API 키 관리

// ❌ 나쁜 예: 모든 권한
{
  "Effect": "Allow",
  "Action": "s3:*",
  "Resource": "*"
}

// ✅ 좋은 예: 필요한 권한만
{
  "Effect": "Allow",
  "Action": [
    "s3:PutObject",
    "s3:GetObject"
  ],
  "Resource": "arn:aws:s3:::my-bucket/uploads/*"
}

# 쓰기 권한 (애플리케이션)
AWS_WRITE_ACCESS_KEY_ID=your-write-key-id
AWS_WRITE_SECRET_ACCESS_KEY=your-write-secret-key

# 읽기 권한 (분석/백업)
AWS_READ_ACCESS_KEY_ID=your-read-key-id
AWS_READ_SECRET_ACCESS_KEY=your-read-secret-key

# git-secrets 설치
brew install git-secrets

# 프로젝트에 적용
git secrets --install
git secrets --register-aws

# 스캔
git secrets --scan

# dotenv-vault 사용
npm install -g dotenv-vault

# 암호화
npx dotenv-vault encrypt

# 복호화 (팀원)
DOTENV_KEY=your-dotenv-vault-key npx dotenv-vault decrypt

import { SSMClient, GetParameterCommand } from "@aws-sdk/client-ssm";

const client = new SSMClient({ region: "ap-northeast-2" });

async function getSecret(name: string) {
  const command = new GetParameterCommand({
    Name: name,
    WithDecryption: true,
  });
  const response = await client.send(command);
  return response.Parameter?.Value;
}

// 사용
const apiKey = await getSecret("/myproject/prod/openai-api-key");

import vault from "node-vault";

const client = vault({
  endpoint: "https://vault.example.com:8200",
  token: process.env.VAULT_TOKEN,
});

const { data } = await client.read("secret/data/myproject/prod");
const apiKey = data.data.OPENAI_API_KEY;

Error: The AWS Access Key Id you provided does not exist in our records

# 키 확인
echo $AWS_ACCESS_KEY_ID

# .env 파일 확인
cat .env | grep AWS

# IAM 콘솔에서 키 상태 확인
# Active 상태인지 확인

RateLimitError: Rate limit reached for gpt-4

// 재시도 로직 구현
import { RateLimiter } from "limiter";

const limiter = new RateLimiter({
  tokensPerInterval: 10,
  interval: "minute",
});

async function callOpenAI(prompt: string) {
  await limiter.removeTokens(1);

  try {
    return await openai.chat.completions.create({
      model: "gpt-4",
      messages: [{ role: "user", content: prompt }],
    });
  } catch (error) {
    if (error.status === 429) {
      // 1분 후 재시도
      await new Promise((resolve) => setTimeout(resolve, 60000));
      return callOpenAI(prompt);
    }
    throw error;
  }
}

Access Denied: You do not have permission to perform this action

// IAM 정책에 권한 추가
{
  "Effect": "Allow",
  "Action": ["s3:PutObject", "s3:GetObject", "s3:DeleteObject"],
  "Resource": "arn:aws:s3:::my-bucket/*"
}

# 권한 테스트
aws s3 ls s3://my-bucket --profile myproject