Q:

Is there a way to avoid storing the AWS_SECRET_KEY on the .ebextensions?

I am deploying a Django based project on AWS Elastic Beanstalk. I have been following the Amazon example, where I add my credentials (ACCESS_KEY/SECRET) to my app.config under the .ebextentions directory.
The same config file has:
container_commands:
  01_syncdb:
    command: "django-admin.py migrate --noinput"
    leader_only: true
  02_collectstatic:
    command: "django-admin.py collectstatic --noinput"
    leader_only: true

Problem is that this is forcing me to store my credentials under Version Control, and I will like to avoid that.
I tried to remove the credentials and then add them with "eb setenv" but the problem is that the two django commands require the these settings to be set on the environment.
I am using the v3 cli:
eb create -db -c foo bar --profile foobar

where foobar is the name of the profile under ~/.aws/credentials, and where I want to keep my secret credentials
What is the best security practices for the AWS credentials using EB?
Thanks in advance.

A:

I ended up removing the collecstatic step from the config file, and simply take care of uploading statics on the build side.
After that, all credentials can be removed and all other boto commands will grab the credentials from the security role on the EC2 instance.

