Railsアプリで秘匿情報を環境変数からCredentialsに移行した話

by pokohide

Slide 1

Slide 1 text

2023/11/15ɹGENBA #1 ʙRubyͱRails։ൃͷݱ৔ʙ RailsΞϓϦͰൿಗ৘ใΛ؀ڥม਺͔Β CredentialsʹҠߦͨ͠࿩ @pokohide

Slide 2

Slide 2 text

໨࣍ ● Credentialsͱ͸ ● Ҡߦͷഎܠͱ໨త ● Ҡߦͷखॱ ● Ҡߦ࣌ͷTips ● Ҡߦͷ݁Ռ ● ͍͞͝ʹ

Slide 3

Slide 3 text

ൃදͷલʹࣗݾ঺հͱએ఻

Slide 4

Slide 4 text

ࣗݾ঺հ ● Ά͜ͻͰ / @pokohide ● όοΫΤϯυΤϯδχΞ ● ͓ञ΍ඇ೔ৗମݧʢϛϡʔδΧϧɺΦʔέετϥɺ ϥΠϒɺେࣗવɺetc…ʣ͕޷͖Ͱ͢ ● ࠷ۙͷ೔՝͸ϫϯϐʔεΞχϝؑ৆

Slide 5

Slide 5 text

λΠϛʔͷ࣮੷ εΩϚ όΠτ No.1 ※203೥10݄࣌఺ɹ˞1 [ௐࠪํ๏]σεΫϦαʔνٴͼώΞϦϯάௐࠪ [ௐࠪظؒ]2021೥2݄8೔~22೔ [ௐࠪ֓ཁ]εΩϚόΠτ ΞϓϦαʔϏεͷ࣮ଶௐࠪ [ௐࠪର৅]2020೥12݄·ͰʹαʔϏεΛ։͍࢝ͯ͠ΔεΩϚόΠτΞϓϦ10αʔϏε [ௐ࣮ࠪࢪ] גࣜձࣾγϣούʔζΞΠɹ˞2 [ग़య]AppStoreϥΠϑελΠϧΧςΰϦʔϥϯΩϯάʢ2021೥5݄࣌఺ʣ 5 ྦྷܭٻਓҊ݅਺ ɾμ΢ϯϩʔυ਺ ※1 ※2 ಋೖࣄۀऀ਺ 66,000اۀ ϫʔΧʔ਺ 600ສਓ

Slide 6

Slide 6 text

Slide 7

Slide 7 text

Slide 8

Slide 8 text

ۀքΛ௒͑ͯ޿͕ΔλΠϛʔ λΠϛʔ͸ଟ͘ͷۀքͰ׆༻͞ΕΔαʔϏεʹ੒௕͠ɺ෺ྲྀ/খച/ҿ৯ͷ֤ۀքTOP10ࣾͷ൒਺Ҏ্͕λΠϛʔΛಋೖதɻ ݱࡏಋೖࣄۀऀ਺͸66,000اۀ 170,000ڌ఺Ҏ্ʹͳΓɺ༷ʑͳۀքʹ޿͕͍ͬͯ·͢ɻ 8

Slide 9

Slide 9 text

ืूਓ਺ͷਪҠ 9 ※1ɿ2022೥4Qͱ2021೥4Qͷൺֱ ίϩφՒʹ͓͍ͯ΋ɺ աڈʹྫΛݟͳ͍ఔͷ Ճ଎తߴ੒௕Λ࣮ݱɻ

Slide 10

Slide 10 text

2023/11/15ɹGENBA #1 ʙRubyͱRails։ൃͷݱ৔ʙ RailsΞϓϦͰൿಗ৘ใΛ؀ڥม਺͔Β CredentialsʹҠߦͨ͠࿩ @pokohide

