我的目标是将詹金斯构建为docker映像,并将其部署到AWS弹性beanstalk。
要构建docker映像,我正在使用配置作为代码插件,并通过dockerfile中的环境变量注入所有秘密。
我现在要弄清楚的是如何使用CloudFormation或Codepipeline自动化此部署。
我的问题是:
- 我可以使用CloudFormation或CodePipeline从AWS Secrets Manager中获取秘密,并将它们作为部署中的环境变量注射到Elastic Beanstalk中?
不确定为什么要以这种方式做事,但是您不能只使用AWS CLI从您的ELB实例中直接从Secrets Manager那里获取秘密?
云形式模板可以从Secrets Manager中恢复秘密。这有点丑陋,但效果很好。通常,我使用Security.yaml嵌套堆栈为我在SM中生成秘密,然后在其他堆栈中恢复它们。
我不能对EB说话太多,但是如果您通过CF部署了它,那么这应该有所帮助。
在SM(cf Security.yaml(中生成一个秘密:
Parameters:
DeploymentEnvironment:
Type: String
Description: Deployment environment, e.g. prod, stage, qa, dev, or userdev
Default: "dev"
...
Resources:
...
RegistryDbAdminCreds:
Type: 'AWS::SecretsManager::Secret'
Properties:
Name: !Sub "RegistryDbAdminCreds-${DeploymentEnvironment}"
Description: "RDS master uid/password for artifact registry database."
GenerateSecretString:
SecretStringTemplate: '{"username": "artifactadmin"}'
GenerateStringKey: "password"
PasswordLength: 30
ExcludeCharacters: '"@/+//:*`"'
Tags:
-
Key: AppName
Value: RegistryDbAdminCreds
使用另一个yaml中的秘密:
Parameters:
DeploymentEnvironment:
Type: String
Description: Deployment environment, e.g. prod, stage, qa, dev, or userdev
Default: "dev"
...
Resources:
DB:
Type: 'AWS::RDS::DBInstance'
DependsOn: security
Properties:
Engine: postgres
DBInstanceClass: db.t2.small
DBName: quilt
MasterUsername: !Sub '{{resolve:secretsmanager:RegistryDbAdminCreds-${DeploymentEnvironment}:SecretString:username}}'
MasterUserPassword: !Sub '{{resolve:secretsmanager:RegistryDbAdminCreds-${DeploymentEnvironment}:SecretString:password}}'
StorageType: gp2
AllocatedStorage: "100"
PubliclyAccessible: true
DBSubnetGroupName: !Ref SubnetGroup
MultiAZ: true
VPCSecurityGroups:
- !GetAtt "network.Outputs.VPCSecurityGroup"
Tags:
- Key: Name
Value: !Join [ '-', [ !Ref StackName, "dbinstance", !Ref DeploymentEnvironment ] ]
技巧在!Sub '{{resolve:secretsmanager:RegistryDbAdminCreds-${DeploymentEnvironment}:SecretString:username}}'
和!Sub '{{resolve:secretsmanager:RegistryDbAdminCreds-${DeploymentEnvironment}:SecretString:password}}'