CFnでゼロからWeb三層（マルチAZ）のWordPress環境を構築して、アクセスしてみた 〜EFSでEC2を2台構成に〜

AWSTemplateFormatVersion: "2010-09-09"
Description: >-
  Multi-AZ WordPress 3-tier (ALB / EC2 Auto Scaling / EFS + RDS), accessed over HTTP via the ALB DNS name.
  For verification use only. Region: ap-northeast-1 is assumed.

Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label: { default: "Site / Access" }
        Parameters: [ProjectName, AllowedCidr]
      - Label: { default: "Compute (Web tier)" }
        Parameters: [LatestAmiId, InstanceType, DesiredCapacity]
      - Label: { default: "Database (Data tier)" }
        Parameters: [DBInstanceClass, DBEngineVersion, DBMultiAZ]
      - Label: { default: "Network" }
        Parameters: [NatGatewayMode]

Parameters:
  ProjectName:
    Type: String
    Default: wp-3tier
    AllowedPattern: "^[a-z][a-z0-9-]{1,20}$"
    Description: Name prefix for resources (lowercase letters, digits, hyphen).
  AllowedCidr:
    Type: String
    AllowedPattern: "^([0-9]{1,3}\\.){3}[0-9]{1,3}/[0-9]{1,2}$"
    ConstraintDescription: Must be a CIDR such as 203.0.113.10/32
    Description: >-
      CIDR allowed to access the site over HTTP. Use your own public IP as /32 (e.g. 203.0.113.10/32).
      0.0.0.0/0 opens the site to the whole internet (not recommended: HTTP is not encrypted).
  LatestAmiId:
    Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>
    Default: /aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64
  InstanceType:
    Type: String
    Default: t3.micro
    AllowedValues: [t3.micro, t3.small, t3.medium]
  DesiredCapacity:
    Type: Number
    Default: 2
    MinValue: 2
    MaxValue: 4
    Description: Number of web servers (2 or more to span 2 AZs).
  DBInstanceClass:
    Type: String
    Default: db.t4g.micro
    AllowedValues: [db.t4g.micro, db.t4g.small, db.t3.micro, db.t3.small]
  DBEngineVersion:
    Type: String
    Default: "8.4"
    Description: >-
      RDS for MySQL version. Check availability with
      aws rds describe-db-engine-versions --engine mysql
  DBMultiAZ:
    Type: String
    Default: "true"
    AllowedValues: ["true", "false"]
  NatGatewayMode:
    Type: String
    Default: Single
    AllowedValues: [Single, PerAZ]
    Description: Single = one NAT Gateway (cheaper). PerAZ = one per AZ (resilient to AZ failure).

Conditions:
  IsPerAzNat: !Equals [!Ref NatGatewayMode, PerAZ]

Resources:
  # ---------------------------------------------------------------
  # Network
  # ---------------------------------------------------------------
  Vpc:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.0.0.0/16
      EnableDnsSupport: true
      EnableDnsHostnames: true
      Tags:
        - { Key: Name, Value: !Sub "${ProjectName}-vpc" }

  InternetGateway:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
        - { Key: Name, Value: !Sub "${ProjectName}-igw" }

  IgwAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref Vpc
      InternetGatewayId: !Ref InternetGateway

  # Public subnets (ALB, NAT Gateway)
  PublicSubnetA:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref Vpc
      AvailabilityZone: !Select [0, !GetAZs ""]
      CidrBlock: 10.0.0.0/24
      MapPublicIpOnLaunch: false
      Tags:
        - { Key: Name, Value: !Sub "${ProjectName}-public-a" }
  PublicSubnetB:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref Vpc
      AvailabilityZone: !Select [1, !GetAZs ""]
      CidrBlock: 10.0.1.0/24
      MapPublicIpOnLaunch: false
      Tags:
        - { Key: Name, Value: !Sub "${ProjectName}-public-b" }

  # Private app subnets (EC2)
  AppSubnetA:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref Vpc
      AvailabilityZone: !Select [0, !GetAZs ""]
      CidrBlock: 10.0.10.0/24
      Tags:
        - { Key: Name, Value: !Sub "${ProjectName}-app-a" }
  AppSubnetB:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref Vpc
      AvailabilityZone: !Select [1, !GetAZs ""]
      CidrBlock: 10.0.11.0/24
      Tags:
        - { Key: Name, Value: !Sub "${ProjectName}-app-b" }

  # Private data subnets (RDS, EFS) - no route to the internet
  DataSubnetA:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref Vpc
      AvailabilityZone: !Select [0, !GetAZs ""]
      CidrBlock: 10.0.20.0/24
      Tags:
        - { Key: Name, Value: !Sub "${ProjectName}-data-a" }
  DataSubnetB:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref Vpc
      AvailabilityZone: !Select [1, !GetAZs ""]
      CidrBlock: 10.0.21.0/24
      Tags:
        - { Key: Name, Value: !Sub "${ProjectName}-data-b" }

