Get elastic beanstalk environment variables in docker container

Question

So, i'm trying not to put sensitive information on the dockerfile. A logical approach is to put the creds in the ebs configuration (the GUI) as a ENV variable. However, docker build doesn't seem to be able to access the ENV variable. Any thoughts?

FROM jupyter/scipy-notebook

USER root

ARG AWS_ACCESS_KEY_ID
RUN echo {$AWS_ACCESS_KEY_ID}

Answer 1

I assume that for every deployment you create a new Dockerrun.aws.json file with the correct docker image tag for that deployment. At deployment stage, you can inject environment values which will then be used in docker run command by EB agent. So your docker containers can now access to these environment variables.

Answer 2

Using secrets or sensitive information in Docker encompasses two potential timeframes:

1. Build time: When the Docker image is being constructed.
2. Runtime: When a container from the Docker image is executing.

For runtime secrets in AWS Elastic Beanstalk:

Elastic Beanstalk environment variables can be used to pass runtime secrets to the application. These variables can be set via the AWS Management Console, EB CLI, or AWS SDKs and are injected into the Docker container at runtime. Your application can then read these environment variables.

However, for build time secrets:

• Docker has a native mechanism to pass build-time secrets using the --build-arg parameter during the docker build command. That approach uses the ARG instruction in the Dockerfile.

• Yet, Elastic Beanstalk's Docker integration, as of the last update, does not allow for the passing of build arguments during the image build process. That means you cannot use the ARG mechanism for build-time secrets when deploying with Elastic Beanstalk.

As such, if your use case specifically requires build-time secrets with Elastic Beanstalk, you might need to consider alternative strategies:

1. Pre-built Images: Build your Docker images in a secure environment where you can use build-time secrets. Push these pre-built images to a private registry (like Amazon ECR) and then reference these images in Elastic Beanstalk.
   Remember: Storing or baking secrets into Docker images is a security risk. Instead, prefer methods that inject secrets at runtime or grant permissions without explicit credentials.
2. IAM roles: For AWS specific secrets (like access to S3 or DynamoDB), instead of passing secrets, attach an IAM role to your Elastic Beanstalk environment's EC2 instances that grants the necessary permissions. AWS SDKs inside your container will automatically use these permissions without needing explicit credentials.
   This is used for instance here for accessing the AWS secret Manager