diff --git a/aws/ecs/execution-role.tf b/aws/ecs/execution-role.tf
index 13a26841..d456a8ea 100644
--- a/aws/ecs/execution-role.tf
+++ b/aws/ecs/execution-role.tf
@@ -149,10 +149,10 @@ resource "aws_iam_role_policy" "ecs-task-execution-policy" {
 }
 
 locals {
-  kms_and_secret_arns = flatten([
+  kms_and_secret_arns = compact(flatten([
     var.secrets_arns,
     var.kms_key_arns,
-  ])
+  ]))
 }
 
 # Making secret/kms ARNs optional was added later.