ruby-on-rails – 如何将秘密文件推送到使用亚马逊web服务及其弹性beanstalk的EC2 Ruby on Rails应用程序？

秘密文件应如何使用亚马逊的Web服务和弹性beanstalk推送到EC2 Ruby on Rails应用程序？

我将文件添加到git存储库,我推送到github,但是我想将我的秘密文件保留在git存储库中.我正在部署到aws使用：

git aws.push

以下文件位于.gitignore中：

/config/database.yml
/config/initializers/omniauth.rb
/config/initializers/secret_token.rb

在此链接之后,我尝试向我的部署添加一个S3文件：
http://docs.amazonwebservices.com/elasticbeanstalk/latest/dg/customize-containers.html

从该链接引用：

Example Snippet

The following example downloads a zip file from an Amazon S3 bucket and unpacks it into /etc/myapp:

06002

按照这些指示,我将文件上传到S3存储区,并将以下内容添加到.ebextensions目录中的private.config文件中：

sources:
  /var/app/current/: https://s3.amazonaws.com/mybucket/config.tar.gz

该config.tar.gz文件将解压缩到：

/config/database.yml
/config/initializers/omniauth.rb
/config/initializers/secret_token.rb

但是,当部署应用程序时,不会复制或提取S3主机上的config.tar.gz文件.我仍然收到无法找到database.yml的错误,EC2日志没有配置文件的记录,这里是错误消息：

Error message:
  No such file or directory - /var/app/current/config/database.yml
Exception class:
  Errno::ENOENT
Application root:
  /var/app/current

解决方法

将敏感文件存储在S3中是可能的(并且很容易),并将它们自动复制到Beanstalk实例中.

创建Beanstalk应用程序时,会自动创建一个S3 bucket.此桶用于存储应用程序版本,日志,元数据等.

分配给Beanstalk环境的默认aws-elasticbeanstalk-ec2角色已经读取了这个存储桶的访问权限.

所以你需要做的就是将你的敏感文件放在桶中(在桶的根目录或你想要的任何目录结构中),然后创建一个.ebextension配置文件,把它们复制到你的EC2实例中.

这是一个例子：

# .ebextensions/sensitive_files.config

Resources:
  AWSEBAutoScalingGroup:
    Metadata:
      AWS::CloudFormation::Authentication:
        S3Auth:
          type: "s3"
          buckets: ["elasticbeanstalk-us-east-1-XXX"] # Replace with your bucket name
          roleName: 
            "Fn::GetoptionSetting": 
              Namespace: "aws:autoscaling:launchconfiguration"
              OptionName: "IamInstanceProfile"
              DefaultValue: "aws-elasticbeanstalk-ec2-role" # This is the default role created for you when creating a new Beanstalk environment. Change it if you are using a custom role

files:
  /etc/pki/tls/certs/server.key: # This is where the file will be copied on the EC2 instances
    mode: "000400" # Apply restrictive permissions to the file
    owner: root # Or nodejs,or whatever suits your needs
    group: root # Or nodejs,or whatever suits your needs
    authentication: "S3Auth"
    source: https://s3-us-west-2.amazonaws.com/elasticbeanstalk-us-east-1-XXX/server.key # URL to the file in S3

这在这里记录：http://docs.aws.amazon.com/elasticbeanstalk/latest/dg/https-storingprivatekeys.html