AWS 배포 실전: EC2와 RDS로 나만의 서버 띄우기

graph TD
    subgraph VPC [VPC 10.0.0.0/16]
        subgraph AZ_A [AZ-a]
            PubA[Public Subnet 10.0.1.0/24]
            PriA[Private Subnet 10.0.10.0/24]
        end
        subgraph AZ_C [AZ-c]
            PubC[Public Subnet 10.0.2.0/24]
            PriC[Private Subnet 10.0.20.0/24]
        end
        ALB[Application Load Balancer]
        EC2_A[EC2 - AZ-a]
        EC2_C[EC2 - AZ-c]
        RDS_P[(RDS Primary)]
        RDS_S[(RDS Standby)]
    end
    
    Internet((Internet)) <--> IGW[Internet Gateway]
    IGW <--> ALB
    ALB --> EC2_A
    ALB --> EC2_C
    EC2_A --> RDS_P
    EC2_C --> RDS_P
    RDS_P -.->|Sync| RDS_S
    
    PubA --- EC2_A
    PubC --- EC2_C
    PriA --- RDS_P
    PriC --- RDS_S
    
    style PubA fill:#e3f2fd,stroke:#2196f3
    style PubC fill:#e3f2fd,stroke:#2196f3
    style PriA fill:#ffebee,stroke:#f44336
    style PriC fill:#ffebee,stroke:#f44336

SG-ALB (Application Load Balancer)
├── Inbound:  80/443 ← 0.0.0.0/0
└── Outbound: ALL → 0.0.0.0/0

SG-Web (EC2 인스턴스)
├── Inbound:  8080 ← SG-ALB (ALB에서만 접근)
├── Inbound:  22   ← Bastion SG 또는 SSM 사용 시 불필요
└── Outbound: ALL → 0.0.0.0/0

SG-DB (RDS)
├── Inbound:  3306 ← SG-Web (웹 서버에서만 접근)
└── Outbound: ALL → SG-Web

# SSM으로 접속 (포트 22 없이!)
aws ssm start-session --target i-0123456789abcdef0

// EC2에 부여할 IAM 역할 정책 예시
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject"
      ],
      "Resource": "arn:aws:s3:::my-deploy-bucket/*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "secretsmanager:GetSecretValue"
      ],
      "Resource": "arn:aws:secretsmanager:ap-northeast-2:*:secret:prod/myapp/*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "ssm:UpdateInstanceInformation",
        "ssmmessages:*",
        "ec2messages:*"
      ],
      "Resource": "*"
    }
  ]
}

[Unit]
Description=My Spring Boot Application
After=network.target
Requires=network.target

[Service]
User=appuser
Group=appuser
WorkingDirectory=/opt/myapp

# 시크릿은 환경 파일에서 로드
EnvironmentFile=/opt/myapp/.env

# JVM 튜닝 포함
ExecStart=/usr/bin/java \
  -Xms512m -Xmx1024m \
  -XX:+UseG1GC \
  -XX:MaxGCPauseMillis=200 \
  -Dspring.profiles.active=prod \
  -jar /opt/myapp/app.jar

# 정상 종료 시그널
SuccessExitStatus=143
KillSignal=SIGTERM
TimeoutStopSec=30

# 비정상 종료 시 자동 재시작
Restart=on-failure
RestartSec=10

# 보안: 파일 시스템 제한
ReadWritePaths=/opt/myapp/logs
ProtectSystem=strict
ProtectHome=true
NoNewPrivileges=true

# 리소스 제한
MemoryMax=1500M
CPUQuota=200%

[Install]
WantedBy=multi-user.target

# 서비스 등록 및 시작
sudo systemctl daemon-reload
sudo systemctl enable myapp    # 부팅 시 자동 시작
sudo systemctl start myapp

# 상태 확인
sudo systemctl status myapp

# 로그 확인 (실시간 스트리밍)
journalctl -u myapp -f --since "10 min ago"

# Multi-stage Build
FROM eclipse-temurin:17-jdk-alpine AS builder
WORKDIR /build
COPY . .
RUN ./gradlew bootJar --no-daemon

FROM eclipse-temurin:17-jre-alpine
RUN addgroup -S appgroup && adduser -S appuser -G appgroup

WORKDIR /app
COPY --from=builder /build/build/libs/app.jar app.jar

# 비root 사용자 실행
USER appuser

EXPOSE 8080
HEALTHCHECK --interval=30s --timeout=3s \
  CMD wget -qO- http://localhost:8080/actuator/health || exit 1

