22주차 코드 뒤풀이: 외부 CI·OIDC 증거부터 disposable restore·비용 teardown까지

학습용 예시 · PDF 외부 실행 계약 · 정본 답안 아님
status: FUTURE_TRIGGER
execution: NOT_RUN_EXTERNAL
required_fields: official_run_url, run_id, commit_sha, workflow_name, conclusion, screenshot_path, screenshot_sha256, artifact_url
url_rule: official HTTPS GitHub Actions run URL
hash_rule: screenshot_sha256 is exact 64-hex hash of screenshot_path
local_green_owner: none
local_restore_owner: scripts/run-w22-restore.ps1 (Saturday)
manual_rule: 승인된 repository의 실제 push/PR 뒤 공식 run URL과 commit SHA를 사람이 대조한다.
failure_artifact_rule: 고의 실패 run에서도 test report artifact가 남아야 한다.

boundary: 로컬 파일 존재·문자열 검사·self-declared PASS는 외부 CI Green이 아니다.

학습용 예시 · PDF architecture template · 정본 답안 아님 · 그대로 실행 금지
Internet -> ALB:443 (public)
ALB SG -> App:8080 (private)
App SG -> RDS PostgreSQL:5432 (private)
Admin -> SSM Session Manager (no inbound SSH 22)
Secrets -> SSM Parameter Store or Secrets Manager
Logs/Metrics -> CloudWatch
security_group_rule: App inbound source is ALB SG, not 0.0.0.0/0.
database_rule: RDS public accessibility is false and inbound source is App SG only.
cost_boundary: account resource creation requires a budget and teardown plan first.

non_goal: single-instance learning deployment is not production HA, WAF, or full DR.

# 학습용 예시 · PDF OIDC template · 정본 답안 아님 · 그대로 실행 금지
permissions:
  id-token: write
  contents: read
steps:
  - uses: aws-actions/configure-aws-credentials@v4
    with:
      role-to-assume: arn:aws:iam::123456789012:role/fcl-github-deploy
      aws-region: ap-northeast-2
  - run: aws sts get-caller-identity

# 실제 trust policy는 정확한 repository와 main 또는 승인 environment의 sub claim으로 제한한다.
# AWS_ACCESS_KEY_ID·AWS_SECRET_ACCESS_KEY 같은 장기 정적 key를 workflow secret에 저장하지 않는다.
# 이 조각은 외부 assume-role 성공을 증명하지 않으며 공식 run 증거는 MANUAL_REVIEW_REQUIRED다.

{
  "_provenance": "학습용 예시 · PDF manifest schema · 정본 답안 아님 · 비실행",
  "gitSha": "0000000000000000000000000000000000000000",
  "image": "example.invalid/financial-core@sha256:0000000000000000000000000000000000000000000000000000000000000000",
  "java": "21",
  "springBoot": "4.1.0",
  "dbMigrations": [
    {
      "version": "001",
      "script": "V001__common.sql",

      "checksum": "EXAMPLE_FLYWAY_CHECKSUM"
    },
    {
      "version": "019",
      "script": "V019__audit.sql",
      "checksum": "EXAMPLE_FLYWAY_CHECKSUM"
    }
  ],
  "dbMigrationInventorySha256": "0000000000000000000000000000000000000000000000000000000000000000",
  "verificationStatus": "MANUAL_REVIEW_REQUIRED"

}

#!/usr/bin/env bash
# 학습용 예시 · PDF 연결 순서 template · 정본 답안 아님 · 그대로 실행 금지
# 1. identity: 현재 AWS caller가 의도한 deploy/app role인지 확인한다.
aws sts get-caller-identity
# 2. secret boundary: decrypted Value를 출력하지 않고 parameter ARN만 확인한다.
aws ssm get-parameter --name /fcl/prod/db/password --query Parameter.ARN
# 3. network: private app host에서만 private RDS endpoint와 5432 도달성을 확인한다.
pg_isready -h private-rds-endpoint.internal -p 5432
# 4. migration: Flyway info와 실제 schema history의 version·script·checksum을 대조한다.
./gradlew flywayInfo

# 5. readiness: migration 성공 뒤에만 application traffic readiness를 확인한다.
curl --fail --silent http://127.0.0.1:8080/actuator/health/readiness
# timeout은 route·DNS·SG 단계, password authentication failed는 secret·user·DB name 단계를 먼저 본다.
# secret 원문, account ID, endpoint 전체는 evidence에 저장하지 않는다.

param(
    [ValidateSet('Compose','Container')][string]$Mode = 'Compose',
    [string]$ComposeProject = 'w22-restore-lab',
    [string]$ContainerName = '',
    [string]$EvidenceDir = 'evidence/w22',
    [string]$TargetDb = 'financial_core_restore'
)

Set-StrictMode -Version Latest
$ErrorActionPreference = 'Stop'

if ($TargetDb -cne 'financial_core_restore') {

    throw 'W22 disposable target allowlist violation'
}

$root = Split-Path -Parent $PSScriptRoot
$evidence = if ([IO.Path]::IsPathRooted($EvidenceDir)) {
    [IO.Path]::GetFullPath($EvidenceDir)
} else {
    [IO.Path]::GetFullPath((Join-Path $root $EvidenceDir))
}
$tool = Join-Path $PSScriptRoot 'run-w42-restore-drill.ps1'
$compose = Join-Path $root 'compose.yaml'
$ownedCompose = $false

