An ECS task definition injects the database password with the secrets field from Secrets Manager. After the secret is rotated, running tasks still use the old password. Why?

ECS reads the secret only once, when the task starts. It uses the execution role to read it, then sets it as an environment variable. Running containers never see later changes to the secret. So after rotation you have two choices:
• Redeploy the service, so new tasks start with the new value.
• Make the app fetch the secret at runtime with the SDK, and refresh it.

"ECS caches secrets for 24 hours before refreshing them" is wrong: there is no timed cache. ECS never refreshes the value in a running task.