[BE] S3 자격증명 방식 변경 #172
[BE] S3 자격증명 방식 변경 #172
Conversation
- DefaultCredentialsProvider로 EC2에 부여된 Role을 자동 감지할 수 있도록 AWS SDK 버전 업데이트
- DefaultCredentialsProvider를 사용하여 환경 변수, EC2 IAM Role, ~/.aws/credentials 등을 자동 탐색하도록 개선 - 수동으로 ProfileCredentialsProvider를 지정하지 않아도 다양한 실행 환경에서 올바른 자격 증명을 찾을 수 있도록 변경
- 프로필 이미지가 저장되지 않은 사용자의 경우 Presigned URL을 생성하지 않도록 로직 수정 - isFileExists(professor) 검사를 통해 예외 상황 방지
WalkthroughThe pull request updates the AWS SDK S3 dependency in the Gradle build file from version 2.13.0 to 2.20.0. In the Changes
Sequence Diagram(s)sequenceDiagram
participant Client
participant ProfessorService
participant S3Service
Client->>ProfessorService: Request profile info
ProfessorService->>ProfessorService: Initialize profileImageUrl as empty
ProfessorService->>S3Service: Check if profile image exists
alt File exists
ProfessorService->>S3Service: Generate presigned URL
S3Service-->>ProfessorService: Return URL
ProfessorService->>Client: Return profile info with URL
else
ProfessorService->>Client: Return profile info with empty URL
end
sequenceDiagram
participant S3Config
participant DefaultCredentialsProvider
participant AWS_Service
S3Config->>DefaultCredentialsProvider: Initialize credentials
DefaultCredentialsProvider-->>S3Config: Provide credentials
S3Config->>AWS_Service: Create S3 client & presigner with credentials
Suggested reviewers
Poem
✨ Finishing Touches
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
back-end/reacton/src/main/java/com/softeer/reacton/global/s3/S3Config.java (1)
27-30: Consider reusing the DefaultCredentialsProvider instance.While the change to
DefaultCredentialsProvideris correct, creating separate instances for both S3Client and S3Presigner might not be optimal. Consider creating a single bean for the credentials provider and reusing it.Here's a suggested refactor:
@Configuration public class S3Config { @Value("${aws.region}") private String AWS_REGION; + @Bean + public DefaultCredentialsProvider credentialsProvider() { + return DefaultCredentialsProvider.create(); + } @Bean - public S3Client s3Client() { + public S3Client s3Client(DefaultCredentialsProvider credentialsProvider) { return S3Client.builder() .region(Region.of(AWS_REGION)) - .credentialsProvider(DefaultCredentialsProvider.create()) + .credentialsProvider(credentialsProvider) .build(); } @Bean - public S3Presigner s3Presigner() { + public S3Presigner s3Presigner(DefaultCredentialsProvider credentialsProvider) { return S3Presigner.builder() .region(Region.of(AWS_REGION)) - .credentialsProvider(DefaultCredentialsProvider.create()) + .credentialsProvider(credentialsProvider) .build(); } }
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (3)
back-end/reacton/build.gradle(1 hunks)back-end/reacton/src/main/java/com/softeer/reacton/domain/professor/ProfessorService.java(1 hunks)back-end/reacton/src/main/java/com/softeer/reacton/global/s3/S3Config.java(2 hunks)
🔇 Additional comments (5)
back-end/reacton/build.gradle (1)
41-41: AWS SDK S3 Version Update: Verify Compatibility with the New Credentials ProviderThe dependency version for AWS SDK S3 has been updated from a lower version to 2.20.0. This change is critical since the new
DefaultCredentialsProviderrequired for production environments is supported only from this version onward. Please ensure that this upgrade is compatible with the rest of your S3 client configuration and that any related usages in the codebase (such as inS3Config) have been verified for compatibility with the new AWS SDK version.back-end/reacton/src/main/java/com/softeer/reacton/domain/professor/ProfessorService.java (2)
101-104: LGTM! Improved error handling for profile image URLs.The changes correctly address the issue by checking file existence before generating presigned URLs, preventing unnecessary S3 operations for non-existent profile images.
118-121: LGTM! Consistent implementation of profile image URL handling.The changes maintain consistency with
getProfileInfomethod, ensuring proper handling of non-existent profile images.back-end/reacton/src/main/java/com/softeer/reacton/global/s3/S3Config.java (2)
7-7: LGTM!The import of
DefaultCredentialsProvideraligns with the PR objectives to support more flexible credential management across different environments.
19-22:Details
✅ Verification successful
LGTM! Verify AWS SDK version in build.gradle.
The switch to
DefaultCredentialsProvideris a good improvement as it supports multiple credential sources (environment variables, EC2 IAM roles, AWS credentials file) in a priority order.Run this script to verify the AWS SDK version in build.gradle matches the minimum required version (2.20.0) for DefaultCredentialsProvider:
🏁 Script executed:
#!/bin/bash # Description: Check AWS SDK version in build.gradle rg -A 5 "software.amazon.awssdk:s3" back-end/reacton/build.gradleLength of output: 169
LGTM! The update to use
DefaultCredentialsProvider.create()ensures that multiple credential sources are effectively handled, which is a solid improvement for both development and production environments. The AWS SDK version inbuild.gradlewas verified to be2.20.0, confirming compatibility with this configuration.
#️⃣ 연관된 이슈
#170 [BE] S3 자격증명 실패
📝 작업 내용
S3 자격증명 확인 및 AWS SDK 버전 업그레이드
ProfileCredentialsProvider를 사용해서~/.aws/credentials에 저장해둔 제 User 계정의 액세스 키로 S3에 접근했었습니다. 개발 환경에서는 사용이 가능하지만 운영 환경에서는 EC2에 부여한 Role 권한을 가지고 S3에 접근해야 해서DefaultCredentialsProvider로 변경했습니다.-
DefaultCredentialsProvider는 환경 변수, EC2 IAM Role,~/.aws/credentials등을 자동으로 탐색해서 자격증명을 제공한다고 합니다. 각 실행 환경 별로 코드를 나누는 것보다 하나를 사용하는 것이 나을 것이라 판단하여 변경하였습니다.DefaultCredentialsProvider는 기존 AWS SDK 2.13.0에서 사용이 불가하여 2.20.0로 업그레이드 했습니다.추가 버그 수정
Summary by CodeRabbit