AWS Secrets Manager 완전 정복: 비밀번호를 코드에 넣지 않는 법

DATABASES = {
    'default': {
        'ENGINE': 'django.db.backends.postgresql',
        'HOST': 'prod-db.cluster-abc123.ap-northeast-2.rds.amazonaws.com',
        'NAME': 'myapp_production',
        'USER': 'admin',
        'PASSWORD': 'SuperSecret!2026',  # TODO: 나중에 환경변수로 바꾸기
    }
}

import os
db_password = os.environ['DB_PASSWORD']

# SecureString으로 DB 비밀번호 저장
aws ssm put-parameter \
  --name "/myapp/prod/db/password" \
  --value "SuperSecret!2026" \
  --type SecureString

import boto3

ssm = boto3.client('ssm', region_name='ap-northeast-2')

response = ssm.get_parameter(
    Name='/myapp/prod/db/password',
    WithDecryption=True
)
db_password = response['Parameter']['Value']

aws secretsmanager create-secret \
  --name "prod/myapp/db-credentials" \
  --secret-string '{
    "username": "admin",
    "password": "aB3$kL9mN2pQ7wX5",
    "engine": "postgres",
    "host": "prod-db.cluster-abc123.rds.amazonaws.com",
    "port": 5432,
    "dbname": "myapp_production"
  }'

import json
import boto3
from botocore.exceptions import ClientError

def get_secret(secret_name: str, region: str = 'ap-northeast-2') -> dict:
    """AWS Secrets Manager에서 시크릿을 가져온다."""
    client = boto3.client('secretsmanager', region_name=region)
    try:
        response = client.get_secret_value(SecretId=secret_name)
    except ClientError as e:
        code = e.response['Error']['Code']
        if code == 'ResourceNotFoundException':
            raise ValueError(f"시크릿 '{secret_name}'을 찾을 수 없습니다.")
        elif code == 'AccessDeniedException':
            raise PermissionError("접근 권한이 없습니다.")
        raise
    return json.loads(response['SecretString'])

# 사용 예시
db = get_secret('prod/myapp/db-credentials')

from sqlalchemy import create_engine
engine = create_engine(
    f"postgresql://{db['username']}:{db['password']}"
    f"@{db['host']}:{db['port']}/{db['dbname']}"
)

import {
  SecretsManagerClient,
  GetSecretValueCommand,
} from '@aws-sdk/client-secrets-manager';

const client = new SecretsManagerClient({ region: 'ap-northeast-2' });

async function getSecret(secretName) {
  const response = await client.send(
    new GetSecretValueCommand({ SecretId: secretName })
  );
  return JSON.parse(response.SecretString);
}

// 사용 예시
const db = await getSecret('prod/myapp/db-credentials');

import pg from 'pg';
const pool = new pg.Pool({
  host: db.host,
  port: db.port,
  database: db.dbname,
  user: db.username,
  password: db.password,
});

from aws_secretsmanager_caching import SecretCache, SecretCacheConfig

cache = SecretCache(config=SecretCacheConfig(
    secret_refresh_interval=300  # 5분 캐싱
))

secret_string = cache.get_secret_string('prod/myapp/db-credentials')
db = json.loads(secret_string)

aws secretsmanager rotate-secret \
  --secret-id "prod/myapp/db-credentials" \
  --rotation-lambda-arn "arn:aws:lambda:ap-northeast-2:123456789:function:SecretsManagerRDSRotation" \
  --rotation-rules '{"AutomaticallyAfterDays": 30}'

from aws_cdk import aws_secretsmanager as sm, Duration

db_secret = sm.Secret(self, "DBSecret",
    secret_name="prod/myapp/db-credentials",
    generate_secret_string=sm.SecretStringGenerator(
        secret_string_template='{"username": "admin"}',
        generate_string_key="password",
        password_length=32,
    ),
)

db_secret.add_rotation_schedule("Rotation",
    automatically_after=Duration.days(30),
    hosted_rotation=sm.HostedRotation.postgre_sql_single_user(),
)

# Lambda 함수에 Extension 레이어 추가
aws lambda update-function-configuration \
  --function-name my-function \
  --layers "arn:aws:lambda:ap-northeast-2:044395824272:layer:AWS-Parameters-and-Secrets-Lambda-Extension:12"

import json, boto3

secrets = boto3.client('secretsmanager')

def lambda_handler(event, context):
    response = secrets.get_secret_value(SecretId='prod/myapp/db-credentials')
    db = json.loads(response['SecretString'])
    # DB 작업 수행 ...

{
  "containerDefinitions": [{
    "name": "myapp",
    "image": "123456789.dkr.ecr.ap-northeast-2.amazonaws.com/myapp:latest",
    "secrets": [
      {
        "name": "DB_PASSWORD",
        "valueFrom": "arn:aws:secretsmanager:ap-northeast-2:123456789:secret:prod/myapp/db-credentials:password::"
      }
    ]
  }]
}

{
  "Effect": "Allow",
  "Action": "secretsmanager:GetSecretValue",
  "Resource": "arn:aws:secretsmanager:ap-northeast-2:123456789:secret:prod/myapp/*"
}

/prod/myapp/db-credentials
/staging/myapp/db-credentials
/dev/myapp/db-credentials

brew install git-secrets   # macOS
git secrets --register-aws
git secrets --install
# 이후 커밋 시 AWS 키 포함되면 자동 차단