diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 89141f1..3203980 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -7,7 +7,7 @@ repos: - id: trailing-whitespace - id: end-of-file-fixer - id: check-yaml - - id: check-added-large-files + # - id: check-added-large-files exclude: '.*\.md$' # mdでend-of-file-fixerが謎の挙動をするので除外 # hadolint - repo: https://github.com/hadolint/hadolint diff --git a/Dockerfile b/Dockerfile index 762961f..13e7e08 100644 --- a/Dockerfile +++ b/Dockerfile @@ -9,23 +9,15 @@ RUN npm install && npm run build FROM public.ecr.aws/eks-distro-build-tooling/eks-distro-minimal-base-nginx:latest-al23 COPY --from=build /app/build /usr/share/nginx/html COPY nginx.conf /etc/nginx/nginx.conf -#COPY default.conf /etc/nginx/conf.d/default.conf - # Change owner to allow non-root users to start the service USER root -# RUN < +see detail + +```shell +copilot env init +Environment name: prod-env + + Which credentials would you like to use to create hoge? [Use arrows to move, type to filter, ? for more help] + Enter temporary credentials + > [profile default] + + +Environment name: prod-env +Credential source: [profile default] +Would you like to use the default configuration for a new environment? + - A new VPC with 2 AZs, 2 public subnets and 2 private subnets + - A new ECS Cluster + - New IAM Roles to manage services and jobs in your environment + [Use arrows to move, type to filter] + Yes, use default. + Yes, but I'd like configure the default resources (CIDR ranges, AZs). + > No, I'd like to import existing resources (VPC, subnets). + + +Environment name: prod-env +Credential source: [profile default] +Default environment configuration? No, I'd like to import existing resources + + Which VPC would you like to use? [Use arrows to move, type to filter] + > vpc-xxxxxxxxxxxxxxxxx (copilot-react-app-dev-env) +``` + +- environmentをデプロイ + +```shell +copilot env deploy +``` + +- prod用のserviceを作成してデプロイする。 +この際に間違えてdev-svcやdev-envを選ばないように注意する。 + +```shell +DOCKER_DEFAULT_PLATFORM=linux/amd64 copilot svc init +copilot svc deploy +``` +- ブラウザからアクセスできるか試してみる。 + +```shell +copilot svc show # urlが出てくるので +``` + + +### CodePipelineの作成 +- 名前は任意だが，自分はreact-app-pipelineとした。 + +```shell +copilot pipeline init +``` +- [manifest.yml](./copilot/pipelines/react-app-pipeline/manifest.yml)を編集してdevelopmentでサービス開始後にユーザが承認した後にproductionにデプロイされるようにする。 + +``` + requires_approval: true +``` +- 先にgithubに設定ファイルをアップロードしてからpipelineをデプロイする + +```shell +git add . +git commit -m "add pipeline" +git push +copilot pipeline deploy +``` +- ACTION REQUIREDが出るのでURLにアクセスし，pendingになっているpipelineとGitHubを接続する設定を追加する。 +- 一度pipelineをデプロイすると以後，指定したGitHubのブランチにマージされるたびにCode Pipelineを通してデプロイが進むようになる。 +****** + + +## その他の設定 +- ローカルでのセットアップが必用なのはgit-secretsとpre-commitくらい + +```shell +cd devsecops-demo-aws-ecs +pre-commit install + +git secrets --install +git secrets --register-aws # awsのクレデンシャル検知ルールを登録 +``` +- VSCodeのExtensionsもお好みで。Dockerのhadolintはおすすめ。 + +- GitHub Actionsがスキャン結果のファイルをアップロードできるように権限をつける。詳細は[semgrepのyaml](./.github/workflows/react-semgrep.yaml)を参照。 +****** + + # HOW TO USE -# REFERENCE +[PREPARING](#PREPARING)の設定後にはGitHubにコードをコミットしたり，pushするだけ。 +****** + + +# MEMO +- [ECSの仕様で非特権ユーザを使用したコンテナでは80番ポートが使えないっぽい](https://repost.aws/questions/QU1bCV9wT4T5iBrrP1c2ISfg/container-cannot-bind-to-port-80-running-as-non-root-user-on-ecs-fargate) --> つまり，localのdockerで80でサービスが起動できてもECSだと権限エラーになる。このため，コンテナで開放するportは8080としている(ALBに対して8080がマッピングされているためブラウザからは80でアクセスできる)。 +> nginx: [emerg] bind() to 0.0.0.0:80 failed (13: Permission denied) diff --git a/copilot/.workspace b/copilot/.workspace index 535c93c..a9afdd4 100644 --- a/copilot/.workspace +++ b/copilot/.workspace @@ -1 +1 @@ -application: roulette-app +application: react-app diff --git a/copilot/dev-svc/manifest.yml b/copilot/dev-svc/manifest.yml index 05dd2e3..fe3a5f3 100644 --- a/copilot/dev-svc/manifest.yml +++ b/copilot/dev-svc/manifest.yml @@ -19,13 +19,11 @@ image: # Docker build arguments. For additional overrides: https://aws.github.io/copilot-cli/docs/manifest/lb-web-service/#image-build build: Dockerfile # Port exposed through your container to route traffic