ENTRYPOINT ["java", \
  "-XX:+UseContainerSupport", \
  "-XX:MaxRAMPercentage=75.0", \
  "-jar", "app.jar"]

# application-prod.yml (Spring Boot)
spring:
  datasource:
    url: jdbc:mysql://${DB_ENDPOINT}:3306/mydb?useSSL=true&requireSSL=true
    username: ${DB_USERNAME}
    password: ${DB_PASSWORD}  # Secrets Manager에서 주입
    hikari:
      maximum-pool-size: 20
      minimum-idle: 5
      connection-timeout: 3000
      idle-timeout: 600000
      max-lifetime: 1800000
      leak-detection-threshold: 10000

@Configuration
public class SecretsManagerConfig {
    
    @Bean
    public DataSource dataSource() {
        // AWS SDK로 Secrets Manager에서 DB 자격증명 조회
        String secretJson = getSecret("prod/myapp/db-credentials");
        DbCredentials creds = objectMapper.readValue(secretJson, DbCredentials.class);
        
        HikariConfig config = new HikariConfig();
        config.setJdbcUrl("jdbc:mysql://" + creds.getHost() + ":3306/mydb");
        config.setUsername(creds.getUsername());
        config.setPassword(creds.getPassword());
        config.setMaximumPoolSize(20);
        return new HikariDataSource(config);
    }
    
    private String getSecret(String secretName) {
        SecretsManagerClient client = SecretsManagerClient.builder()
            .region(Region.AP_NORTHEAST_2)
            .build();
        return client.getSecretValue(
            GetSecretValueRequest.builder().secretId(secretName).build()
        ).secretString();
    }
}

# provider.tf
terraform {
  required_version = ">= 1.5"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
  
  backend "s3" {
    bucket         = "my-terraform-state"
    key            = "prod/terraform.tfstate"
    region         = "ap-northeast-2"
    dynamodb_table = "terraform-locks"
    encrypt        = true
  }
}

provider "aws" {
  region = "ap-northeast-2"
  
  default_tags {
    tags = {
      Environment = "prod"
      ManagedBy   = "terraform"
      Project     = "myapp"
    }
  }
}

# vpc.tf
module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "~> 5.0"

  name = "myapp-vpc"
  cidr = "10.0.0.0/16"

  azs             = ["ap-northeast-2a", "ap-northeast-2c"]
  public_subnets  = ["10.0.1.0/24", "10.0.2.0/24"]
  private_subnets = ["10.0.10.0/24", "10.0.20.0/24"]

  enable_nat_gateway   = true
  single_nat_gateway   = true   # 비용 절감 (프로덕션은 AZ별 1개 권장)
  enable_dns_hostnames = true
  enable_flow_log      = true

  tags = { Name = "myapp-vpc" }
}

# ec2.tf
resource "aws_launch_template" "app" {
  name_prefix   = "myapp-"
  image_id      = data.aws_ami.amazon_linux_2023.id
  instance_type = "t3.medium"

  iam_instance_profile {
    name = aws_iam_instance_profile.app.name
  }

  vpc_security_group_ids = [aws_security_group.web.id]

  user_data = base64encode(<<-EOF
    #!/bin/bash
    yum install -y java-17-amazon-corretto
    aws s3 cp s3://my-deploy-bucket/app.jar /opt/myapp/app.jar
    systemctl start myapp
  EOF
  )

  tag_specifications {
    resource_type = "instance"
    tags = { Name = "myapp-web" }
  }
}

resource "aws_autoscaling_group" "app" {
  desired_capacity    = 2
  max_size            = 6
  min_size            = 2
  vpc_zone_identifier = module.vpc.public_subnets
  target_group_arns   = [aws_lb_target_group.app.arn]

  launch_template {
    id      = aws_launch_template.app.id
    version = "$Latest"
  }

  health_check_type         = "ELB"
  health_check_grace_period = 120

  tag {
    key                 = "Name"
    value               = "myapp-asg"
    propagate_at_launch = true
  }
}

