Environment variables using AWS CodeDeploy

amazon ec2amazon-web-servicesenvironment-variablesunix

I have a web application that utilizes environment variables for some of its configuration (DB credentials, API keys, etc). I'm currently using Elastic Beanstalk for deployment and can easily set these from within AWS, which is great because I don't have this sensitive data in my code base.

However, I'm looking into switching from Elastic Beanstalk so I can leverage a bit more flexibility with my web instances, and naturally I'm looking into deploying (from my Codeship CI setup) using CodeDeploy. CodeDeploy is fairly straight forward and I've integrated it with Codeship just fine, but I noticed there's no built-in feature to set environment variables with CodeDeploy like there is with Elastic Beanstalk. Does anyone have any best practices for this process?

Best Answer

Amazon has quite an neat feature for this: Parameter Store. You can add key/value pairs there, securely encrypted, and then retrieve them in your CodeDeploy scripts, eg:

password=$(aws ssm get-parameters --region us-east-1 --names MySecureSQLPassword --with-decryption --query Parameters[0].Value)

You'll need to do some IAM setup to allow access between CodeDeploy/Parameter Store, but the linked article above walks you through this.

Related Solutions

Linux – Check Environment Variables of a Running Process on Unix

cat /proc/<pid>/environ

If you want to have pid(s) of a given running executable you can, among a number of other possibilities, use pidof:

AlberT$ pidof sshd   
30690 6512

EDIT:

I totally quote Dennis Williamson and Teddy comments to achieve a more readable output. My solution is the following:

tr '\0' '\n' < /proc/<pid>/environ

Linux (Ubuntu) environment variables, shells and security

Using a configuration file, and adding the variables through the application's startup script is really the correct way to handle this. If you need to provide certain environment variables to non-shell scripts or binaries (like perl, python, or java), you can call them with a shell wrapper, provide the needed variables, and then exec the real script.

If your applications are started by some sort of script, it must be started by calling a shell (the shebang at the top of the file), even if the user has no login shell. You could therefor modify the environment variables through the shell's rc files just as you would for regular users. I believe you would still need to insert the BASH_ENV variable to get the rc files to trigger, since you're calling the script non-interactively.

I'm going to highly recommend that you use the former method, and create some sort of configuration for the applications. It will be much easier to manage in the long run.

Best Answer

Related Solutions

Linux – Check Environment Variables of a Running Process on Unix

Linux (Ubuntu) environment variables, shells and security

Related Topic