diff --git a/packages/@aws-cdk/aws-ecs/README.md b/packages/@aws-cdk/aws-ecs/README.md
index bf67ee5437d26..aa83bf6c8f91b 100644
--- a/packages/@aws-cdk/aws-ecs/README.md
+++ b/packages/@aws-cdk/aws-ecs/README.md
@@ -868,13 +868,15 @@ taskDefinition.addContainer('TheContainer', {
 ### splunk Log Driver
 
 ```ts
+declare const secret: secretsmanager.Secret;
+
 // Create a Task Definition for the container to start
 const taskDefinition = new ecs.Ec2TaskDefinition(this, 'TaskDef');
 taskDefinition.addContainer('TheContainer', {
   image: ecs.ContainerImage.fromRegistry('example-image'),
   memoryLimitMiB: 256,
   logging: ecs.LogDrivers.splunk({
-    token: SecretValue.secretsManager('my-splunk-token'),
+    secretToken: secret,
     url: 'my-splunk-url',
   }),
 });
diff --git a/packages/@aws-cdk/aws-ecs/lib/log-drivers/splunk-log-driver.ts b/packages/@aws-cdk/aws-ecs/lib/log-drivers/splunk-log-driver.ts
index 0069db85635df..87582fbd18be8 100644
--- a/packages/@aws-cdk/aws-ecs/lib/log-drivers/splunk-log-driver.ts
+++ b/packages/@aws-cdk/aws-ecs/lib/log-drivers/splunk-log-driver.ts
@@ -37,11 +37,8 @@ export interface SplunkLogDriverProps extends BaseLogDriverProps {
    *
    * The splunk-token is added to the SecretOptions property of the Log Driver Configuration. So the secret value will not be
    * resolved or viewable as plain text.
-   *
-   * Please provide at least one of `token` or `secretToken`.
-   * @default - If secret token is not provided, then the value provided in `token` will be used.
    */
-  readonly secretToken?: Secret;
+  readonly secretToken: Secret;
 
   /**
    * Path to your Splunk Enterprise, self-service Splunk Cloud instance, or Splunk
diff --git a/packages/@aws-cdk/aws-ecs/test/splunk-log-driver.test.ts b/packages/@aws-cdk/aws-ecs/test/splunk-log-driver.test.ts
index b33b4155615a4..02786fa5d61cc 100644
--- a/packages/@aws-cdk/aws-ecs/test/splunk-log-driver.test.ts
+++ b/packages/@aws-cdk/aws-ecs/test/splunk-log-driver.test.ts
@@ -209,16 +209,4 @@ describe('splunk log driver', () => {
       ],
     });
   });
-
-  test('throws when neither token nor secret token are provided', () => {
-    expect(() => {
-      td.addContainer('Container', {
-        image,
-        logging: ecs.LogDrivers.splunk({
-          url: 'my-splunk-url',
-        }),
-        memoryLimitMiB: 128,
-      });
-    }).toThrow('Please provide either token or secretToken.');
-  });
 });