Skip to content

Commit d163e93

Browse files
hk-dev13hk-dev13
committed
Add AWS App Runner service role and secure credentials setup documentation
1 parent f1a3eed commit d163e93

3 files changed

Lines changed: 269 additions & 0 deletions

File tree

‎APPRUNNER_SERVICE_SETUP.md‎

Lines changed: 133 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
# AWS App Runner Service Role Configuration
2+
3+
## 🔐 Service Role Requirements
4+
5+
AWS App Runner membutuhkan IAM service role untuk mengakses ECR dan layanan AWS lainnya.
6+
7+
### Option 1: Auto-create Service Role (Recommended)
8+
Saat membuat App Runner service, pilih **"Create new service role"** - AWS akan otomatis membuat role dengan permissions yang tepat.
9+
10+
### Option 2: Manual Service Role Creation
11+
12+
#### 1. Create IAM Role
13+
```json
14+
{
15+
"Version": "2012-10-17",
16+
"Statement": [
17+
{
18+
"Effect": "Allow",
19+
"Principal": {
20+
"Service": "build.apprunner.amazonaws.com"
21+
},
22+
"Action": "sts:AssumeRole"
23+
}
24+
]
25+
}
26+
```
27+
28+
#### 2. Attach Policy
29+
Role name: `AppRunnerECRAccessRole`
30+
31+
**AWS Managed Policy:**
32+
- `AWSAppRunnerServicePolicyForECRAccess`
33+
34+
**Or Custom Policy:**
35+
```json
36+
{
37+
"Version": "2012-10-17",
38+
"Statement": [
39+
{
40+
"Effect": "Allow",
41+
"Action": [
42+
"ecr:GetAuthorizationToken"
43+
],
44+
"Resource": "*"
45+
},
46+
{
47+
"Effect": "Allow",
48+
"Action": [
49+
"ecr:BatchCheckLayerAvailability",
50+
"ecr:GetDownloadUrlForLayer",
51+
"ecr:BatchGetImage",
52+
"ecr:DescribeRepositories",
53+
"ecr:DescribeImages"
54+
],
55+
"Resource": "arn:aws:ecr:ap-southeast-2:147845229604:repository/permit-api"
56+
}
57+
]
58+
}
59+
```
60+
61+
## 📋 App Runner Service Configuration
62+
63+
### Container Configuration
64+
```yaml
65+
Source: Container registry
66+
Provider: Amazon ECR
67+
Container image URI: 147845229604.dkr.ecr.ap-southeast-2.amazonaws.com/permit-api:latest
68+
Deployment trigger: Manual
69+
```
70+
71+
### Build Configuration
72+
```yaml
73+
Service role: AppRunnerECRAccessRole (or auto-created)
74+
```
75+
76+
### Service Configuration
77+
```yaml
78+
Service name: permit-api-service
79+
Virtual CPU: 1 vCPU
80+
Virtual memory: 2 GB
81+
Port: 8000
82+
Environment variables:
83+
FLASK_ENV: production
84+
FLASK_DEBUG: 0
85+
PORT: 8000
86+
API_KEYS: demo_basic_key:DemoBasic:basic,demo_premium_key:DemoPremium:premium
87+
MASTER_API_KEY: demo_master_key_12345
88+
LOG_LEVEL: INFO
89+
```
90+
91+
### Auto-scaling Configuration
92+
```yaml
93+
Minimum size: 1
94+
Maximum size: 3
95+
Max concurrency: 100 per instance
96+
```
97+
98+
### Health Check Configuration
99+
```yaml
100+
Health check path: /health
101+
Health check interval: 20 seconds
102+
Health check timeout: 5 seconds
103+
Healthy threshold: 1
104+
Unhealthy threshold: 5
105+
```
106+
107+
## 🚀 Step-by-Step Creation
108+
109+
1. **AWS App Runner Console**: https://ap-southeast-2.console.aws.amazon.com/apprunner/home
110+
2. **Create service** → Container registry
111+
3. **ECR Image**: `147845229604.dkr.ecr.ap-southeast-2.amazonaws.com/permit-api:latest`
112+
4. **Service role**: Choose "Create new service role" or select existing `AppRunnerECRAccessRole`
113+
5. **Configure** service settings as above
114+
6. **Review and create**
115+
116+
## ✅ Verification Steps
117+
118+
After deployment:
119+
1. **Check service status**: Should show "Running"
120+
2. **Test health endpoint**: `https://your-app-url.awsapprunner.com/health`
121+
3. **Test API with key**:
122+
```bash
123+
curl -H "Authorization: Bearer demo_basic_key" \
124+
"https://your-app-url.awsapprunner.com/global/emissions?limit=5"
125+
```
126+
127+
## 🔧 Troubleshooting
128+
129+
**Common Issues:**
130+
- **Service role permissions**: Ensure ECR access is granted
131+
- **Container port**: Must match Dockerfile EXPOSE 8000
132+
- **Health check**: Verify `/health` endpoint responds
133+
- **Environment variables**: Check all required vars are set

