chore: DB 백업을 SSM 명령 실행 방식으로 변경 by JanooGwan · Pull Request #606 · BCSDLab/KONECT_BACK_END

JanooGwan · 2026-04-28T00:43:10Z

🔍 개요

DB 서버 백업을 위해 외부 SSH 포트(22222)를 열어두던 배포 흐름을 AWS Systems Manager Run Command 기반으로 전환합니다.
배포 전 백업은 DB 서버 내부의 backup-db.sh를 SSM으로 실행하도록 변경해 DB 서버 인바운드 SSH 의존성을 줄입니다.

🚀 주요 변경 내용

.github/workflows/deploy-stage.yml
- GitHub OIDC 사용을 위한 id-token: write 권한을 추가했습니다.
- AWS 자격 증명 설정 단계(aws-actions/configure-aws-credentials)를 추가했습니다.
- stage DB 백업 단계를 SSH 접속 대신 SSM Run Command 호출로 변경했습니다.
.github/workflows/deploy-prod.yml
- GitHub OIDC 사용을 위한 id-token: write 권한을 추가했습니다.
- AWS 자격 증명 설정 단계(aws-actions/configure-aws-credentials)를 추가했습니다.
- prod DB 백업 단계를 SSH 접속 대신 SSM Run Command 호출로 변경했습니다.

💬 참고 사항

GitHub Actions Secrets에 AWS_ROLE_TO_ASSUME, AWS_REGION, DB_INSTANCE_ID가 필요합니다.
stage/prod 배포에서 SSM 백업 성공을 확인한 뒤 DB 서버 보안 그룹의 22222/TCP 0.0.0.0/0 규칙을 제거할 수 있습니다.
prod 서버의 /home/ubuntu/konect/prod-db-compose/backup-db.sh 존재 여부와 실행 가능 여부를 배포 전 확인해야 합니다.

✅ Checklist (완료 조건)

코드 스타일 가이드 준수
테스트 코드 포함됨
Reviewers / Assignees / Labels 지정 완료
보안 및 민감 정보 검증 (API 키, 환경 변수, 개인정보 등)

coderabbitai · 2026-04-28T00:43:16Z

Warning

Rate limit exceeded

@JanooGwan has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 0 minutes and 0 seconds before requesting another review.

To keep reviews running without waiting, you can enable usage-based add-on for your organization. This allows additional reviews beyond the hourly cap. Account admins can enable it under billing.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 54e030f1-02c9-40ed-9412-a5a64e54547d

📥 Commits

Reviewing files that changed from the base of the PR and between 38eebb3 and 1f673c9.

📒 Files selected for processing (2)

.github/workflows/deploy-prod.yml
.github/workflows/deploy-stage.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch chore/db-backup-ssm

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Copilot

Pull request overview

외부 SSH 포트를 열어두고 DB 서버에 직접 접속해 백업을 실행하던 배포 흐름을, GitHub OIDC + AWS Systems Manager Run Command 기반으로 전환해 DB 서버 인바운드 SSH 의존성을 줄이려는 PR입니다.

Changes:

stage/prod 배포 워크플로우에 OIDC 사용을 위한 permissions: id-token: write 추가
aws-actions/configure-aws-credentials로 AWS 자격 증명 설정 단계 추가
배포 전 DB 백업을 SSH 실행 방식에서 SSM send-command 실행 방식으로 변경

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File	Description
.github/workflows/deploy-stage.yml	stage 배포 전 백업을 SSM Run Command로 실행하도록 변경 및 OIDC 권한/자격증명 설정 추가
.github/workflows/deploy-prod.yml	prod 배포 전 백업을 SSM Run Command로 실행하도록 변경 및 OIDC 권한/자격증명 설정 추가

Copilot · 2026-04-28T01:18:09Z

-      - name: Backup stage MySQL before deploy
-        uses: appleboy/ssh-action@v1.2.0
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4


aws-actions/configure-aws-credentials가 다른 액션들과 달리 커밋 SHA로 고정되지 않고 @v4 태그를 사용하고 있어, 공급망(액션 하이재킹/변조) 리스크가 커집니다. 이 저장소의 다른 워크플로우처럼 해당 액션도 커밋 SHA로 pinning 해주세요.

Suggested change

uses: aws-actions/configure-aws-credentials@v4

uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6b27e6f440bfd2d1b0c1c7f5f # v4

Copilot · 2026-04-28T01:18:09Z

+          aws ssm get-command-invocation \
+            --command-id "$COMMAND_ID" \
+            --instance-id "$DB_INSTANCE_ID" \
+            --query "{Status:Status,Output:StandardOutputContent,Error:StandardErrorContent}" \
+            --output json



get-command-invocation로 원격 백업 스크립트의 stdout/stderr를 그대로 Actions 로그에 출력하고 있습니다. backup-db.sh가 실패 시 환경변수/경로/계정 정보 등을 출력할 수 있으니, 로그에 남겨도 안전한 출력만 남기도록 스크립트 출력 정책을 보장하거나(예: 요약만 출력), 워크플로우에서 출력 내용을 필터링/축약하도록 조정하는 편이 안전합니다.