to it. - port: 80 + port: 8080 cpu: 256 # Number of CPU units for the task. memory: 512 # Amount of memory in MiB used by the task. -count: # Number of tasks that should be running in your service. - range: 1-2 - cpu_percentage: 50 +count: 1 # Number of tasks that should be running in your service. exec: true # Enable running commands in your container. network: connect: true # Enable Service Connect for intra-environment traffic between services. diff --git a/copilot/environments/app-scanner-env/manifest.yml b/copilot/environments/app-scanner-env/manifest.yml deleted file mode 100644 index d2d5f23..0000000 --- a/copilot/environments/app-scanner-env/manifest.yml +++ /dev/null @@ -1,30 +0,0 @@ -# The manifest for the "app-scanner-env" environment. -# Read the full specification for the "Environment" type at: -# https://aws.github.io/copilot-cli/docs/manifest/environment/ - -# Your environment name will be used in naming your resources like VPC, cluster, etc. -name: app-scanner-env -type: Environment - -# Import your own VPC and subnets or configure how they should be created. -network: - vpc: - id: vpc-03581f28225eebcf8 - subnets: - public: - - id: subnet-02af5dce7bdaae4c9 - - id: subnet-070a378ffc7a92766 - - id: subnet-0bfd16c35ed005f62 - private: - - id: subnet-059ce9420f335d7b0 - - id: subnet-0cb914099ba5f287b - - id: subnet-003d479c3698684de - -# Configure the load balancers in your environment, once created. -# http: -# public: -# private: - -# Configure observability for your environment resources. -observability: - container_insights: false diff --git a/copilot/environments/dev-env/manifest.yml b/copilot/environments/dev-env/manifest.yml index 2dace23..1c14f97 100644 --- a/copilot/environments/dev-env/manifest.yml +++ b/copilot/environments/dev-env/manifest.yml @@ -7,18 +7,9 @@ name: dev-env type: Environment # Import your own VPC and subnets or configure how they should be created. -network: - vpc: - id: vpc-03581f28225eebcf8 - subnets: - public: - - id: subnet-02af5dce7bdaae4c9 - - id: subnet-070a378ffc7a92766 - - id: subnet-0bfd16c35ed005f62 - private: - - id: subnet-059ce9420f335d7b0 - - id: subnet-0cb914099ba5f287b - - id: subnet-003d479c3698684de +# network: +# vpc: +# id: # Configure the load balancers in your environment, once created. # http: diff --git a/copilot/environments/prod-env/manifest.yml b/copilot/environments/prod-env/manifest.yml index e96aa53..8102c47 100644 --- a/copilot/environments/prod-env/manifest.yml +++ b/copilot/environments/prod-env/manifest.yml @@ -9,16 +9,14 @@ type: Environment # Import your own VPC and subnets or configure how they should be created. network: vpc: - id: vpc-03581f28225eebcf8 + id: vpc-0e2c3939c6159987c subnets: public: - - id: subnet-02af5dce7bdaae4c9 - - id: subnet-070a378ffc7a92766 - - id: subnet-0bfd16c35ed005f62 + - id: subnet-077af848ce2255562 + - id: subnet-074c71e5fac150d04 private: - - id: subnet-059ce9420f335d7b0 - - id: subnet-0cb914099ba5f287b - - id: subnet-003d479c3698684de + - id: subnet-0c572ccc92f2f825f + - id: subnet-0209edab730676d3e # Configure the load balancers in your environment, once created. # http: diff --git a/copilot/pipelines/tomita-pipeline/buildspec.yml b/copilot/pipelines/react-app-pipeline/buildspec.yml similarity index 94% rename from copilot/pipelines/tomita-pipeline/buildspec.yml rename to copilot/pipelines/react-app-pipeline/buildspec.yml index 5ad0c4b..a84fc8e 100644 --- a/copilot/pipelines/tomita-pipeline/buildspec.yml +++ b/copilot/pipelines/react-app-pipeline/buildspec.yml @@ -17,7 +17,7 @@ phases: - ls -l - export COLOR="false" - export CI="true" - - pipeline=$(cat $CODEBUILD_SRC_DIR/copilot/pipelines/tomita-pipeline/manifest.yml | ruby -ryaml -rjson -e 'puts JSON.pretty_generate(YAML.load(ARGF))') + - pipeline=$(cat $CODEBUILD_SRC_DIR/copilot/pipelines/react-app-pipeline/manifest.yml | ruby -ryaml -rjson -e 'puts JSON.pretty_generate(YAML.load(ARGF))') - pl_envs=$(echo $pipeline | jq -r '.stages[].name') # Find all the local services in the workspace. - svc_ls_result=$(./copilot-linux svc ls --local --json) diff --git a/copilot/pipelines/tomita-pipeline/manifest.yml