Encrypting application data on an Elastic Beanstalk environment

Question

Pulumi · Accepted Answer

When deploying an application on AWS Elastic Beanstalk (EB), you may want to ensure your application data is encrypted to protect it from unauthorized access. AWS provides several mechanisms for encryption both in transit and at rest.

For encryption of data at rest, AWS typically uses the EBS (Elastic Block Store) for persistent storage with options for encryption. In the context of an Elastic Beanstalk environment, you can set encryption options through environment configurations. This can be done using Option Settings in the Elastic Beanstalk environment's configuration, setting it to use encrypted EBS volumes for any attached storage. AWS also allows you to use a custom KMS key for encryption to have control over the key management process.

For in-transit encryption, you can configure your Elastic Beanstalk environment to enforce HTTPS using a secure listener in your environment's load balancer settings.

Now let's look at how to accomplish this using Pulumi with TypeScript. We'll use the `aws.elasticbeanstalk.Application` and `aws.elasticbeanstalk.Environment` resources to create an application and an associated environment, setting up encryption for storage.

Below is a TypeScript program that demonstrates how to set up an Elastic Beanstalk application and environment with encrypted storage:

```typescript
import * as aws from '@pulumi/aws';

// Create an Elastic Beanstalk application
const app = new aws.elasticbeanstalk.Application("myApp", {
    name: "my-application", // Change this to your application's name
});

// Define the EB environment with option settings for encryption
const env = new aws.elasticbeanstalk.Environment("myEnv", {
    application: app.name,
    solutionStackName: "64bit Amazon Linux 2 v5.4.4 running Node.js 14", // Choose the appropriate solution stack for your app
    optionSettings: [
        {
            namespace: "aws:autoscaling:launchconfiguration",
            optionName: "BlockDeviceMappings", // Here we configure block device mappings to define encryption settings.
            value: `/dev/sdb=:20:true:gp2::encrypted`, // This is an example value, change it as per your need "size:delete_on_termination:encrypted:volume_type:iops".
        },
        // Additional environment configurations like setting up a secure listener for HTTPS can be added here.
    ],
});

// Export the environment's URL
export const appUrl = env.cname;

// To view your Elastic Beanstalk URL, you would use the Pulumi CLI after deployment:
// pulumi stack output appUrl
```

This program sets up an Elastic Beanstalk application and an environment with encrypted storage. The `BlockDeviceMappings` option within `optionSettings` is used to ensure that the created EBS volumes are encrypted. The `value` field of this configuration string provides the parameters of the Block Device Mapping, which consist of multiple colon-separated properties, including setting `encrypted` to `true`.

Should your requirements be more specific, for example, using a custom KMS key for encryption or additional application settings to enforce HTTPS, you would need to expand the `optionSettings` configuration with the appropriate namespace and option names reflecting these requirements.

Remember, while this program sets up encryption at rest for the EBS volumes attached to the EC2 instances running your EB environment, additional configurations may be required to fully secure your application according to best practices, including setting up security groups, network ACLs, and IAM roles with the least privilege needed for your application to function.