DevOps Stack Exchange is a question and answer site for software engineers working on automated testing, continuous delivery, service integration and monitoring, and building SDLC infrastructure. It only takes a minute to sign up.
Sign up to join this community
I want to setup an auto-scaling configuration but cannot think how I can securely get code from a private repo when I spin up new instances.
I obviously don't want to put passwords in startup scripts, or store private keys somewhere that can be downloaded without a password.
How can I achieve this?
Option 1: You could place your private repo in the same VPC as the instance and then pull code from there. Just make sure the repo cannot be accessed from outside the VPC.
Option 2: Ssh into the new instance and SCP the binary over.
Option 3: Use docker and deploy a private container registry (e.g. Amazon ECR). Build the image on your machine / build server and then push it to the registry from where it is available to your instances to pull and execute.
Another option is to use saltstack's product: salt
This Configuration Management System (CMS) can protect sensitive data in three ways.
1) Pillars; these are securely stored and encrypted key:value or key:list dictionaries stored on your primary computer(s) that you manage the entire cluster from.
This will allow you to create salt scripts that can have that data inserted at time of running into the scripts (so not stored in the actual scripts).
2) GPG cipher; this allows you to write in actual passwords and keys into scripts and have them encrypted into hashes as placeholders for when you store these scripts into a revision control system (github/gitlab/bitbucket).
The GPG key used for encrypting/decrypting is stored on your primary computer (master) for managing the cluster.
3) Salt-cloud; all of your salt scripts are stored in the /srv/salt/ directory on the primary machine, however the credentials/keys for spinning up VMs in the cloud is stored in /etc/salt/ directory.
This allows you to store the work you share with other people on a project in github, but all the sensitive data salt needs to spin up more resources isnt even in the same directory to be recorded.
This will probably super simplify your devops related code as well if you end up using this product.
Resources: - GPG Render - salt-cloud - pillars
If the repo is on AWS Codecommit, you should be able to access it via a role setup for each type of instance.
See under IAM role here https://docs.aws.amazon.com/codecommit/latest/userguide/auth-and-access-control.html