# rds.tf
resource "aws_db_instance" "main" {
  identifier     = "myapp-db"
  engine         = "mysql"
  engine_version = "8.0"
  instance_class = "db.t3.medium"

  allocated_storage     = 50
  max_allocated_storage = 200   # Auto scaling
  storage_encrypted     = true

  db_name  = "mydb"
  username = "admin"
  password = random_password.db.result   # Secrets Manager에 저장

  multi_az               = true
  db_subnet_group_name   = aws_db_subnet_group.main.name
  vpc_security_group_ids = [aws_security_group.db.id]

  backup_retention_period      = 7
  backup_window                = "03:00-04:00"
  maintenance_window           = "sun:04:00-sun:05:00"
  performance_insights_enabled = true
  monitoring_interval          = 60

  skip_final_snapshot = false
  final_snapshot_identifier = "myapp-db-final-${formatdate("YYYYMMDD", timestamp())}"

  tags = { Name = "myapp-db" }
}

terraform init     → 프로바이더/모듈 설치
terraform plan     → 변경 사항 미리보기 (★ 반드시 확인)
terraform apply    → 실제 적용
terraform destroy  → 전체 삭제 (주의!)

# .github/workflows/deploy.yml
name: Deploy to EC2

on:
  push:
    branches: [main]

permissions:
  id-token: write   # OIDC
  contents: read

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up JDK 17
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: 17
          cache: gradle

      - name: Build
        run: ./gradlew bootJar --no-daemon

      - name: Configure AWS Credentials (OIDC)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789012:role/github-actions-deploy
          aws-region: ap-northeast-2

      - name: Upload to S3
        run: |
          aws s3 cp build/libs/app.jar s3://my-deploy-bucket/app.jar
          aws s3 cp appspec.yml s3://my-deploy-bucket/appspec.yml
          aws s3 cp scripts/ s3://my-deploy-bucket/scripts/ --recursive

      - name: Trigger CodeDeploy
        run: |
          aws deploy create-deployment \
            --application-name myapp \
            --deployment-group-name prod \
            --s3-location bucket=my-deploy-bucket,key=app.jar,bundleType=zip

version: 0.0
os: linux

files:
  - source: app.jar
    destination: /opt/myapp/

hooks:
  BeforeInstall:
    - location: scripts/stop.sh
      timeout: 30
  AfterInstall:
    - location: scripts/start.sh
      timeout: 60
  ValidateService:
    - location: scripts/health-check.sh
      timeout: 120

# scripts/stop.sh
#!/bin/bash
sudo systemctl stop myapp || true

# scripts/start.sh
#!/bin/bash
sudo systemctl start myapp

# scripts/health-check.sh
#!/bin/bash
for i in {1..30}; do
  STATUS=$(curl -s -o /dev/null -w "%{http_code}" http://localhost:8080/actuator/health)
  if [ "$STATUS" == "200" ]; then
    echo "Health check passed"
    exit 0
  fi
  echo "Waiting... ($i/30)"
  sleep 2
done
echo "Health check failed"
exit 1

resource "aws_cloudwatch_metric_alarm" "cpu_high" {
  alarm_name          = "myapp-cpu-high"
  comparison_operator = "GreaterThanThreshold"
  evaluation_periods  = 3
  metric_name         = "CPUUtilization"
  namespace           = "AWS/EC2"
  period              = 300
  statistic           = "Average"
  threshold           = 80
  alarm_description   = "EC2 CPU > 80% for 15 minutes"
  alarm_actions       = [aws_sns_topic.alerts.arn]

  dimensions = {
    AutoScalingGroupName = aws_autoscaling_group.app.name
  }
}

# application-prod.yml
management:
  endpoints:
    web:
      exposure:
        include: health,info,metrics,prometheus
  endpoint:
    health:
      show-details: when-authorized
  metrics:
    export:
      cloudwatch:
        namespace: MyApp
        step: 1m

resource "aws_budgets_budget" "monthly" {
  name         = "monthly-budget"
  budget_type  = "COST"
  limit_amount = "100"
  limit_unit   = "USD"
  time_unit    = "MONTHLY"

  notification {
    comparison_operator       = "GREATER_THAN"
    threshold                 = 80
    threshold_type            = "PERCENTAGE"
    notification_type         = "ACTUAL"
    subscriber_email_addresses = ["ops@example.com"]
  }
}

# EC2 메타데이터 확인
TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" \
  -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
curl -H "X-aws-ec2-metadata-token: $TOKEN" \
  http://169.254.169.254/latest/meta-data/iam/security-credentials/

# Security Group 규칙 확인
aws ec2 describe-security-groups --group-ids sg-xxxx \
  --query 'SecurityGroups[].IpPermissions'

# RDS 연결 테스트
mysql -h myapp-db.xxxx.ap-northeast-2.rds.amazonaws.com \
  -u admin -p --ssl-mode=REQUIRED

# ALB Target 상태 확인
aws elbv2 describe-target-health --target-group-arn arn:aws:...