Slide 11

Slide 11 text

໨࣍ ● Credentialsͱ͸ ● Ҡߦͷഎܠͱ໨త ● Ҡߦͷखॱ ● Ҡߦ࣌ͷTips ● Ҡߦͷ݁Ռ ● ͍͞͝ʹ

Slide 12

Slide 12 text

1 Credentialsͱ͸

Slide 13

Slide 13 text

Credentialsͱ͸ ● Rails 5.2͔Β௥Ճ͞Εͨൿಗ৘ใΛ؅ཧ͢ΔͨΊͷ࢓૊Έ ○ Add credentials using a generic EncryptedConfiguration class #30067 ● Rails 6͔Βෳ਺ͷ؀ڥΛαϙʔτ ○ Add support for multi environment credentials. #33521

Slide 14

Slide 14 text

Credentialsͱ͸ ● ओͳొ৔ਓ෺ ○ ҉߸ԽϑΝΠϧɿ config/credentials/.yml.enc ○ ෮߸༻ͷ伴ɿ ENV[”RAILS_MASTER_KEY”] or config/credentials/.key ● RailsΞϓϦىಈ࣌ʹ Rails.env ʹରԠ͢Δ҉߸ԽϑΝΠϧͱ伴Λࢀর͠ɺ ෮߸͢Δ ● Rails.application.credentials ܦ༝ͰऔಘՄೳʹͳΔ

Slide 15

Slide 15 text

Credentialsͱ͸ ● ಺෦తʹ͸YAMLܗࣜͷϑΝΠϧΛ҉߸Խ ⁵ ෮߸͍ͯ͠Δ ○ YAMLͷߏจʹґଘ͢Δ ● ෮߸ͨ͠ޙ͸ ActiveSupport::OrderedOptions ͰࢀরͰ͖ΔͷͰ fetch ΍ dig ͕࢖͑Δ

Slide 16

Slide 16 text

Credentialsͱ͸ʢྫʣ

Slide 17

Slide 17 text

2 Ҡߦͷഎܠͱ໨త

Slide 18

Slide 18 text

Ҡߦͷഎܠ ● Ҏલ͸ECSͷλεΫఆٛʹ؀ڥม਺ͱͯ͠ύϥϝʔλετΞͷSecureStringΛ ར༻ͯ͠ઃఆ͍ͯͨ͠ʢࠓ΋͕ͩʣ ○ ύϥϝʔλετΞ΁ͷొ࿥ɺλεΫఆٛϑΝΠϧͷมߋɺίʔυͷมߋͱखؒͩͬͨ ○ AWSϦιʔεͷ؅ཧ͸ΠϯϑϥνʔϜ͕ओಋ͓ͯ͠Γ੹೚ڥք͕ᐆດͩͬͨ ○ σϓϩΠͷ༰қੑʹ΋͚ܽΔ ● ύϥϝʔλετΞͷૢ࡞ʹ͸ಠࣗͷର࿩ܕCLIΛར༻ ○ ϨϏϡʔ͕ࠔ೉

Slide 19

Slide 19 text

ಋೖͷϝϦοτ ● ੹೚ڥք͕໌֬ʹͳΔ ● σϓϩΠ͕༰қʹͳΔ ● ύϥϝʔλετΞͷૢ࡞ݖݶΛফͤΔ ○ CredentialsΛಋೖ͢Δͱجຊతʹ RAILS_MASTER_KEY ͷΈΛ؅ཧ͢Ε͹ྑ͍ͨΊ

Slide 20

Slide 20 text

໨త ΞϓϦέʔγϣϯ͕؅ཧ͢΂͖ൿಗ৘ใ͸ ੹೚ڥք΍σϓϩΠͷ༰қੑΛߟྀͯ͠CredentialsʹҠߦ͢Δ

Slide 21

Slide 21 text

Credentials͸҆શʁ ● ϚελʔΩʔΛ࢖༻ͯ͠҉߸ԽϑΝΠϧΛ෮߸͢Δ ● AES-256-GCM҉߸ԽΞϧΰϦζϜΛ࢖༻ͯ͠҉߸Խ͞Ε͍ͯΔ ○ 2023೥ݱࡏɺ࠷΋҆શͳ҉߸Խํࣜͷ1ͭ ● ݁ہ͸ϚελʔΩʔͷ؅ཧ͕ॏཁ ● 伴͕ྲྀग़͢Ε͹શͯݟ͑ͯ͠·͏ͷͰཁ݅΍࢓༷ɺϏδωε؀ڥʹԠͯ͡ݕ ౼ͯ͠Ͷ

