CI/CD - Hardcoded AWS Credentials in `deploy.yml`

[Sumith-Kumar-Saini]

The GitHub Actions workflow (.github/workflows/deploy.yml) contains hardcoded AWS ECR registry IDs, cluster names, and region values.
This can cause deployment failures when deploying to different environments or accounts, and may expose internal infrastructure details.

Example:

- name: Build and Push Docker image to ECR
  run: |
    echo "deploying TestApp to AWS ECS"
    aws ecr get-login-password --region ap-south-1 | docker login --username AWS --password-stdin 329599656829.dkr.ecr.ap-south-1.amazonaws.com
    docker build -t testdog .
    docker tag testdog:latest 329599656829.dkr.ecr.ap-south-1.amazonaws.com/testdog:latest
    docker push 329599656829.dkr.ecr.ap-south-1.amazonaws.com/testdog:latest

    aws ecs update-service \
    --cluster testdog-cluster \
    --service testdog-api \
    --force-new-deployment \
    --region ap-south-1 \
    --task-definition testdog-api

Suggested Fix:

• Replace all hardcoded identifiers with GitHub Secrets or workflow inputs, e.g:

${{ secrets.AWS_REGION }}
${{ secrets.ECR_REGISTRY }}
${{ secrets.ECR_REPOSITORY }}
${{ secrets.ECR_CLUSTER }}
${{ secrets.ECR_SERVICE }}
${{ secrets.ECR_DEFINITION }}

• Update .env.example, and documentation to include these variables.

Impact:
Is High - Prevents flexible, secure multi-environment deployments and exposes sensitive infrastructure details.

Files Affected:
.github/workflows/deploy.yml