How can Secrets Manager and Parameter Store be integrated with container orchestration platforms like ECS and EKS to securely inject secrets into running applications?

ECS supports referencing Secrets Manager or Parameter Store values directly within a task definition, automatically injecting the decrypted secret value as an environment variable when the container starts, while EKS commonly uses a Secrets Store CSI Driver to mount secrets directly as files within a pod, both approaches avoiding the need to bake sensitive values into a container image or pass them through less secure channels like plain environment variables defined directly in a deployment manifest.

{
  "containerDefinitions": [{
    "secrets": [{"name": "DB_PASSWORD", "valueFrom": "arn:aws:secretsmanager:us-east-1:123456789012:secret:db-password"}]
  }]
}