How to encrypt the web.config section and deploy to multiple servers using Amazon Elastic Beanstalk

Question

I am deploying a website using AWS Elastic Beanstalk and it is very easy to deploy to a load balanced web farm.

Now I want to encrypt some sections in the web.config file for the sites that I deployed, whether before deployment or after.

There are many articles on how to use Aspnet_regiis.exe using RSA to encrypt a partition, but the problem is that you are dealing with a web farm because you need to export the private key to other servers.

From this article http://msdn.microsoft.com/en-us/library/ff647398.aspx see:

Web farm scripts If you want to deploy the same encrypted configuration file on multiple servers in a web farm, you should use RSAProtectedConfigurationProvider. This provider makes it easier for you to encrypt data on one server and then export the RSA private key, which is necessary for decrypting the data. You can then deploy the configuration file and the exported key to the target servers, and then re-import the keys.

However, my problem is that in a load-balanced environment, the servers will work up and down due to automatic scaling rules, and I need a process to automate key management, i.e. import on a newly deployed private key server is used to encrypt Web.config .

Has anyone done this or can give some idea?

Answer 1

Can I use container commands to import private keys? The command will be executed every time the instance is initialized. After you start storing your keys in persistent storage, for example, S3, then autoscaling should not be a problem.

Customizing the software on Windows EC2 instances contains more detailed information about container commands.

Answer 2

The following @kukido suggestion what you need to do is create a .ebextension file with the following contents.

commands: encryptConfig: command: aspnet_regiis.exe -pe "connectionStrings" -app / cwd: %windir%\\Microsoft.NET\\Framework64\\v4.0.30319