Devops Monk

# Expose only health and info publicly
management.endpoints.web.exposure.include=health,info

# Or expose more for internal monitoring
management.endpoints.web.exposure.include=health,info,metrics,loggers

# Never expose these without extreme care:
# env, configprops, heapdump, shutdown, threaddump, mappings

management.endpoint.shutdown.enabled=false

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                // Public health check (for load balancers)
                .requestMatchers("/actuator/health").permitAll()
                .requestMatchers("/actuator/info").permitAll()

                // Sensitive actuator endpoints — admin only
                .requestMatchers("/actuator/**").hasRole("ACTUATOR_ADMIN")

                // Application endpoints
                .requestMatchers("/api/**").authenticated()
                .anyRequest().denyAll()
            );
        return http.build();
    }
}

management.server.port=8081
management.server.address=127.0.0.1  # bind to localhost only

# Internal management service — no external ingress
apiVersion: v1
kind: Service
metadata:
  name: app-management
spec:
  selector:
    app: your-app
  ports:
    - port: 8081
      targetPort: 8081
  type: ClusterIP  # internal only, no LoadBalancer

# Detailed health only for authenticated users
management.endpoint.health.show-details=when-authorized
management.endpoint.health.show-components=when-authorized
management.endpoint.health.roles=ACTUATOR_ADMIN

// Public view: {"status": "UP"}
// Authenticated admin view: full breakdown with database, disk, redis status

@RestController
public class HealthCheckController {

    @GetMapping("/health")
    public ResponseEntity<Map<String, String>> health() {
        return ResponseEntity.ok(Map.of("status", "UP"));
    }
}

management.server.port=8081
spring.security.user.name=actuator
spring.security.user.password=${ACTUATOR_PASSWORD}
spring.security.user.roles=ACTUATOR_ADMIN

@Configuration
@Order(1)  // higher priority than the main SecurityFilterChain
public class ManagementSecurityConfig {

    @Bean
    @ConditionalOnProperty(name = "management.server.port")
    public SecurityFilterChain managementFilterChain(HttpSecurity http) throws Exception {
        http
            .securityMatcher(EndpointRequest.toAnyEndpoint())
            .authorizeHttpRequests(auth -> auth
                .requestMatchers(EndpointRequest.to("health", "info")).permitAll()
                .anyRequest().hasRole("ACTUATOR_ADMIN")
            )
            .httpBasic(Customizer.withDefaults());
        return http.build();
    }
}

@Component
public class SecurityAuditListener {

    private static final Logger auditLog = LoggerFactory.getLogger("SECURITY_AUDIT");

    @EventListener
    public void onAuthenticationSuccess(AuthenticationSuccessEvent event) {
        auditLog.info("LOGIN_SUCCESS user={} ip={}",
            event.getAuthentication().getName(),
            getClientIp());
    }

    @EventListener
    public void onAuthenticationFailure(AbstractAuthenticationFailureEvent event) {
        auditLog.warn("LOGIN_FAILURE user={} reason={}",
            event.getAuthentication().getName(),
            event.getException().getMessage());
    }

    @EventListener
    public void onAuthorizationDenied(AuthorizationDeniedEvent<?> event) {
        Authentication auth = (Authentication) event.getAuthentication().get();
        auditLog.warn("ACCESS_DENIED user={} object={}",
            auth != null ? auth.getName() : "anonymous",
            event.getObject());
    }
}

management.endpoints.web.exposure.include=auditevents

spring.config.import=vault://secret/myapp
spring.cloud.vault.uri=https://vault.internal
spring.cloud.vault.authentication=KUBERNETES

<dependency>
    <groupId>io.awspring.cloud</groupId>
    <artifactId>spring-cloud-aws-secrets-manager-config</artifactId>
</dependency>

spring.config.import=aws-secretsmanager:/myapp/prod/secrets

# Kubernetes — pull from Secret, not ConfigMap
env:
  - name: SPRING_DATASOURCE_PASSWORD
    valueFrom:
      secretKeyRef:
        name: app-secrets
        key: db-password
  - name: JWT_SECRET
    valueFrom:
      secretKeyRef:
        name: app-secrets
        key: jwt-secret

<!-- Maven: OWASP Dependency-Check -->
<plugin>
    <groupId>org.owasp</groupId>
    <artifactId>dependency-check-maven</artifactId>
    <version>9.0.9</version>
    <executions>
        <execution>
            <goals><goal>check</goal></goals>
        </execution>
    </executions>
    <configuration>
        <failBuildOnCVSS>7</failBuildOnCVSS>  <!-- fail on high/critical CVEs -->
    </configuration>
</plugin>

mvn dependency-check:check