我将文件添加到git存储库,我推送到github,但是我想将我的秘密文件保留在git存储库中.我正在部署到aws使用：
- git aws.push
以下文件位于.gitignore中：
- /config/database.yml
- /config/initializers/omniauth.rb
- /config/initializers/secret_token.rb
在此链接之后,我尝试向我的部署添加一个S3文件：
http://docs.amazonwebservices.com/elasticbeanstalk/latest/dg/customize-containers.html
从该链接引用：
Example Snippet
The following example downloads a zip file from an Amazon S3 bucket and unpacks it into /etc/myapp:
06002
按照这些指示,我将文件上传到S3存储区,并将以下内容添加到.ebextensions目录中的private.config文件中：
- sources:
- /var/app/current/: https://s3.amazonaws.com/mybucket/config.tar.gz
该config.tar.gz文件将解压缩到：
- /config/database.yml
- /config/initializers/omniauth.rb
- /config/initializers/secret_token.rb
但是,当部署应用程序时,不会复制或提取S3主机上的config.tar.gz文件.我仍然收到无法找到database.yml的错误,EC2日志没有配置文件的记录,这里是错误消息：
- Error message:
- No such file or directory - /var/app/current/config/database.yml
- Exception class:
- Errno::ENOENT
- Application root:
- /var/app/current
解决方法
创建Beanstalk应用程序时,会自动创建一个S3 bucket.此桶用于存储应用程序版本,日志,元数据等.
分配给Beanstalk环境的默认aws-elasticbeanstalk-ec2角色已经读取了这个存储桶的访问权限.
所以你需要做的就是将你的敏感文件放在桶中(在桶的根目录或你想要的任何目录结构中),然后创建一个.ebextension配置文件,把它们复制到你的EC2实例中.
这是一个例子：
- # .ebextensions/sensitive_files.config
- Resources:
- AWSEBAutoScalingGroup:
- Metadata:
- AWS::CloudFormation::Authentication:
- S3Auth:
- type: "s3"
- buckets: ["elasticbeanstalk-us-east-1-XXX"] # Replace with your bucket name
- roleName:
- "Fn::GetOptionSetting":
- Namespace: "aws:autoscaling:launchconfiguration"
- OptionName: "IamInstanceProfile"
- DefaultValue: "aws-elasticbeanstalk-ec2-role" # This is the default role created for you when creating a new Beanstalk environment. Change it if you are using a custom role
- files:
- /etc/pki/tls/certs/server.key: # This is where the file will be copied on the EC2 instances
- mode: "000400" # Apply restrictive permissions to the file
- owner: root # Or nodejs,or whatever suits your needs
- group: root # Or nodejs,or whatever suits your needs
- authentication: "S3Auth"
- source: https://s3-us-west-2.amazonaws.com/elasticbeanstalk-us-east-1-XXX/server.key # URL to the file in S3
这在这里记录：http://docs.aws.amazon.com/elasticbeanstalk/latest/dg/https-storingprivatekeys.html