Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How should secret files be pushed to an EC2 Ruby on Rails application using amazon web services with their elastic beanstalk?

I add the files to a git repository, and I push to github, but I want to keep my secret files out of the git repository. I'm deploying to aws using:

git aws.push

The following files are in the .gitignore:


Following this link I attempted to add an S3 file to my deployment:

Quoting from that link:

Example Snippet

The following example downloads a zip file from an Amazon S3 bucket and unpacks it into /etc/myapp:


Following those directions I uploaded a file to an S3 bucket and added the following to a private.config file in the .elasticbeanstalk .ebextensions directory:


That config.tar.gz file will extract to:


However, when the application is deployed the config.tar.gz file on the S3 host is never copied or extracted. I still receive errors that the database.yml couldn't be located and the EC2 log has no record of the config file, here is the error message:

Error message:
  No such file or directory - /var/app/current/config/database.yml
Exception class:
Application root:
share|improve this question

Smells like a typo.

The instructions you linked to say, in relevant part:

Customizing your AWS Elastic Beanstalk environment when you deploy your application requires two steps:

  1. Create a configuration file with the extension .config and place it in an .ebextensions top-level directory of your source bundle. You can have multiple configuration files in your .ebextensions directory. These files are executed in alphabetical order. For example, .ebextensions/01run.config is executed before .ebextensions/02do.config.

However, you said you placed the .config file in a .elasticbeanstalk directory. Try fixing the directory name.

share|improve this answer
Oh man I thought you had it Michael, but moving the secret.config file to a new .ebextensions directory still didn't resolve the issue. Thanks for the response! – nikc Dec 18 '12 at 4:19

You can run a bash script and have all the files you need downloaded from S3 using a command line utility such as s3cmd.

I have written a series of articles that cover the customization of AWS Elastic Beanstalk.

For the details about downloading files from S3 you can refer to

share|improve this answer
Welcome to Server Fault! Generally we like answers on the site to be able to stand on their own - Links are great, but if that link ever breaks the answer should have enough information to still be helpful. Please consider editing your answer to include more detail. See the FAQ for more info. – slm Apr 11 '13 at 12:04

Try setting your sources' source to /var/app/ondeck. IIRC, the script runs there and once everything is done, the folder is renamed to /var/app/current so you're probably unzipping to the build that's about to get replaced.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.