  # Route tables
  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref Vpc
      Tags:
        - { Key: Name, Value: !Sub "${ProjectName}-public-rt" }
  PublicDefaultRoute:
    Type: AWS::EC2::Route
    DependsOn: IgwAttachment
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway
  PublicSubnetARouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnetA
      RouteTableId: !Ref PublicRouteTable
  PublicSubnetBRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnetB
      RouteTableId: !Ref PublicRouteTable

  NatEipA:
    Type: AWS::EC2::EIP
    DependsOn: IgwAttachment
    Properties:
      Domain: vpc
      Tags:
        - { Key: Name, Value: !Sub "${ProjectName}-nat-eip-a" }
  NatGatewayA:
    Type: AWS::EC2::NatGateway
    Properties:
      AllocationId: !GetAtt NatEipA.AllocationId
      SubnetId: !Ref PublicSubnetA
      Tags:
        - { Key: Name, Value: !Sub "${ProjectName}-nat-a" }
  NatEipB:
    Type: AWS::EC2::EIP
    Condition: IsPerAzNat
    DependsOn: IgwAttachment
    Properties:
      Domain: vpc
      Tags:
        - { Key: Name, Value: !Sub "${ProjectName}-nat-eip-b" }
  NatGatewayB:
    Type: AWS::EC2::NatGateway
    Condition: IsPerAzNat
    Properties:
      AllocationId: !GetAtt NatEipB.AllocationId
      SubnetId: !Ref PublicSubnetB
      Tags:
        - { Key: Name, Value: !Sub "${ProjectName}-nat-b" }

  AppRouteTableA:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref Vpc
      Tags:
        - { Key: Name, Value: !Sub "${ProjectName}-app-rt-a" }
  AppDefaultRouteA:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref AppRouteTableA
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !Ref NatGatewayA
  AppSubnetARouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref AppSubnetA
      RouteTableId: !Ref AppRouteTableA

  AppRouteTableB:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref Vpc
      Tags:
        - { Key: Name, Value: !Sub "${ProjectName}-app-rt-b" }
  AppDefaultRouteB:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref AppRouteTableB
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !If [IsPerAzNat, !Ref NatGatewayB, !Ref NatGatewayA]
  AppSubnetBRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref AppSubnetB
      RouteTableId: !Ref AppRouteTableB

  DataRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref Vpc
      Tags:
        - { Key: Name, Value: !Sub "${ProjectName}-data-rt" }
  DataSubnetARouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref DataSubnetA
      RouteTableId: !Ref DataRouteTable
  DataSubnetBRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref DataSubnetB
      RouteTableId: !Ref DataRouteTable

  # ---------------------------------------------------------------
  # Security groups (chain: Internet -> ALB -> App -> DB / EFS)
  # ---------------------------------------------------------------
  AlbSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: ALB (HTTP from the allowed CIDR only)
      VpcId: !Ref Vpc
      SecurityGroupIngress:
        - { IpProtocol: tcp, FromPort: 80, ToPort: 80, CidrIp: !Ref AllowedCidr, Description: HTTP from the allowed CIDR }
      Tags:
        - { Key: Name, Value: !Sub "${ProjectName}-alb-sg" }

  AppSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Web servers (HTTP from ALB only)
      VpcId: !Ref Vpc
      SecurityGroupIngress:
        - { IpProtocol: tcp, FromPort: 80, ToPort: 80, SourceSecurityGroupId: !Ref AlbSecurityGroup, Description: HTTP from ALB }
      Tags:
        - { Key: Name, Value: !Sub "${ProjectName}-app-sg" }

  DbSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: RDS (MySQL from web servers only)
      VpcId: !Ref Vpc
      SecurityGroupIngress:
        - { IpProtocol: tcp, FromPort: 3306, ToPort: 3306, SourceSecurityGroupId: !Ref AppSecurityGroup, Description: MySQL from web servers }
      Tags:
        - { Key: Name, Value: !Sub "${ProjectName}-db-sg" }

  EfsSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: EFS (NFS from web servers only)
      VpcId: !Ref Vpc
      SecurityGroupIngress:
        - { IpProtocol: tcp, FromPort: 2049, ToPort: 2049, SourceSecurityGroupId: !Ref AppSecurityGroup, Description: NFS from web servers }
      Tags:
        - { Key: Name, Value: !Sub "${ProjectName}-efs-sg" }

