amazon-web-services - 使用 docker 在弹性 beantalk 实例上使用 SSL

Question

我拼命地尝试将 SSL 添加到我们的 web 应用程序中，该应用程序运行在带有单个 docker conatiner 的弹性 beantalk 上。 我遵循了 aws https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/https-singleinstance-docker.html 的文档并添加了所有需要的信息。运行 eb deploy 后，实例的配置没有任何变化。通过 SSH 登录它显示所需的 2 个文件均未创建。

环境配置文件:

    # 01_envar.config
option_settings:
  aws:elasticbeanstalk:application:environment:
    PORT: 3000
    NODE_ENV: production

files:
  /etc/nginx/conf.d/https.conf:
    mode: "000644"
    owner: root
    group: root
    content: |
      # HTTPS Server

      server {
        listen 443;
        server_name localhost;

        ssl on;
        ssl_certificate /etc/pki/tls/certs/server.crt;
        ssl_certificate_key /etc/pki/tls/certs/server.key;

        ssl_session_timeout 5m;

        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_prefer_server_ciphers on;

        location / {
          proxy_pass http://docker;
          proxy_http_version 1.1;

          proxy_set_header Connection "";
          proxy_set_header Host $host;
          proxy_set_header X-Real-IP $remote_addr;
          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
          proxy_set_header X-Forwarded-Proto https;
        }
      }

  /etc/pki/tls/certs/server.crt:
    mode: "000400"
    owner: root
    group: root
    content: |
          -----BEGIN CERTIFICATE-----

          -----END CERTIFICATE-----
          -----BEGIN CERTIFICATE-----

          -----END CERTIFICATE-----
          -----BEGIN CERTIFICATE-----

          -----END CERTIFICATE-----
          -----BEGIN CERTIFICATE-----

          -----END CERTIFICATE-----      
  /etc/pki/tls/certs/server.key:
    mode: "000400"
    owner: root
    group: root
    content: |
              -----BEGIN RSA PRIVATE KEY-----
              -----END RSA PRIVATE KEY-----
Resources:
  sslSecurityGroupIngress: 
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: {"Fn::GetAtt" : ["AWSEBSecurityGroup", "GroupId"]}
      IpProtocol: tcp
      ToPort: 443
      FromPort: 443
      CidrIp: 0.0.0.0/0

我对在 aws 上部署应用程序还很陌生，非常感谢任何帮助!

提前致谢

Answer 1

将 TLS 配置到 ELB elastic beanstalk 提供的环境比配置环境 nginx 配置更省力，因此对于大多数用例来说它应该是更好的选择。