Slide 22

Slide 22 text

3 Ҡߦͷखॱ

Slide 23

Slide 23 text

Ҡߦͷखॱ 1. ԿΛҠߦ͢Δ͔ܾΊΔ 2. Ҡߦର৅ͷൿಗ৘ใΛશͯCredentialsʹ௥Ճ͢Δ 3. গͣͭ͠ Rails.application.credentials ʹҠߦ͢Δ

Slide 24

Slide 24 text

Ҡߦͷखॱ 1. ԿΛҠߦ͢Δ͔ܾΊΔ 👈 2. Ҡߦର৅ͷൿಗ৘ใΛશͯCredentialsʹ௥Ճ͢Δ 3. গͣͭ͠ Rails.application.credentials ʹҠߦ͢Δ

Slide 25

Slide 25 text

Ҡߦͷखॱ ● ίʔυΛENVͰgrepͨ͠ΓɺECSͷλεΫఆٛͷ؀ڥม਺ΛϦετΞοϓ ● ൿಗ৘ใʹ͸ূ໌ॻ΍ൿີ伴ɺGoogleCloudͷJSONΩʔͳͲ΋͋Δ ● Ҡߦ͢Δ͔ͷ؍఺ʢྫʣ ○ ͦ΋ͦ΋ൿಗ৘ใ͔ → ؀ڥຖͷݻ༗ͷઃఆͳΒ config_for Ͱ΋ྑ͍͔΋ ○ ίϯςφԽ͞Εͨ؀ڥຖʹಈతʹ஫ೖ͍ͨ͠΋ͷ͔ ○ සൟʹߋ৽͢Δ৘ใ͔ʢྫ͑͹PORT൪߸ͱ͔༰қʹม͍͑ͨ৔߹͕͋Δ͔΋͠Εͳ͍ʣ

Slide 26

Slide 26 text

Ҡߦͷखॱ

Slide 27

Slide 27 text

Ҡߦͷखॱ 1. ԿΛҠߦ͢Δ͔ܾΊΔ 2. Ҡߦର৅ͷൿಗ৘ใΛશͯCredentialsʹ௥Ճ͢Δ 👈 3. গͣͭ͠ Rails.application.credentials ʹҠߦ͢Δ

Slide 28

Slide 28 text

Ҡߦͷखॱ ҉߸ԽϑΝΠϧͷϨϏϡʔ͕ࠔ೉ͳͨΊɺઌʹൿಗ৘ใΛҠߦ͓ͯ͘͠ͱ Rails consoleͳͲͰϦϦʔεલʹ֬ೝ͕Ͱ͖ͯศར

Slide 29

Slide 29 text

Ҡߦͷखॱ 1. ԿΛҠߦ͢Δ͔ܾΊΔ 2. Ҡߦର৅ͷൿಗ৘ใΛશͯCredentialsʹ௥Ճ͢Δ 3. গͣͭ͠ Rails.application.credentials ʹҠߦ͢Δ 👈

Slide 30

Slide 30 text

Ҡߦͷखॱ ؤுΔ

Slide 31

Slide 31 text

Ҡߦͷखॱ ͻͨ͢ΒPR࡞ͬͯؤுΔ

Slide 32

Slide 32 text

Ҡߦͷखॱ ো֐΋ى͖Δ

Slide 33

Slide 33 text

Ҡߦͷखॱ શ֯εϖʔεͱ൒֯εϖʔεΛؒҧ͑ͯొ࿥͠ɺࢀর࣌ʹΤϥʔൃੜ ൿಗϑΝΠϧͷϨϏϡʔ͸جຊతʹૉͷVimͱ͔Ͱߦ͍ɺSyntax Highlight΋ޮ͔ ͣɺؾ෇͖ਏ͍ͷͰ஫ҙ͍ͯͩ͘͠͞

