[BSVR-249] 환경변수 관리를 위한 AWS Secret Manger 도입

.github/workflows/dev-build-and-deploy.yaml

@@ -24,6 +24,13 @@ jobs:
                     java-version: "17"
                     distribution: "corretto"
 
+            -   name: Configure AWS credentials
+                uses: aws-actions/configure-aws-credentials@v1
+                with:
+                    aws-access-key-id: ${{ secrets.AWS_S3_ACCESS_KEY }}
+                    aws-secret-access-key: ${{ secrets.AWS_S3_SECRET_KEY }}
+                    aws-region: ap-northeast-2
+
             -   name: Cache Gradle
                 uses: actions/cache@v3
                 with:
@@ -111,36 +118,10 @@ jobs:
                           -p 9292:9292 \
                           -p 3100:3100 \
                           -e SPRING_PROFILES_ACTIVE=dev \
-                          -e SPRING_SERVLET_MULTIPART_MAX-FILE-SIZE=30MB \
-                          -e SPRING_SERVLET_MULTIPART_MAX-REQUEST-SIZE=30MB \
-                          -e AWS_REDIS_HOST=${{ secrets.DEV_REDIS_HOST }} \
-                          -e AWS_REDIS_PORT=${{ secrets.DEV_REDIS_PORT }}  \
-                          -e SPRING_DATASOURCE_URL=${{ secrets.DEV_DB_URL }} \
-                          -e SPRING_DATASOURCE_USERNAME=${{ secrets.DEV_DB_USERNAME }} \
-                          -e SPRING_DATASOURCE_PASSWORD=${{ secrets.DEV_DB_PASSWORD }} \
-                          -e SPRING_JWT_SECRET=${{ secrets.JWT_SECRET }} \
-                          -e OAUTH_CLIENTID=${{ secrets.KAKAO_CLIENT_ID }} \
-                          -e OAUTH_KAUTHTOKENURLHOST=${{ secrets.KAUTH_TOKEN_URL_HOST }} \
-                          -e OAUTH_KAUTHUSERURLHOST=${{ secrets.KAUTH_USER_URL_HOST }} \
-                          -e OAUTH_KAKAOCLIENTID=${{ secrets.OAUTH_KAKAOCLIENTID }} \
-                          -e OAUTH_KAKAOAUTHTOKENURLHOST=${{ secrets.KAKAOAUTHTOKENURLHOST }} \
-                          -e OAUTH_KAKAOAUTHUSERURLHOST=${{ secrets.KAKAOAUTHUSERURLHOST }} \
-                          -e OAUTH_KAKAOREDIRECTURL=${{ secrets.KAKAOREDIRECTURL }} \
-                          -e OAUTH_GOOGLECLIENTID=${{ secrets.GOOGLECLIENTID }} \
-                          -e OAUTH_GOOGLECLIENTSECRET=${{ secrets.GOOGLECLIENTSECRET }} \
-                          -e OAUTH_GOOGLEREDIRECTURL=${{ secrets.GOOGLEREDIRECTURL }} \
-                          -e OAUTH_GOOGLEAUTHTOKENURLHOST=${{ secrets.GOOGLEAUTHTOKENURLHOST }} \
-                          -e OAUTH_GOOGLEUSERURLHOST=${{ secrets.GOOGLEUSERURLHOST }} \
                           -e SPRING_JPA_HIBERNATE_DDL_AUTO=validate \
-                          -e AWS_S3_ACCESS_KEY=${{ secrets.AWS_S3_ACCESS_KEY }} \
-                          -e AWS_S3_SECRET_KEY=${{ secrets.AWS_S3_SECRET_KEY }} \
-                          -e AWS_S3_BUCKET_NAME=${{ secrets.DEV_AWS_S3_BUCKET_NAME }} \
-                          -e AWS_S3_BASICPROFILEIMAGEURL=${{ secrets.BASICPROFILEIMAGEURL }} \
+                          -e SPRING_CREDENTIALS_ACCESS_KEY=${{secrets.AWS_S3_ACCESS_KEY}} \
+                          -e SPRING_CREDENTIALS_SECRET_KEY=${{secrets.AWS_S3_SECRET_KEY}} \
                           -e TZ=Asia/Seoul \
-                          -e SENTRY_DSN=${{ secrets.SENTRY_DSN }} \
-                          -e SENTRY_ENABLE_TRACING=true \
-                          -e SENTRY_ENVIRONMENT=prod \
-                          -e LOKI_URL=${{ secrets.LOKI_SERVER_URL }} \
                           ${{ secrets.DOCKERHUB_USERNAME }}/spot-server:dev-${{ github.sha }}
                         docker system prune -af
 

