如何在EC2实例中克隆私有Git存储库

Question

I have a lambda function which starts an EC2 instance. I specify in the boto3 call the user_data some bash script which install dependencies and start services.

I would like to clone a private Bitbucket repository at that time, so my question is...

What is the best practice in this case?

I am thinking about download some ssh keys from S3 and configure everything with the user_data script but I think is not a good practice.

Suggestions?

Thanks in advance!

Answer 1

Finally I managed the SSH key inside a S3 bucket and provision that key with the following code in the user_data script:

aws s3 cp s3://<bucket_name>/resources/id_rsa id_rsa --region <your_region>
chmod 600 id_rsa
mkdir -p /root/.ssh
ssh-keyscan -t rsa <your_domain> > /root/.ssh/known_hosts
mv id_rsa /root/.ssh/id_rsa

Of course that bucket is protected in order to avoid an accidental exposure of the key.