Payroll Database Credentials

A payroll service runs as containers on ECS with Fargate and connects to a PostgreSQL database on RDS. An audit found the database password written in plain text in the task definition and shared by every developer. The auditors now require that no credential appears in code, configuration or environment files, that the database password changes automatically every thirty days without an outage or a redeploy, and that only the payroll tasks themselves, not every workload in the account, can read it. Access must be granted to the service rather than to people, and the secret must be encrypted with a key the security team manages.