b/copilot/pipelines/react-app-pipeline/manifest.yml similarity index 88% rename from copilot/pipelines/tomita-pipeline/manifest.yml rename to copilot/pipelines/react-app-pipeline/manifest.yml index 09d0424..3bd89b3 100644 --- a/copilot/pipelines/tomita-pipeline/manifest.yml +++ b/copilot/pipelines/react-app-pipeline/manifest.yml @@ -1,9 +1,9 @@ -# The manifest for the "tomita-pipeline" pipeline. +# The manifest for the "react-app-pipeline" pipeline. # This YAML file defines your pipeline: the source repository it tracks and the order of the environments to deploy to. # For more info: https://aws.github.io/copilot-cli/docs/manifest/pipeline/ # The name of the pipeline. -name: tomita-pipeline +name: react-app-pipeline # The version of the schema used in this template. version: 1 @@ -16,7 +16,7 @@ source: # Additional properties that further specify the location of the artifacts. properties: branch: master - repository: https://github.com/RyosukeDTomita/react-roulette-frontend + repository: https://github.com/RyosukeDTomita/devsecops-demo-aws-ecs # Optional: specify the name of an existing CodeStar Connections connection. # connection_name: a-connection @@ -28,7 +28,6 @@ stages: # requires_approval: true # Optional: use test commands to validate this stage of your build. # test_commands: [echo 'running tests', make test] - test_commands: [echo 'hogehogehoge'] - # The name of the environment. name: prod-env diff --git a/copilot/prod-svc/manifest.yml b/copilot/prod-svc/manifest.yml index b242507..79d94e4 100644 --- a/copilot/prod-svc/manifest.yml +++ b/copilot/prod-svc/manifest.yml @@ -19,7 +19,7 @@ image: # Docker build arguments. For additional overrides: https://aws.github.io/copilot-cli/docs/manifest/lb-web-service/#image-build build: Dockerfile # Port exposed through your container to route traffic to it. - port: 80 + port: 8080 cpu: 256 # Number of CPU units for the task. memory: 512 # Amount of memory in MiB used by the task. diff --git a/doc/fig/cfn/app-infrastructure-roles.png b/doc/fig/cfn/app-infrastructure-roles.png new file mode 100644 index 0000000..9d30ea4 Binary files /dev/null and b/doc/fig/cfn/app-infrastructure-roles.png differ diff --git a/doc/fig/cfn/app-infrastructure.png b/doc/fig/cfn/app-infrastructure.png new file mode 100644 index 0000000..66e600b Binary files /dev/null and b/doc/fig/cfn/app-infrastructure.png differ diff --git a/doc/fig/cfn/env.png b/doc/fig/cfn/env.png new file mode 100644 index 0000000..f41a729 Binary files /dev/null and b/doc/fig/cfn/env.png differ diff --git a/doc/fig/cfn/pipeline.png b/doc/fig/cfn/pipeline.png new file mode 100644 index 0000000..780199e Binary files /dev/null and b/doc/fig/cfn/pipeline.png differ diff --git a/doc/fig/cfn/svc.png b/doc/fig/cfn/svc.png new file mode 100644 index 0000000..7b76db7 Binary files /dev/null and b/doc/fig/cfn/svc.png differ diff --git a/doc/tools_doc/git-secret.md b/doc/tools_doc/git-secret.md new file mode 100644 index 0000000..774a891 --- /dev/null +++ b/doc/tools_doc/git-secret.md @@ -0,0 +1,24 @@ +# git secrets +- パスワードのシークレットと思われる文字列を検知する。 +- pre-commitを使って実装されているらしい。 +## 環境構築 + +```shell +cd ~/Downloads +wget https://github.com/awslabs/git-secrets/archive/refs/tags/1.3.0.tar.gz +tar zxvf 1.3.0.tar.gz +cd git-secrets-1.3.0/ +ls +sudo make install +git secrets # 動作確認 +``` +## 使用方法 +- プロジェクトに移動して以下を実行 + +```shell +git secrets --install +git secrets --register-aws # awsのクレデンシャル検知ルールを登録 +git secrets --list # 設定を確認 +git secrets --scan # スキャン +``` +- また，コミットしようとした際にもscanが実行されており，特定の文字列が検知されるとコミットできなくなる。 diff --git a/nginx.conf b/nginx.conf index 890043b..c5e19cc 100644 --- a/nginx.conf +++ b/nginx.conf @@ -1,4 +1,3 @@ - # For more information on configuration, see: # * Official English Documentation: http://nginx.org/en/docs/ # * Official Russian Documentation: http://nginx.org/ru/docs/ @@ -35,9 +34,11 @@ http { # for more information. include /etc/nginx/conf.d/*.conf; + + # Use 8080 instead of 80 to avoid the `nginx: [emerg] bind() to 0.0.0.0:80 failed (13: Permission denied)` when using ECS. server { - listen 80; - listen [::]:80; + listen 8080; + listen [::]:8080; server_name _; root /usr/share/nginx/html;