How to run aws configure in a travis deploy script?

问题

I am trying to get travis-ci to run a custom deploy script that uses awscli to push a deployment up to my staging server.

In my .travis.yml file I have this:

before_deploy:
  - 'curl "https://s3.amazonaws.com/aws-cli/awscli-bundle.zip" -o "awscli-bundle.zip"'
  - 'unzip awscli-bundle.zip'
  - './awscli-bundle/install -b ~/bin/aws'
  - 'export PATH=~/bin:$PATH'
  - 'aws configure'

And I have set up the following environment variables:

AWS_ACCESS_KEY_ID
AWS_SECRET_ACCESS_KEY
AWS_DEFAULT_REGION

with their correct values in the travis-ci web interface.

However when the aws configure runs, it stops and waits for user input. How can I tell it to use the environment variables I have defined?

回答1:

You can set these in a couple of ways.

Firstly, by creating a file at ~/.aws/config (or ~/.aws/credentials).

For example:

[default]
aws_access_key_id=foo
aws_secret_access_key=bar
region=us-west-2

Secondly, you can add environment variables for each of your settings.

For example, create the following environment variables:

AWS_DEFAULT_REGION
AWS_ACCESS_KEY_ID
AWS_SECRET_ACCESS_KEY

Thirdly, you can pass region in as a command line argument. For example:

aws eb deploy --region us-west-2

You won't need to run aws configure in these cases as the cli is configured.

There is further AWS documentation on this page.

回答2:

Darbio's solution works fine but it's not taking into consideration that you may end up pushing your AWS credentials in your repository.

That is a bad thing especially if docker is trying to pull a private image from one of your ECR repositories. It would mean that you probably had to store your AWS production credentials in the .travis.yml file and that is far from ideal.

Fortunately Travis gives you the possibility to encrypt environment variables, notification settings, and deploy api keys.

gem install travis

Do a travis login first of all, it will ask you for your github credentials. Once you're logged in get in your project root folder (where your .travis.yml file is) and encrypt your access key id and secret access key.

travis encrypt AWS_ACCESS_KEY_ID="HERE_PUT_YOUR_ACCESS_KEY_ID" --add
travis encrypt AWS_SECRET_ACCESS_KEY="HERE_PUT_YOUR_SECRET_ACCESS_KEY" --add

Thanks to the --add option you'll end up with two new (encrypted) environment variables in your configuration file. Now just open your .travis.yml file and you should see something like this:

env:
    global:
        - secure: encrypted_stuff
        - secure: encrypted_stuff

Now you can make travis run a shell script that creates the ~/.aws/credentials file for you.

ecr_credentials.sh

#!/usr/bin/env bash

mkdir -p ~/.aws

cat > ~/.aws/credentials << EOL
[default]
aws_access_key_id = ${AWS_ACCESS_KEY_ID}
aws_secret_access_key = ${AWS_SECRET_ACCESS_KEY}
EOL

Then you just need to run the ecr_credentials.sh script from your .travis.yml file:

before_install:
    - ./ecr_credentials.sh

Done! :-D

Source: Encription keys on Travis CI

来源：https://stackoverflow.com/questions/37267916/how-to-run-aws-configure-in-a-travis-deploy-script

标签

amazon-web-services

configuration

travis-ci

continuous-deployment

aws-cli