Slide 34

Slide 34 text

Ҡߦͷखॱ ͦΜͳ͜ΜͳͰҠߦͰ͖·ͨ͠ λΠϛʔͰ͸20%ϧʔϧͰٕज़վળʹ࣌ؒΛ࢖͍ͬͯΔͷͰ͕͢ɺ໿5ϲ݄͔͔Γ·ͨ͠

Slide 35

Slide 35 text

4 Ҡߦ࣌ͷTips

Slide 36

Slide 36 text

Ҡߦ࣌ͷTips CredentialsͷϚελʔΩʔ͕ͳ͍ͱRailsΞϓϦͷىಈʹࣦഊ͢ΔઃఆΛ༗ޮʹ͠ ͓͖ͯ·͠ΐ͏

Slide 37

Slide 37 text

Ҡߦ࣌ͷTips ҉߸ԽϑΝΠϧͷฤूʹ͸ΤσΟλͷࢦఆ͕ඞਢͳͷͰ༻ҙ͓͖ͯ͠·͠ΐ͏ emacsͰ΋ྑ͍Ͱ͢

Slide 38

Slide 38 text

Ҡߦ࣌ͷTips ൿಗ৘ใʹΤεέʔϓจࣈؚ͕·ΕΔ৔߹͸μϒϧΫΥʔςʔγϣϯͰׅΔ

Slide 39

Slide 39 text

Ҡߦ࣌ͷTips ൿಗ৘ใʹվߦΛ࢖͍͍ͨ৔߹͸ύΠϓΛ࢖͏ͳͲ͢Δ

Slide 40

Slide 40 text

Ҡߦ࣌ͷTips Credentialsͷ౎߹ʹ߹Θͤͯɺ֎෦αʔϏεͱͷೝূํ๏Λม͑Δ ྫɿGoogle::Auth::ClientId#from_file ͸಺෦తʹfrom_hash ݺͼग़͍ͯ͠Δ https://github.com/googleapis/google-auth-library-ruby/blob/main/lib/googleauth/client_id.rb#L86

Slide 41

Slide 41 text

Ҡߦ࣌ͷTips ● YAML͸ςΩετϕʔεͷσʔλܗࣜͳͷͰόΠφϦʹ͸޲͍͍ͯͳ͍ ● ূ໌ॻͳͲόΠφϦσʔλΛCredentialsͰѻ͏৔߹ɺBase64Τϯίʔυ͠ ͨ஋Λอଘ͠ɺΞϓϦέʔγϣϯଆͰऔΓग़ͯ͠σίʔυΛߦ͏ ● Τϯίʔυ͞Ε͍ͯΔࣄ͕෼͔Γ΍͍͢Α͏ʹ base64_encoded ϓϨϑΟο ΫεΛ͚ͭͨ

Slide 42

Slide 42 text

Ҡߦ࣌ͷTips ൿಗ஋ΛίϯιʔϧͰඇදࣔʹ͢Δ Rails 7.1͔Βඪ४ʹͳΓ·͕͢ɺ·্͍ͩ͛ͯͳ͍৔߹͸γϯϓϧͳมߋͳͷͰόοΫϙʔτ΋ָ https://github.com/rails/rails/pull/48498

Slide 43

Slide 43 text

Ҡߦ࣌ͷTips ● Secrets͸Rails 7.1͔Β໌ࣔతʹඇਪ঑Խ͞ΕͨͷͰɺSECRET_KEY_BASE Λ Credentials ʹҠߦ ● ֤؀ڥͷ credentials.yml ʹ SECRET_KEY_BASE ΛҠߦ͢Ε͹OKͳ͸ͣ