.github/workflows/manual-prod-deploy.yaml

@@ -48,35 +48,9 @@ jobs:
                           -p 9292:9292 \
                           -p 3100:3100 \
                           -e SPRING_PROFILES_ACTIVE=prod \
-                          -e SPRING_SERVLET_MULTIPART_MAX-FILE-SIZE=30MB \
-                          -e SPRING_SERVLET_MULTIPART_MAX-REQUEST-SIZE=30MB \
-                          -e AWS_REDIS_HOST=${{ secrets.PROD_REDIS_HOST }} \
-                          -e AWS_REDIS_PORT=${{ secrets.PROD_REDIS_PORT }}  \
-                          -e SPRING_DATASOURCE_URL=${{ secrets.PROD_DB_URL }} \
-                          -e SPRING_DATASOURCE_USERNAME=${{ secrets.PROD_DB_USERNAME }} \
-                          -e SPRING_DATASOURCE_PASSWORD=${{ secrets.PROD_DB_PASSWORD }} \
-                          -e SPRING_JWT_SECRET=${{ secrets.JWT_SECRET }} \
-                          -e KAKAO_CLIENT_ID=${{ secrets.KAKAO_CLIENT_ID }} \
-                          -e OAUTH_KAUTHTOKENURLHOST=${{ secrets.KAUTH_TOKEN_URL_HOST }} \
-                          -e OAUTH_KAUTHUSERURLHOST=${{ secrets.KAUTH_USER_URL_HOST }} \
-                          -e OAUTH_KAKAOCLIENTID=${{ secrets.OAUTH_KAKAOCLIENTID }} \
-                          -e OAUTH_KAKAOAUTHTOKENURLHOST=${{ secrets.KAKAOAUTHTOKENURLHOST }} \
-                          -e OAUTH_KAKAOAUTHUSERURLHOST=${{ secrets.KAKAOAUTHUSERURLHOST }} \
-                          -e OAUTH_KAKAOREDIRECTURL=${{ secrets.KAKAOREDIRECTURL }} \
-                          -e OAUTH_GOOGLECLIENTID=${{ secrets.GOOGLECLIENTID }} \
-                          -e OAUTH_GOOGLECLIENTSECRET=${{ secrets.GOOGLECLIENTSECRET }} \
-                          -e OAUTH_GOOGLEREDIRECTURL=${{ secrets.GOOGLEREDIRECTURL }} \
-                          -e OAUTH_GOOGLEAUTHTOKENURLHOST=${{ secrets.GOOGLEAUTHTOKENURLHOST }} \
-                          -e OAUTH_GOOGLEUSERURLHOST=${{ secrets.GOOGLEUSERURLHOST }} \
                           -e SPRING_JPA_HIBERNATE_DDL_AUTO=validate \
-                          -e AWS_S3_ACCESS_KEY=${{ secrets.AWS_S3_ACCESS_KEY }} \
-                          -e AWS_S3_SECRET_KEY=${{ secrets.AWS_S3_SECRET_KEY }} \
-                          -e AWS_S3_BUCKET_NAME=${{ secrets.PROD_AWS_S3_BUCKET_NAME }} \
-                          -e AWS_S3_BASICPROFILEIMAGEURL=${{ secrets.BASICPROFILEIMAGEURL }} \
+                          -e SPRING_CREDENTIALS_ACCESS_KEY=${{secrets.AWS_S3_ACCESS_KEY}} \
+                          -e SPRING_CREDENTIALS_SECRET_KEY=${{secrets.AWS_S3_SECRET_KEY}} \
                           -e TZ=Asia/Seoul \
-                          -e SENTRY_DSN=${{ secrets.SENTRY_DSN }} \
-                          -e SENTRY_ENABLE_TRACING=true \
-                          -e SENTRY_ENVIRONMENT=prod \
-                          -e LOKI_URL=${{ secrets.LOKI_SERVER_URL }} \
                           ${{ secrets.DOCKERHUB_USERNAME }}/spot-server:prod-${{ github.event.inputs.tag }}
                         docker system prune -af