  # ---------------------------------------------------------------
  # Data tier: RDS (Multi-AZ) / EFS
  # ---------------------------------------------------------------
  DbSubnetGroup:
    Type: AWS::RDS::DBSubnetGroup
    Properties:
      DBSubnetGroupDescription: Data subnets for RDS
      SubnetIds: [!Ref DataSubnetA, !Ref DataSubnetB]
      Tags:
        - { Key: Name, Value: !Sub "${ProjectName}-db-subnet-group" }

  DbInstance:
    Type: AWS::RDS::DBInstance
    # For verification: do not leave a final snapshot behind (it would keep costing money).
    DeletionPolicy: Delete
    UpdateReplacePolicy: Delete
    Properties:
      Engine: mysql
      EngineVersion: !Ref DBEngineVersion
      DBInstanceClass: !Ref DBInstanceClass
      AllocatedStorage: "20"
      StorageType: gp3
      StorageEncrypted: true
      DBName: wordpress
      MasterUsername: wpadmin
      ManageMasterUserPassword: true # RDS creates/manages the password in Secrets Manager
      MultiAZ: !Ref DBMultiAZ
      PubliclyAccessible: false
      DBSubnetGroupName: !Ref DbSubnetGroup
      VPCSecurityGroups: [!Ref DbSecurityGroup]
      BackupRetentionPeriod: 1
      DeletionProtection: false
      Tags:
        - { Key: Name, Value: !Sub "${ProjectName}-db" }

  FileSystem:
    Type: AWS::EFS::FileSystem
    Properties:
      Encrypted: true
      PerformanceMode: generalPurpose
      ThroughputMode: elastic
      FileSystemTags:
        - { Key: Name, Value: !Sub "${ProjectName}-efs" }

  MountTargetA:
    Type: AWS::EFS::MountTarget
    Properties:
      FileSystemId: !Ref FileSystem
      SubnetId: !Ref DataSubnetA
      SecurityGroups: [!Ref EfsSecurityGroup]
  MountTargetB:
    Type: AWS::EFS::MountTarget
    Properties:
      FileSystemId: !Ref FileSystem
      SubnetId: !Ref DataSubnetB
      SecurityGroups: [!Ref EfsSecurityGroup]

  # ---------------------------------------------------------------
  # Web tier: ALB / Target group / Auto Scaling group
  # ---------------------------------------------------------------
  LoadBalancer:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      Type: application
      Scheme: internet-facing
      Subnets: [!Ref PublicSubnetA, !Ref PublicSubnetB]
      SecurityGroups: [!Ref AlbSecurityGroup]
      Tags:
        - { Key: Name, Value: !Sub "${ProjectName}-alb" }

  TargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      VpcId: !Ref Vpc
      TargetType: instance
      Protocol: HTTP
      Port: 80
      HealthCheckPath: /
      HealthCheckIntervalSeconds: 15
      HealthyThresholdCount: 2
      UnhealthyThresholdCount: 3
      Matcher:
        HttpCode: "200-399" # WordPress redirects (301/302) before the setup is completed
      TargetGroupAttributes:
        - { Key: deregistration_delay.timeout_seconds, Value: "30" }
      Tags:
        - { Key: Name, Value: !Sub "${ProjectName}-tg" }

  HttpListener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      LoadBalancerArn: !Ref LoadBalancer
      Port: 80
      Protocol: HTTP
      DefaultActions:
        - Type: forward
          TargetGroupArn: !Ref TargetGroup

  WebServerRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal: { Service: ec2.amazonaws.com }
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore # Session Manager (no SSH / bastion)
      Policies:
        - PolicyName: read-db-secret
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action: secretsmanager:GetSecretValue
                Resource: !GetAtt DbInstance.MasterUserSecret.SecretArn
      Tags:
        - { Key: Name, Value: !Sub "${ProjectName}-web-role" }

  WebServerInstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Roles: [!Ref WebServerRole]

  LaunchTemplate:
    Type: AWS::EC2::LaunchTemplate
    Properties:
      LaunchTemplateData:
        ImageId: !Ref LatestAmiId
        InstanceType: !Ref InstanceType
        IamInstanceProfile:
          Arn: !GetAtt WebServerInstanceProfile.Arn
        SecurityGroupIds: [!Ref AppSecurityGroup]
        MetadataOptions:
          HttpTokens: required # IMDSv2 only
          HttpEndpoint: enabled
        TagSpecifications:
          - ResourceType: instance
            Tags:
              - { Key: Name, Value: !Sub "${ProjectName}-web" }
        UserData:
          Fn::Base64: !Sub |
            #!/bin/bash
            set -Eeuxo pipefail

