diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
new file mode 100644
index 0000000..d057dc7
--- /dev/null
+++ b/.github/workflows/deploy.yml
@@ -0,0 +1,71 @@
+name: CD
+on:
+  push:
+    paths:
+      - '.github/workflows/**'
+      - 'moyamoya-backend/**'
+    branches: [ "main" ]
+permissions:
+  contents: read
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Set up JDK 17
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '17'
+      - name: Setting yaml file
+        # TODO: microsoft/variable-substitution is deprecated
+        uses: microsoft/variable-substitution@v1
+        with:
+          files: src/main/resources/application.yml
+        env:
+          spring.datasource.url: ${{ secrets.DB_URL }}
+          spring.datasource.username: ${{ secrets.DB_USERNAME }}
+          spring.datasource.password: ${{ secrets.DB_PASSWORD }}
+      - name: Build with Gradle
+        run: |
+          ./gradlew bootJar -x test
+      - name: Upload build artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: moyamoya
+          path: ./build/libs/moyamoya-0.0.1-SNAPSHOT.jar
+  distribute:
+    needs: build
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download build artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: moyamoya
+          path: dist
+      - name: Show downloaded files
+        run: ls -alh dist
+      - name: EC2 Upload
+        uses: appleboy/scp-action@master
+        with:
+          host: ${{ secrets.REMOTE_SSH_HOST }}
+          username: ${{ secrets.REMOTE_SSH_USERNAME }}
+          key: ${{ secrets.REMOTE_SSH_KEY }}
+          port: ${{ secrets.REMOTE_SSH_PORT }}
+          source: "dist/*.jar"
+          target: /home/ubuntu/product
+          strip_components: 1 # Remove dist path
+  service_restart:
+    needs: distribute
+    runs-on: ubuntu-latest
+    steps:
+      - name: EC2 Run
+        uses: appleboy/ssh-action@master
+        with:
+          host: ${{ secrets.REMOTE_SSH_HOST }}
+          username: ${{ secrets.REMOTE_SSH_USERNAME }}
+          key: ${{ secrets.REMOTE_SSH_KEY }}
+          port: ${{ secrets.REMOTE_SSH_PORT }}
+          script: |
+            cd /home/ubuntu/product
+            sh start.sh
\ No newline at end of file
diff --git a/build.gradle.kts b/build.gradle.kts
index 65b4ad7..ce820cb 100644
--- a/build.gradle.kts
+++ b/build.gradle.kts
@@ -49,3 +49,17 @@ allOpen {
 tasks.withType<Test> {
     useJUnitPlatform()
 }
+
+
+tasks.apply {
+    bootJar {
+        // 실행 가능한 JAR 생성 설정
+        // XX.jar
+        enabled = true
+    }
+    jar {
+        // 일반 JAR 파일 생성 비활성화
+        // XXplain.jar
+        enabled = false
+    }
+}
diff --git a/src/main/kotlin/com/ohayo/moyamoya/MoyamoyaApplication.kt b/src/main/kotlin/com/ohayo/moyamoya/MoyamoyaApplication.kt
index 843c25f..744ee6a 100644
--- a/src/main/kotlin/com/ohayo/moyamoya/MoyamoyaApplication.kt
+++ b/src/main/kotlin/com/ohayo/moyamoya/MoyamoyaApplication.kt
@@ -1,9 +1,11 @@
 package com.ohayo.moyamoya
 
 import org.springframework.boot.autoconfigure.SpringBootApplication
+import org.springframework.boot.context.properties.ConfigurationPropertiesScan
 import org.springframework.boot.runApplication
 
 @SpringBootApplication
+@ConfigurationPropertiesScan
 class MoyamoyaApplication
 
 fun main(args: Array<String>) {
diff --git a/src/main/kotlin/com/ohayo/moyamoya/api/TestController.kt b/src/main/kotlin/com/ohayo/moyamoya/api/TestController.kt
new file mode 100644
index 0000000..23bd0d6
--- /dev/null
+++ b/src/main/kotlin/com/ohayo/moyamoya/api/TestController.kt
@@ -0,0 +1,12 @@
+package com.ohayo.moyamoya.api
+
+import org.springframework.web.bind.annotation.GetMapping
+import org.springframework.web.bind.annotation.RequestMapping
+import org.springframework.web.bind.annotation.RestController
+
+@RestController
+@RequestMapping("test")
+class TestController {
+    @GetMapping
+    fun test() = "Hello"
+}
\ No newline at end of file
diff --git a/src/main/kotlin/com/ohayo/moyamoya/global/SecurityConfig.kt b/src/main/kotlin/com/ohayo/moyamoya/global/SecurityConfig.kt
new file mode 100644
index 0000000..d0aa030
--- /dev/null
+++ b/src/main/kotlin/com/ohayo/moyamoya/global/SecurityConfig.kt
@@ -0,0 +1,45 @@
+package com.ohayo.moyamoya.global
+
+import org.springframework.context.annotation.Bean
+import org.springframework.context.annotation.Configuration
+import org.springframework.security.config.annotation.web.builders.HttpSecurity
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity
+import org.springframework.security.config.http.SessionCreationPolicy
+import org.springframework.security.web.DefaultSecurityFilterChain
+import org.springframework.web.cors.CorsConfiguration
+import org.springframework.web.cors.UrlBasedCorsConfigurationSource
+
+@Configuration
+@EnableWebSecurity
+class SecurityConfig {
+    @Bean
+    fun securityFilterChain(http: HttpSecurity): DefaultSecurityFilterChain = http
+        .cors { corsConfigurationSource() }
+        .csrf { it.disable() }
+        .formLogin { it.disable() }
+        .sessionManagement { session ->
+            session.sessionCreationPolicy(SessionCreationPolicy.STATELESS)
+        }
+        .authorizeHttpRequests {
+            it.requestMatchers(
+                "auth/refresh",
+                "test/**"
+            ).permitAll()
+                .anyRequest().authenticated()
+        }
+//        .exceptionHandling {
+//            it.authenticationEntryPoint { _, response, _ -> sender.send(response, HttpStatus.UNAUTHORIZED) }
+//            it.accessDeniedHandler { _, response, _ -> sender.send(response, HttpStatus.FORBIDDEN) }
+//        }
+        .build()
+
+    @Bean
+    fun corsConfigurationSource() = UrlBasedCorsConfigurationSource().apply {
+        registerCorsConfiguration("/**", CorsConfiguration().apply {
+            addAllowedOriginPattern(CorsConfiguration.ALL)  // Allows any origin
+            addAllowedHeader(CorsConfiguration.ALL)         // Allows any header
+            addAllowedMethod(CorsConfiguration.ALL)         // Allows any HTTP method
+            allowCredentials = true                         // Allows cookies and credentials
+        })
+    }
+}
\ No newline at end of file