.gitignore

@@ -384,13 +384,5 @@ gradle-app.setting
 
 .env
 
-*.application-jwt.yml
-*.application-monitoring.yml
-application-jwt.yml
-application-oauth.yml
-application-sentry.yml
-application-aws.yaml
-application-mixpanel.yaml
-
 # 민성 레디스 바이너리 파일
-redis-server-7.2.3-mac-arm64
+redis-server-7.2.3-mac-arm64

application/.gitignore

@@ -41,7 +41,3 @@ bin/
 ### Mac OS ###
 .DS_Store
 
-*.application-jwt.yml
-
-### loki ###
-**/application-monitoring.yml

application/src/main/java/org/depromeet/spot/application/common/jwt/JwtProperties.java

@@ -1,6 +1,17 @@
 package org.depromeet.spot.application.common.jwt;
 
 import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.context.annotation.DependsOn;
+import org.springframework.stereotype.Component;
 
+import lombok.Getter;
+import lombok.Setter;
+
+@Getter
+@Setter
+@Component
 @ConfigurationProperties(prefix = "spring.jwt")
-public record JwtProperties(String secret) {}
+@DependsOn("awsSecretsManagerConfig")
+public class JwtProperties {
+    String secret;
+}

application/src/main/java/org/depromeet/spot/application/common/jwt/JwtTokenUtil.java

@@ -59,21 +59,21 @@ public String generateToken(Long memberId, MemberRole memberRole) {
                 .setClaims(createClaims(memberId, memberRole))
                 .setIssuedAt(current)
                 .setExpiration(expiredAt)
-                .signWith(SignatureAlgorithm.HS256, properties.secret().getBytes())
+                .signWith(SignatureAlgorithm.HS256, properties.getSecret().getBytes())
                 .compact();
     }
 
     public Long getIdFromJWT(String token) {
         return Jwts.parser()
-                .setSigningKey(properties.secret().getBytes())
+                .setSigningKey(properties.getSecret().getBytes())
                 .parseClaimsJws(token)
                 .getBody()
                 .get("memberId", Long.class);
     }
 
     public String getRoleFromJWT(String token) {
         return Jwts.parser()
-                .setSigningKey(properties.secret().getBytes())
+                .setSigningKey(properties.getSecret().getBytes())
                 .parseClaimsJws(token)
                 .getBody()
                 .get("role", String.class);
@@ -122,7 +122,7 @@ private Map<String, Object> createClaims(Long memberId, MemberRole role) {
     }
 
     private Key createSignature() {
-        byte[] apiKeySecretBytes = properties.secret().getBytes();
+        byte[] apiKeySecretBytes = properties.getSecret().getBytes();
         return new SecretKeySpec(apiKeySecretBytes, SignatureAlgorithm.HS256.getJcaName());
     }
 

application/src/main/resources/appenders/console-appender.xml

@@ -13,7 +13,7 @@
 
     <appender name="LOKI_APPENDER" class="com.github.loki4j.logback.Loki4jAppender">
         <http>
-            <url>http://${LOKI_URL}:3100/loki/api/v1/push</url>
+            <url>http://${loki.url}:3100/loki/api/v1/push</url>
         </http>
         <format>
             <label>