            # ---- 0. cfn-signal (tells CloudFormation the instance is ready) ----
            dnf install -y aws-cfn-bootstrap
            signal() { /opt/aws/bin/cfn-signal -e $1 --stack ${AWS::StackName} --resource AutoScalingGroup --region ${AWS::Region}; }
            trap 'signal 1' ERR

            # ---- 1. Packages ----
            dnf install -y httpd php8.3 php8.3-fpm php8.3-mysqlnd php8.3-gd php8.3-xml php8.3-mbstring php8.3-intl php8.3-opcache amazon-efs-utils jq

            # ---- 2. Mount EFS (shared by all web servers) ----
            mkdir -p /mnt/efs
            echo "${FileSystem}:/ /mnt/efs efs _netdev,noresvport,tls 0 0" >> /etc/fstab
            mount -a -t efs
            mountpoint -q /mnt/efs

            # ---- 3. Get DB credentials from Secrets Manager ----
            set +x   # keep the password out of the log
            SECRET_JSON=$(aws secretsmanager get-secret-value --secret-id ${DbInstance.MasterUserSecret.SecretArn} --region ${AWS::Region} --query SecretString --output text)
            DB_USER=$(echo "$SECRET_JSON" | jq -r .username)
            DB_PASS=$(echo "$SECRET_JSON" | jq -r .password)
            set -x

            # ---- 4. Install WordPress ONCE onto EFS (lock so that only one server does it) ----
            # WP-CLI needs more than PHP's default 128MB to unpack WordPress, so wrap it with a larger limit
            curl -fsSL -o /usr/local/bin/wp-cli.phar https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli.phar
            printf '#!/bin/bash\nexec php -d memory_limit=512M /usr/local/bin/wp-cli.phar "$@"\n' > /usr/local/bin/wp
            chmod +x /usr/local/bin/wp /usr/local/bin/wp-cli.phar

            exec 200>/mnt/efs/.init.lock
            flock -x 200
            if [ ! -f /mnt/efs/html/wp-config.php ]; then
              mkdir -p /mnt/efs/html
              /usr/local/bin/wp core download --path=/mnt/efs/html --locale=ja --force --allow-root
              /usr/local/bin/wp config create --path=/mnt/efs/html --allow-root \
                --dbname=wordpress --dbuser="$DB_USER" --dbpass="$DB_PASS" --dbhost=${DbInstance.Endpoint.Address} \
                --extra-php <<'PHPEOF'
            // Use the host name the browser used (ALB DNS name), over plain HTTP.
            define('WP_HOME', 'http://' . $_SERVER['HTTP_HOST']);
            define('WP_SITEURL', 'http://' . $_SERVER['HTTP_HOST']);
            PHPEOF
              chown -R apache:apache /mnt/efs/html
            fi
            flock -u 200

            # ---- 5. Apache / PHP-FPM ----
            rm -rf /var/www/html
            ln -s /mnt/efs/html /var/www/html
            cat > /etc/httpd/conf.d/wordpress.conf <<'CONFEOF'
            <Directory "/var/www/html">
                AllowOverride All
            </Directory>
            CONFEOF
            systemctl enable --now php-fpm httpd

            signal 0

  AutoScalingGroup:
    Type: AWS::AutoScaling::AutoScalingGroup
    DependsOn: [AppDefaultRouteA, AppDefaultRouteB, MountTargetA, MountTargetB, DbInstance, HttpListener]
    CreationPolicy:
      ResourceSignal:
        Count: !Ref DesiredCapacity
        Timeout: PT30M
    Properties:
      MinSize: !Ref DesiredCapacity
      MaxSize: "4"
      DesiredCapacity: !Ref DesiredCapacity
      VPCZoneIdentifier: [!Ref AppSubnetA, !Ref AppSubnetB]
      LaunchTemplate:
        LaunchTemplateId: !Ref LaunchTemplate
        Version: !GetAtt LaunchTemplate.LatestVersionNumber
      TargetGroupARNs: [!Ref TargetGroup]
      HealthCheckType: ELB
      HealthCheckGracePeriod: 600
      Tags:
        - { Key: Name, Value: !Sub "${ProjectName}-web", PropagateAtLaunch: true }

Outputs:
  SiteUrl:
    Description: WordPress site URL (ALB DNS name, HTTP)
    Value: !Sub "http://${LoadBalancer.DNSName}/"
  AlbDnsName:
    Description: ALB DNS name
    Value: !GetAtt LoadBalancer.DNSName
  DbEndpoint:
    Description: RDS endpoint (private)
    Value: !GetAtt DbInstance.Endpoint.Address
  DbSecretArn:
    Description: Secrets Manager secret holding the DB master credentials
    Value: !GetAtt DbInstance.MasterUserSecret.SecretArn
  FileSystemId:
    Description: EFS file system ID
    Value: !Ref FileSystem