I am super new to anything DevOps and server related, but I just started hosting my webapp on AWS Elastic Beanstalk with Docker Compose. The EB documentation recommends that for referencing an env file within docker compose to:

• Add the .env file generated by Elastic Beanstalk to the env_file configuration option in the docker-compose.yml file.

This works with either the ones I set on the EB console, or if I provide my own, i.e.

services:
  web:
    build: .
    environment:
      - DEBUG=1
    env_file:
      - .env

This is my current working implementation to serve my env variables to my application and populating it within my EC2 instance at /var/app/current/.env, but I recently became very worried about some malicious GET /.env requests I found through my nginx access logs /var/log/nginx/access.log:

(IP Address - - [26/Jul/2024:22:38:18 +0000] "GET /.env HTTP/1.1" 200 653 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36" "-"

It indicates the return to this request was successful and 653 bytes (not the byte size of the of my env file), and testing this request myself only returned the index.html of my page:

sudo tail -n 1000 /var/log/nginx/access.log | grep "GET /.env" | head -n 1 | awk '{print $7}' | xargs curl -s http://site.elasticbeanstalk.com

I have since configured the nginx to deny all requests for hidden files and return a 404:

     location ~ /.
       deny all;
       return 404;
     }

But I am now extremely concerned if this is a data breach. I am not sure if my env file can somehow be accessed without directly ssh into my EC2 instance. The Amazon Documentation provides this as a method, so I am assuming it is safe, but I would like to be cautious.

I also don’t know how to properly interpolate .env variables at runtime with hooks at what not.

I am not very learned on security best practices since this is my first time trying to host a web application, so do I need to be worried about continuing with the env file inside my EC2 instance?

What should I do to avoid any potential security concerns in the future, and what should I check now to make sure I haven’t messed up already?

Thank you so much for anyone taking the time to answer this.