Slide 44

Slide 44 text

Ҡߦ࣌ͷTips assets:precompile ࣮ߦ࣌ʹ SECRET_KEY_BASE ͕ͳ͍ͱΤϥʔ͕ى͖Δ  ࣮ࡍʹ࢖༻͸͠ͳ͍ͷͰɺμϛʔ஋ΛࣗಈͰઃఆͯ͘͠ΕΔ SECRET_KEY_BASE_DUMMY ͕ Rails 7.1͔Βಋೖ͞Εͨ

Slide 45

Slide 45 text

Ҡߦ࣌ͷ஫ҙ ● HerokuͰӡ༻ɺHeroku Data for RedisΛར༻ͯ͠ΔݸਓΞϓϦͷREDIS_URL ΛCredentialsʹҠߦͨ͠ΒRedisʹ઀ଓͰ͖ͳ͘ͳͬͨ ● ࣗ෼ͷ؅ཧ͍ͯ͠ͳ͍؀ڥม਺౳ΛҠߦ͢Δ৔߹͸஫ҙ͠·͠ΐ͏ https://devcenter.heroku.com/ja/articles/heroku-redis

Slide 46

Slide 46 text

5 Ҡߦͷ݁Ռ

Slide 47

Slide 47 text

Ҡߦͷ݁Ռ ● ؀ڥม਺Ͱ؅ཧ͢Δൿಗ৘ใ͸ RAILS_MASTER_KEY ͷΈͱͳͬͨ ● ূ໌ॻͳͲͷൿಗϑΝΠϧΛS3͔Βίϐʔ͢Δඞཁ͕ͳ͘ͳͬͨͨΊɺawscli΍ AWSͷೝূ৘ใ͕ෆཁʹͳͬͨ ● Rails.application.secrets Λഇࢭ ● dotenv-rails Λ࡟আ ● ൿಗ৘ใͷ௥Ճɾߋ৽͕ΞϓϦέʔγϣϯʹด͡ΔΑ͏ʹͳͬͨ 🎉

Slide 48

Slide 48 text

Ҡߦͷ݁Ռ ʙ ༨ஊ ྺ࢙తܦҢͰdotenv-rails͕։ൃ؀ڥҎ֎ʹ΋ಡΈࠐ·Ε͍ͯͨ ● ຊ൪؀ڥͰ༧ظͤ͵্ॻ͖͕͋ͬͯ΋ා͍͠ɺCredentialsҠߦʹΑΓ΄΅ෆཁ ʹͳͬͨͷͰ࡟আ͢Δ͜ͱʹ ● notion-ruby-clientͱ͍͏GemͷRuntime Dependencies͔ΒdotenvΛ࡟আ ● DockerͰ΋ .env ΛಡΈࠐΜͰ͘ΕΔ ○ ಡΈࠐΈλΠϛϯά͸RailsΞϓϦىಈ͔࣌Βίϯςφىಈ࣌ʹมΘΔ͕໰୊ͳ͍ͱ൑அ

Slide 49

Slide 49 text

6 ͍͞͝ʹ

Slide 50

Slide 50 text

͍͞͝ʹ ΍ͬͺΓϨϏϡʔ͸େม ● ҉߸Խ͞Ε͍ͯΔͨΊɺ෮߸ͨ݁͠ՌΛݟͳ͍ͱࠩ෼͸෼͔Βͳ͍ ● ҉߸ԽϑΝΠϧͷdiffΛݟΕΔΑ͏ʹ͢Δ bin/rails credentials:diff ͕ެࣜαϙʔ τ͞Ε͍ͯΔ ○ Railsͷ࣮ߦ؀ڥ͔Βgitૢ࡞Ͱ͖Δඞཁ͕͋Δ ○ ։ൃ؀ڥʹDockerΛ༻͍ͯϗετଆͰgitૢ࡞͍ͯ͠ΔͷͰɺ͜ͷͨΊʹίϯςφʹgitΛೖΕΔ ͔ݕ౼த

Slide 51

Slide 51 text

͝ਗ਼ௌ͋Γ͕ͱ͏͍͟͝·ͨ͠