$composeCleanup = $false
$failure = $null
$body = $null

if (!(Test-Path -LiteralPath $tool -PathType Leaf)) {
    throw 'W22 transitive W42 tool missing'
}

try {
    if ($Mode -ceq 'Compose') {
        if ($ContainerName) { throw 'W22 Compose mode rejects ContainerName' }
        if ([string]::IsNullOrWhiteSpace($env:FCL_DB_PASSWORD)) {

            $env:FCL_DB_PASSWORD = 'w22-disposable-password'
        }
        # Own the unique Compose project before startup so a partial `up`
        # failure still reaches finally/down and cannot leak resources.
        $ownedCompose = $true
        & docker compose -f $compose -p $ComposeProject up -d --wait db
        if ($LASTEXITCODE -ne 0) { throw "W22 compose up exit=$LASTEXITCODE" }
        $ContainerName = (& docker compose -f $compose -p $ComposeProject ps -q db).Trim()
    } elseif ([string]::IsNullOrWhiteSpace($ContainerName)) {
        throw 'W22 Container mode requires ContainerName'
    }
    if ([string]::IsNullOrWhiteSpace($ContainerName)) {

        throw 'W22 container resolution failed'
    }

    $output = @(
        & powershell.exe -NoProfile -ExecutionPolicy Bypass -File $tool `
            -Mode Container `
            -ContainerName $ContainerName `
            -AdminDatabase financial_core `
            -Username app `
            -TargetDb $TargetDb `
            -EvidenceDir $evidence 2>&1
    )

    $nativeExit = $LASTEXITCODE
    if ($nativeExit -ne 0) {
        throw "W22 restore native exit=$nativeExit`n$($output -join "`n")"
    }
    $line = $output | Where-Object { $_ -match '^PASS W42_RESTORE ' } | Select-Object -Last 1
    if (!$line -or $line -cnotmatch 'row_count=3 ledger_sum=120 mismatch=0 rto_seconds=([0-9]+(?:\.[0-9]+)?) source_dropped=1 target_dropped=1') {
        throw "W22 transcript mismatch: $output"
    }

    $innerPath = Join-Path $evidence '5-restore-result.json'
    if (!(Test-Path -LiteralPath $innerPath -PathType Leaf)) {
        throw 'W22 inner restore result missing'

    }
    $inner = Get-Content -Raw -LiteralPath $innerPath | ConvertFrom-Json
    if ([int]$inner.row_count -ne 3 -or [long]$inner.ledger_sum -ne 120 -or
        [int]$inner.mismatch_count -ne 0 -or [long]$inner.dump_bytes -le 0) {
        throw 'W22 inner restore invariant mismatch'
    }
    $start = [DateTimeOffset]::MinValue
    $end = [DateTimeOffset]::MinValue
    if (![DateTimeOffset]::TryParse([string]$inner.start_utc, [ref]$start) -or
        ![DateTimeOffset]::TryParse([string]$inner.end_utc, [ref]$end) -or $end -lt $start) {
        throw 'W22 inner restore timestamps invalid'
    }

    $body = [ordered]@{
        owner = 'W22'
        run_id = [guid]::NewGuid().ToString('N')
        started_at_utc = $start.ToString('o')
        completed_at_utc = $end.ToString('o')
        source_db = 'financial_core_restore_source'
        target_db = $TargetDb
        fixture_schema = 'restore_probe_v1'
        row_count = 3
        ledger_sum = 120
        mismatch = 0

        rto_seconds = [double]$inner.rto_seconds
        dump_bytes = [long]$inner.dump_bytes
        source_dropped = 1
        target_dropped = 1
        cleanup = 1
        native_exit = 0
        inner_result_path = 'evidence/w22/5-restore-result.json'
        inner_result_sha256 = (Get-FileHash -LiteralPath $innerPath -Algorithm SHA256).Hash.ToLowerInvariant()
    }
} catch {
    $failure = $_
} finally {

    if ($ownedCompose) {
        & docker compose -f $compose -p $ComposeProject down -v --remove-orphans | Out-Null
        $composeCleanup = ($LASTEXITCODE -eq 0)
    } else {
        $composeCleanup = $true
    }
}

if (!$composeCleanup) {
    if ($null -ne $failure) {
        throw "W22 restore failed and owned Compose cleanup failed: $($failure.Exception.Message)"
    }

    throw 'W22 owned Compose cleanup failed'
}
if ($null -ne $failure) { throw $failure }
if ($null -eq $body) { throw 'W22 restore produced no canonical result' }

$body['compose_cleanup'] = if ($ownedCompose) { 1 } else { 'not-owned' }
New-Item -ItemType Directory -Force $evidence | Out-Null
$resultPath = Join-Path $evidence 'restore-result.json'
$temporary = "$resultPath.tmp"
$body | ConvertTo-Json -Depth 5 | Set-Content -Encoding utf8 -LiteralPath $temporary
Move-Item -LiteralPath $temporary -Destination $resultPath -Force

"W22_RESTORE_GREEN row_count=3 ledger_sum=120 mismatch=0 rto_seconds=$($body.rto_seconds) cleanup=1 native_exit=0"