How should secret files be pushed to an EC2 Ruby on Rails application using amazon web services with their elastic beanstalk?

Question

How should secret files be pushed to an EC2 Ruby on Rails application using amazon web services with their elastic beanstalk?

I add the files to a git repository, and I push to github, but I want to keep my secret files out of the git repository. I'm deploying to aws using:

git aws.push

The following files are in the .gitignore:

/config/database.yml
/config/initializers/omniauth.rb
/config/initializers/secret_token.rb

Following this link I attempted to add an S3 file to my deployment: http://docs.amazonwebservices.com/elasticbeanstalk/latest/dg/customize-containers.html

Quoting from that link:

Example Snippet

The following example downloads a zip file from an Amazon S3 bucket and unpacks it into /etc/myapp:

sources:  
    /etc/myapp: http://s3.amazonaws.com/mybucket/myobject 

Following those directions I uploaded a file to an S3 bucket and added the following to a private.config file in the .ebextensions directory:

sources:
  /var/app/current/: https://s3.amazonaws.com/mybucket/config.tar.gz

That config.tar.gz file will extract to:

/config/database.yml
/config/initializers/omniauth.rb
/config/initializers/secret_token.rb

However, when the application is deployed the config.tar.gz file on the S3 host is never copied or extracted. I still receive errors that the database.yml couldn't be located and the EC2 log has no record of the config file, here is the error message:

Error message:
  No such file or directory - /var/app/current/config/database.yml
Exception class:
  Errno::ENOENT
Application root:
  /var/app/current

Answer 1

The "right" way to do what I think that you want to do is to use IAM Roles. You can see a blog post about it here: http://aws.typepad.com/aws/aws-iam/

Basically, it allows you to launch an EC2 instance without putting any personal credential on any configuration file at all. When you launch the instance it will be assigned the given role (a set of permissions to use AWS resources), and a rotating credential will be put on the machine automatically with Amazon IAM.