Drone CI 搭配 AWS Secrets Manager 疑難排解

將機敏資料放在 .env 是危險的作法，通常會搭配 AWS Secrets Manager、Vault 等工具使用

 

流程

DroneCI pull code -> 取得 secrets 資料 export 到 env -> build

 

AWS Secrets Manager 價格

• 單一筆 secrets 每月 0.4USD
• 一筆可存 N個 key-value
• 每 10,000 次 API 呼叫 0.05 USD
• 複製到其他 region，需另計一份

  drone-server:
    image: drone/drone:2
    ports:
      - 8888:80
      - 443
    restart: always
    volumes:
      - /home/my/droneci_docker:/data
    environment:
      - DRONE_AGENTS_ENABLED=true
      - DRONE_BITBUCKET_CLIENT_ID=${DRONE_BITBUCKET_CLIENT_ID}
      - DRONE_BITBUCKET_CLIENT_SECRET=${DRONE_BITBUCKET_CLIENT_SECRET}
      - DRONE_RPC_SECRET=${DRONE_RPC_SECRET}
      - DRONE_SERVER_HOST=${SERVER_HOST}
      - DRONE_SERVER_PROTO=http

  drone-runner:
    image: drone/drone-runner-docker:1
    ports:
      - 3000
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      DRONE_RPC_PROTO: http
      DRONE_RPC_HOST: drone-server
      DRONE_RPC_SECRET: ${DRONE_RPC_SECRET}
      DRONE_RUNNER_CAPACITY: 3
      DRONE_SECRET_PLUGIN_ENDPOINT: http://drone-aws-secret:3000
      DRONE_SECRET_PLUGIN_TOKEN: xx1234

  drone-aws-secret:
    image: drone/amazon-secrets
    ports:
      - 3000
    environment:
      - DEBUG=true
      - SECRET_KEY=xx1234
      - AWS_ACCESS_KEY_ID=從IAM產
      - AWS_SECRET_ACCESS_KEY=從IAM產
      - AWS_REGION=secret所在region     #官方文件沒說的重點

其餘細節請參考官方文件

https://readme.drone.io/secret/external/aws/