将环境变量从 codebuild 传递到 codedeploy ec2 实例

Question

I'm new to sre. i building an aws codepipeline using cdk. i need to pass the rds instance information from my rds stack to my codepipeline(ec2) stack. I need a .env file in my ec2 instances. based on my research i saw there is something called environment variables that can do it for me instead of generating a .env file from codebuild. i set up a few environment variables(plain text) in codebuild and try to pass those environment variables into the ec2 instances that was deployed from the codedeploy. i was able to get the correct environment variable values in buildspec.yml. but when i tried to run echo $DB_HOST in ec2 terminal. i got nothing. here is my set up:

codebuild environment variables:

buildspec.yml

version: 0.2
env:
  exported-variables:
    - DB_HOST
    - DB_PORT
    - DB_DATABASE
    - DB_PASSWORD
    - DB_USERNAME
phases:
  install:
    commands:
      - echo $DB_HOST
      - export DB_HOST=$DB_HOST
  pre_build:
    commands:
      - export DB_HOST=$DB_HOST
artifacts:
  files:
    - '**/*'
  name: myname-$(date +%Y-%m-%d)

my appspec.yml

version: 0.0
os: linux
files:
  - source: /
    destination: /var/www/html/
hooks:
  BeforeInstall:
    - location: script/BeforeInstall.sh
      runas: root
  AfterInstall:
    - location: script/AfterInstall.sh
      runas: root

AfterInstall.sh

#!/bin/bash
# Set permissions to storage and bootstrap cache
sudo chmod -R 0777 /var/www/html/storage
sudo chmod -R 0777 /var/www/html/bootstrap/cache
#
cd /var/www/html

#
# Run composer
composer install --ignore-platform-reqs

please help me to pass those environment variables from codebuild to codedeploy ec2. or is there any other way to generate .env file for codebuild?

Answer 1

You can't do this the way you expect it. The proper way is to pass them through SSM Secrets Manager or SSM Paramter Store .

So in your setup, CodeBuild will populate the SSM Secrets Manager or SSM Paramter Store (or you populate them before hand youself), and CodeDeploy will read these secret stores for the parameters.

Answer 2

I found a way to work around with it. here is my solution: since I'm able to get all the environment variables in build stage. i manage to build a .env file in build stage. I have a few environment variables coming in to build stage from secret manager or as plain text. first, i created a .env.exmaple file in my project root directory:

...
APP_ENV=local
APP_KEY=

...

DB_CONNECTION=mysql
DB_HOST=127.0.0.1
DB_PORT=3306
DB_DATABASE=
DB_USERNAME=root
DB_PASSWORD=

MAIL_MAILER=smtp
MAIL_HOST=smtp.sendgrid.net
MAIL_PORT=587
MAIL_USERNAME=apikey
MAIL_PASSWORD=
...

second, i updated my buildspec.yml file and replace each value with environment variable values using sed commands

version: 0.2
env:
  exported-variables:
    - DB_HOST
    - DB_DATABASE
    - DB_PASSWORD
    - DB_USERNAME
  secrets-manager:
    MAIL_PASSWORD: "email-token:MAIL_PASSWORD"
    AWS_ACCESS_KEY_ID: "aws-token:AWS_ACCESS_KEY_ID"
    AWS_SECRET_ACCESS_KEY: "aws-token:AWS_SECRET_ACCESS_KEY"
    AWS_DEFAULT_REGION: "aws-token:AWS_DEFAULT_REGION"
    AWS_BUCKET : "aws-token:AWS_BUCKET"
    AWS_URL : "aws-token:AWS_URL"
phases:
  build:
    commands:
      - cp .env.example .env
      - sed -i "s/DB_HOST=127.0.0.1/DB_HOST=$DB_HOST/g" .env
      - sed -i "s/DB_DATABASE=/DB_DATABASE=$DB_DATABASE/g" .env
      - sed -i "s/DB_USERNAME=root/DB_USERNAME=$DB_USERNAME/g" .env
      - sed -i "s/DB_PASSWORD=/DB_PASSWORD=$DB_PASSWORD/g" .env
      - sed -i "s/APP_ENV=local/APP_ENV=$APP_ENV/g" .env
      - sed -i "s/MAIL_PASSWORD=/MAIL_PASSWORD=$MAIL_PASSWORD/g" .env
...
      - sed -i "s@AWS_URL=@AWS_URL=$AWS_URL@g" .env
artifacts:
  files:
    - '**/*'
  name: myname-$(date +%Y-%m-%d)

in this way, i am able to create a .env file for the deploy stage. i think to notice here is that if your value contain / (for example url), you need to use @ to instead of / for sed commands