resource/aws_ecs_task_definition: prevent spurious secret diffs

internal/service/ecs/task_definition.go

@@ -84,6 +84,7 @@ func ResourceTaskDefinition() *schema.Resource {
 					// but they still show in the plan if some other property changes).
 					orderedCDs, _ := expandContainerDefinitions(v.(string))
 					containerDefinitions(orderedCDs).OrderEnvironmentVariables()
+					containerDefinitions(orderedCDs).OrderSecrets()
 					unnormalizedJson, _ := flattenContainerDefinitions(orderedCDs)
 					json, _ := structure.NormalizeJsonString(unnormalizedJson)
 					return json
@@ -613,6 +614,7 @@ func resourceTaskDefinitionRead(ctx context.Context, d *schema.ResourceData, met
 	// (diff is suppressed if the environment variables haven't changed, but they still show in the plan if
 	// some other property changes).
 	containerDefinitions(taskDefinition.ContainerDefinitions).OrderEnvironmentVariables()
+	containerDefinitions(taskDefinition.ContainerDefinitions).OrderSecrets()
 
 	defs, err := flattenContainerDefinitions(taskDefinition.ContainerDefinitions)
 	if err != nil {

internal/service/ecs/task_definition_equivalency.go

@@ -61,6 +61,7 @@
 func (cd containerDefinitions) Reduce(isAWSVPC bool) error {
 	// Deal with fields which may be re-ordered in the API
 	cd.OrderEnvironmentVariables()
+	cd.OrderSecrets()
 
 	for i, def := range cd {
 		// Deal with special fields which have defaults
@@ -112,3 +113,11 @@
 		})
 	}
 }
+
+func (cd containerDefinitions) OrderSecrets() {
+	for _, def := range cd {
+		sort.Slice(def.Secrets, func(i, j int) bool {
+			return aws.StringValue(def.Secrets[i].Name) < aws.StringValue(def.Secrets[j].Name)
+		})
+	}
+}