application/src/main/resources/application.yaml

@@ -9,24 +9,14 @@ spring:
         group:
             local:
                 - jpa
-                - aws
-                - jwt
-                - oauth
+                - aws-credentials
                 - mixpanel
             dev:
                 - jpa
-                - aws
-                - jwt
-                - oauth
-                - monitoring
                 - mixpanel
             prod:
                 - jpa
-                - aws
-                - jwt
-                - oauth
                 - sentry
-                - monitoring
                 - mixpanel
     servlet:
         multipart:
@@ -56,21 +46,41 @@ management:
         web:
             exposure:
                 include: "*"
+
+# secret manager
+aws:
+    secretsmanager:
+        name: spot-local-secrets
+cloud:
+    aws:
+        region:
+            static: ap-northeast-2
+        stack:
+            auto: false
 ---
 spring:
     config:
         activate:
             on-profile: local
+aws:
+    secretsmanager:
+        name: spot-local-secrets
 ---
 spring:
     config:
         activate:
             on-profile: dev
+aws:
+    secretsmanager:
+        name: spot-dev-secrets
 ---
 spring:
     config:
         activate:
             on-profile: prod
+aws:
+    secretsmanager:
+        name: spot-prod-secrets
 
 decorator:
     datasource:

application/src/test/java/org/depromeet/spot/application/ReviewLikeServiceTest.java

@@ -1,4 +1,4 @@
 package org.depromeet.spot.application;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
 
@@ -7,6 +7,7 @@
 import java.util.concurrent.Executors;
 import java.util.concurrent.atomic.AtomicLong;
 
+import org.depromeet.spot.application.common.jwt.JwtProperties;
 import org.depromeet.spot.domain.member.Level;
 import org.depromeet.spot.domain.member.Member;
 import org.depromeet.spot.domain.member.enums.MemberRole;
@@ -21,6 +22,7 @@
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.boot.test.autoconfigure.jdbc.AutoConfigureTestDatabase;
 import org.springframework.boot.test.context.SpringBootTest;
+import org.springframework.boot.test.mock.mockito.MockBean;
 import org.springframework.test.context.ActiveProfiles;
 import org.springframework.test.context.TestPropertySource;
 import org.springframework.test.context.jdbc.Sql;
@@ -35,7 +37,7 @@
 @SpringBootTest
 @Testcontainers
 @ActiveProfiles("test")
-@TestPropertySource("classpath:application-test.yml")
+@TestPropertySource({"classpath:application-test.yml"})
 @AutoConfigureTestDatabase(replace = AutoConfigureTestDatabase.Replace.NONE)
 @SqlGroup({
     @Sql(
@@ -47,6 +49,10 @@
 })
 class ReviewLikeServiceTest {
 
+    //    @MockBean private JwtTokenUtil jwtTokenUtil;
+    //
+    @MockBean private JwtProperties jwtProperties;
+
     @Autowired private ReviewLikeService reviewLikeService;
 
     @Autowired private ReadReviewUsecase readReviewUsecase;

application/src/test/resources/application-test.yml

@@ -9,6 +9,9 @@ aws:
     redis:
         host: localhost
         port: 6379
+    credentials:
+        access-key: ${AWS_S3_ACCESS_KEY}
+        secret-key: ${AWS_S3_SECRET_KEY}
 
 oauth:
     kakaoClientId: ${KAKAO_CLIENT_ID}
@@ -19,7 +22,7 @@ oauth:
     googleClientSecret: ${GOOGLE_CLIENT_SECRET}
     googleRedirectUrl: ${GOOGLE_REDIRECT_URL}
     googleAuthTokenUrlHost: ${GOOGLE_AUTH_TOKEN_URL_HOST}
-    googleUserUrlHost: ${GOOGLE_USER_URL_HOST}
+    googleAuthUserUrlHost: ${GOOGLE_USER_URL_HOST}
 
 spring:
     datasource:

build.gradle.kts

@@ -36,6 +36,10 @@ subprojects {
         testCompileOnly("org.projectlombok:lombok:_")
         testAnnotationProcessor("org.projectlombok:lombok:_")
 
+        // aws
+        implementation("org.springframework.cloud:spring-cloud-starter-bootstrap:_")
+        implementation("org.springframework.cloud:spring-cloud-starter-aws-secrets-manager-config:_")
+
         // configuration processor
         annotationProcessor("org.springframework.boot:spring-boot-configuration-processor:_")
 

common/src/main/resources/application-sentry.yml

@@ -0,0 +1,3 @@
+sentry:
+    enable-tracing: true
+    environment: prod