Suggested change

aws ssm get-command-invocation \

--command-id "$COMMAND_ID" \

--instance-id "$DB_INSTANCE_ID" \

--query "{Status:Status,Output:StandardOutputContent,Error:StandardErrorContent}" \

--output json

COMMAND_STATUS=$(aws ssm get-command-invocation \

--command-id "$COMMAND_ID" \

--instance-id "$DB_INSTANCE_ID" \

--query "Status" \

--output text)

RESPONSE_CODE=$(aws ssm get-command-invocation \

--command-id "$COMMAND_ID" \

--instance-id "$DB_INSTANCE_ID" \

--query "ResponseCode" \

--output text)

if [ "$COMMAND_STATUS" != "Success" ] || [ "$RESPONSE_CODE" != "0" ]; then

echo "Stage MySQL backup failed. status=$COMMAND_STATUS, response_code=$RESPONSE_CODE"

exit 1

fi

echo "Stage MySQL backup completed successfully."

Copilot · 2026-04-28T01:18:09Z

-      - name: Backup prod MySQL before deploy
-        uses: appleboy/ssh-action@v1.2.0
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4


aws-actions/configure-aws-credentials가 다른 액션들과 달리 커밋 SHA로 고정되지 않고 @v4 태그를 사용하고 있어, 공급망(액션 하이재킹/변조) 리스크가 커집니다. 이 저장소의 다른 워크플로우처럼 해당 액션도 커밋 SHA로 pinning 해주세요.

Suggested change

uses: aws-actions/configure-aws-credentials@v4

uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6fc65e0e245d8c4b7f4a9b0b3 # v4

Copilot · 2026-04-28T01:18:10Z

+          aws ssm get-command-invocation \
+            --command-id "$COMMAND_ID" \
+            --instance-id "$DB_INSTANCE_ID" \
+            --query "{Status:Status,Output:StandardOutputContent,Error:StandardErrorContent}" \
+            --output json



get-command-invocation로 원격 백업 스크립트의 stdout/stderr를 그대로 Actions 로그에 출력하고 있습니다. backup-db.sh가 실패 시 환경변수/경로/계정 정보 등을 출력할 수 있으니, 로그에 남겨도 안전한 출력만 남기도록 스크립트 출력 정책을 보장하거나(예: 요약만 출력), 워크플로우에서 출력 내용을 필터링/축약하도록 조정하는 편이 안전합니다.

Suggested change

aws ssm get-command-invocation \

--command-id "$COMMAND_ID" \

--instance-id "$DB_INSTANCE_ID" \

--query "{Status:Status,Output:StandardOutputContent,Error:StandardErrorContent}" \

--output json

INVOCATION_SUMMARY=$(aws ssm get-command-invocation \

--command-id "$COMMAND_ID" \

--instance-id "$DB_INSTANCE_ID" \

--query "[Status,StatusDetails,ResponseCode]" \

--output text)

read -r BACKUP_STATUS BACKUP_STATUS_DETAILS BACKUP_RESPONSE_CODE <<< "$INVOCATION_SUMMARY"

echo "Backup command status: $BACKUP_STATUS (details: $BACKUP_STATUS_DETAILS, response-code: $BACKUP_RESPONSE_CODE)"

if [ "$BACKUP_STATUS" != "Success" ]; then

echo "Backup command failed. Detailed remote stdout/stderr is intentionally not printed to avoid leaking sensitive information."

exit 1

fi

chore: DB 백업을 SSM 명령 실행 방식으로 변경

63267ba

JanooGwan self-assigned this Apr 28, 2026

JanooGwan added the 배포 운영 서버의 배포 관련 이슈입니다. label Apr 28, 2026

JanooGwan requested a review from Copilot April 28, 2026 01:14

Copilot started reviewing on behalf of JanooGwan April 28, 2026 01:15 View session

Copilot AI reviewed Apr 28, 2026

View reviewed changes

chore: SSM 백업 로그 출력 범위 제한

1f673c9

JanooGwan merged commit 09e60b1 into develop Apr 28, 2026
4 checks passed

JanooGwan deleted the chore/db-backup-ssm branch April 28, 2026 01:32

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore: DB 백업을 SSM 명령 실행 방식으로 변경#606

chore: DB 백업을 SSM 명령 실행 방식으로 변경#606
JanooGwan merged 2 commits intodevelopfrom
chore/db-backup-ssm

JanooGwan commented Apr 28, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Apr 28, 2026 •

edited

Loading

Rate limit exceeded

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 28, 2026

Uh oh!

Copilot AI Apr 28, 2026

Uh oh!

Copilot AI Apr 28, 2026

Uh oh!

Copilot AI Apr 28, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	uses: aws-actions/configure-aws-credentials@v4
	uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6b27e6f440bfd2d1b0c1c7f5f # v4

Conversation

JanooGwan commented Apr 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔍 개요

🚀 주요 변경 내용

💬 참고 사항

✅ Checklist (완료 조건)

Uh oh!

coderabbitai Bot commented Apr 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Rate limit exceeded

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 28, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 28, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 28, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 28, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

JanooGwan commented Apr 28, 2026 •

edited

Loading

coderabbitai Bot commented Apr 28, 2026 •

edited

Loading