‎SECURE_AWS_SETUP.md‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
# Secure AWS Credentials Setup
2+
3+
## 🔐 Secure Method to Configure AWS CLI
4+
5+
### Option 1: Environment Variables (Recommended)
6+
Create a `.env` file with your credentials:
7+
8+
```powershell
9+
# Create .env file
10+
echo 'AWS_ACCESS_KEY_ID=your_new_access_key_here' > .env.aws
11+
echo 'AWS_SECRET_ACCESS_KEY=your_new_secret_key_here' >> .env.aws
12+
echo 'AWS_DEFAULT_REGION=ap-southeast-2' >> .env.aws
13+
```
14+
15+
Then load them:
16+
```powershell
17+
# Load environment variables
18+
Get-Content .env.aws | ForEach {
19+
$parts = $_.Split('=')
20+
[System.Environment]::SetEnvironmentVariable($parts[0], $parts[1], "User")
21+
}
22+
```
23+
24+
### Option 2: Manual Config File Edit
25+
Edit AWS config files directly:
26+
27+
**Windows locations:**
28+
- `%USERPROFILE%\.aws\credentials`
29+
- `%USERPROFILE%\.aws\config`
30+
31+
**Credentials file content:**
32+
```ini
33+
[default]
34+
aws_access_key_id = YOUR_NEW_ACCESS_KEY
35+
aws_secret_access_key = YOUR_NEW_SECRET_KEY
36+
```
37+
38+
**Config file content:**
39+
```ini
40+
[default]
41+
region = ap-southeast-2
42+
output = json
43+
```
44+
45+
### Option 3: Use AWS CLI with input redirection
46+
```powershell
47+
# Create temporary input file
48+
@'
49+
YOUR_NEW_ACCESS_KEY
50+
YOUR_NEW_SECRET_KEY
51+
ap-southeast-2
52+
json
53+
'@ | .\.venv\Scripts\python.exe -m awscli configure
54+
```
55+
56+
## 🎯 Next Steps After Setup
57+
58+
1. **Test credentials:**
59+
```powershell
60+
.\.venv\Scripts\python.exe -m awscli sts get-caller-identity
61+
```
62+
63+
2. **Test App Runner access:**
64+
```powershell
65+
.\.venv\Scripts\python.exe -m awscli apprunner list-services --region ap-southeast-2
66+
```
67+
68+
3. **Continue with App Runner service creation**
69+
70+
## 🚨 Security Best Practices
71+
72+
1. **Never paste credentials** in chat/terminal logs
73+
2. **Use temporary credentials** when possible
74+
3. **Rotate keys regularly**
75+
4. **Delete unused access keys** immediately
76+
5. **Use least privilege policies**
77+
78+
## 🔄 For GitHub Actions
79+
80+
Make sure to update GitHub Secrets with the new credentials:
81+
- Repository Settings → Secrets and Variables → Actions
82+
- Update `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY`

‎TROUBLESHOOT_APPRUNNER.md‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
# App Runner Minimal Configuration (Bypass Auto-scaling Issue)
2+
3+
## 🚀 Quick Service Creation
4+
5+
### Skip Auto-scaling Configuration
6+
1. **Cancel** the auto-scaling dialog
7+
2. Use **default scaling settings**:
8+
- Min instances: 1
9+
- Max instances: 25
10+
- Concurrency: 100
11+
12+
### Required Configuration Only
13+
```yaml
14+
Service name: permit-api-service
15+
ECR Image URI: 147845229604.dkr.ecr.ap-southeast-2.amazonaws.com/permit-api:latest
16+
Port: 8000
17+
CPU: 1 vCPU
18+
Memory: 2 GB
19+
20+
Environment Variables:
21+
FLASK_ENV: production
22+
PORT: 8000
23+
API_KEYS: demo_basic_key:DemoBasic:basic
24+
MASTER_API_KEY: demo_master_key_12345
25+
```
26+
27+
### Health Check (Optional)
28+
```yaml
29+
Path: /health
30+
Interval: 20s
31+
Timeout: 5s
32+
```
33+
34+
## 🔧 Troubleshooting Account Issues
35+
36+
### Check AWS Account
37+
1. **Billing Console**: Ensure payment method is active
38+
2. **Region**: Switch to `us-east-1` if `ap-southeast-2` has issues
39+
3. **Account Status**: Check if account is fully activated
40+
41+
### Alternative Regions for App Runner
42+
- **US East (N. Virginia)**: `us-east-1`
43+
- **US West (Oregon)**: `us-west-2`
44+
- **Europe (Ireland)**: `eu-west-1`
45+
- **Asia Pacific (Tokyo)**: `ap-northeast-1`
46+
47+
### Command Line Check
48+
```powershell
49+
# Check if App Runner is available in your region
50+
.\.venv\Scripts\python.exe -m awscli apprunner list-services --region ap-southeast-2
51+
52+
# If error, try different region
53+
.\.venv\Scripts\python.exe -m awscli apprunner list-services --region us-east-1
54+
```

0 commit comments

Comments
 (0)