Basic Auth on Nginx server on Elastic Beanstalk - nginx

Question

I am trying to set up basic auth on my elastic beanstalk instance running nodejs, however, I cannot seem to get this working. I have followed this guide Nginx Server on Amazon EC2, but http traffic is still getting through the nginx instance. I think its because the nginx server on the ec2 instance is not the one I need to be altering the virtual.conf file for. I think the nginx server is on another instance entirely, but I cant seem to find it. I think this because when I ping the Domain name for my site its IP is that of the nginx server and not my Elastic IP. Any ideas on how to configure nginx to restrict http and https traffic to my site on Elastic beanstalk?

Answer 1

Although this isn't a direct answer to your question, I had a lot of trouble finding resources for HTTP Basic Authentication for AWS.
I ended up switching from Nginx to Apache and used this configuration in PROJECT_ROOT/.ebextensions/apache.conf:
files:
"/etc/httpd/conf.d/allow_override.conf":
mode: "000644"
owner: ec2-user
group: ec2-user
encoding: plain
content: |
<Directory /var/app/current/>
AllowOverride AuthConfig
</Directory>
"/etc/httpd/conf.d/auth.conf":
mode: "000644"
owner: ec2-user
group: ec2-user
encoding: plain
content: |
<Directory /var/app/current/>
AuthType Basic
AuthName "Myproject Prototype"
AuthUserFile /etc/httpd/.htpasswd
Require valid-user
</Directory>
"/etc/httpd/.htpasswd":
mode: "000644"
owner: ec2-user
group: ec2-user
encoding: plain
content: |
myusername:mypassword-generated-by-htpasswd
Note, this is not ideal as you end up having password protection in the source code of the repo... But, I couldn't find a better way documented anywhere. I'm currently exploring baking the HTTP Auth into the ec2 instance, saving the instance as an AMI, and using that AMI for the instances that are auto-generated in my beanstalk.
Don't even get me started on HTTP Auth in front of s3 buckets, which is not supported by AWS and requires you point your DNS at a third-party service!

Answer 2

The key factor of managing Elastic Beanstalk's nginx Basic auth is to recognize the conf file is managed by beanstalk, so when you modify it, you need to edit the file in /tmp/deployment/config. All the files in there will be copied to destination, and the destination is calculated by replacing the filename's # character to /. And since the /tmp/deployment/config/#etc#nginx#conf.d#00_elastic_beanstalk_proxy.conf file is not created on the commands step, you need to modify it on the container_commands step.
For me, following worked.
files:
/etc/nginx/.htpasswd:
mode: "000755"
owner: root
group: root
# the content of htpasswd.
# Obtain it by `htpasswd -nb USER PASSWORD`
content: "USER_NAME:HASHED_PASS"
container_commands:
add-basic:
command: |
set -ex
EB_CONFIG_STAGING_DIR=$(/opt/elasticbeanstalk/bin/get-config container -k config_staging_dir)
file_name="${EB_CONFIG_STAGING_DIR}/$(echo /etc/nginx/conf.d/00_elastic_beanstalk_proxy.conf | sed -e 's|/|#|g')"
sed -i -e '
/location \// {
s|$|\nauth_basic "Restricted Area";\nauth_basic_user_file /etc/nginx/.htpasswd;|
:loop
n
b loop
}' "$file_name"