(CloudFormtion)シンプル構成なWordPress構築してみた

丸屋正志

2022.10.23

こんばんは､丸屋 正志(Maruya Masashi)です｡

1. はじめに

｢毎回､コンソールやCLIで環境作成していくのって大変だよね〜｣って事で､CloudFormtionテンプレートを作成いたしました｡
今回の内容としては､｢シングルEC2 / ALB / RDS / VPC(周辺諸々含む)を用いたWordPress環境｣になります｡

CloudFormtionの説明や使い方については､下記Blogが参考になるかなと思います｡

2. 構成図

3. やってみる

3.1. 事前準備

  • EC2へSSH接続するためのキーペアを事前に用意
  • SSH接続の際に接続元を事前に絞る場合は､191行目のIPを変更

3.2. テンプレートの作成

以下のコードは､今回のシンプル構成なWordPressのテンプレートとなります｡

ご利用のメモ帳などに貼り付けてから､ご利用ください｡

AWSTemplateFormatVersion: '2010-09-09'

Description:
  Simple WordPress Blog Site

Parameters:
  DatabaseMasterName:
    Description: Database Master User Namee
    Type : String
    Default: wordpress
  DatabaseMasterPassword:
    Description: Database Master User Password
    Type : String
  DatabaseName:
    Description: Database Name
    Type : String
    Default: wordpress
  EC2AMIId:
    Description: AMI ID
    # Type : String
    # Default: ami-078296f82eb463377
    Type: AWS::SSM::Parameter::Value
    Default: "/aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2"
  KeyName:
    Description: The EC2 Key Pair to allow SSH access to the instance
    Type: "AWS::EC2::KeyPair::KeyName"

Resources:
  # ------------------------------------------------------------#
  #  VPC
  # ------------------------------------------------------------#
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.0.0.0/16
      InstanceTenancy: default
      EnableDnsSupport: true
      EnableDnsHostnames: true
      Tags:
      - Key: Name
        Value: WP-VPC

  # ------------------------------------------------------------#
  #  Internet Gateway
  # ------------------------------------------------------------#
  InternetGateway:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
      - Key: Name
        Value: WP-VPC-IGW
  AttachGateway:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref VPC
      InternetGatewayId: !Ref InternetGateway

  # ------------------------------------------------------------#
  #  Route Table
  # ------------------------------------------------------------#
  RouteTable:
    Type: AWS::EC2::RouteTable
    DependsOn: AttachGateway
    Properties:
      VpcId: !Ref VPC
      Tags:
      - Key: Name
        Value: WP-VPC-RTB
  Route:
    Type: AWS::EC2::Route
    DependsOn: AttachGateway
    Properties:
      RouteTableId: !Ref RouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway

  # ------------------------------------------------------------#
  #  Public Sunbet A
  # ------------------------------------------------------------#
  PublicSubnetA:
    Type: AWS::EC2::Subnet
    DependsOn: AttachGateway
    Properties:
      AvailabilityZone: "ap-northeast-1a"
      CidrBlock: 10.0.1.0/24
      MapPublicIpOnLaunch: 'true'
      VpcId: !Ref VPC
      Tags:
      - Key: Name
        Value: WP-VPC-PublicSubnet-A
  PublicRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnetA
      RouteTableId: !Ref RouteTable

  # ------------------------------------------------------------#
  #  Private Sunbet A
  # ------------------------------------------------------------#
  PrivateSubnetA:
    Type: AWS::EC2::Subnet
    Properties:
      AvailabilityZone: "ap-northeast-1a"
      CidrBlock: 10.0.2.0/24
      MapPublicIpOnLaunch: 'false'
      VpcId: !Ref VPC
      Tags:
      - Key: Name
        Value: WP-VPC-PrivateSubnet-A

  # ------------------------------------------------------------#
  #  Public Sunbet C
  # ------------------------------------------------------------#
  PublicSubnetC:
    Type: AWS::EC2::Subnet
    DependsOn: AttachGateway
    Properties:
      AvailabilityZone: "ap-northeast-1c"
      CidrBlock: 10.0.3.0/24
      MapPublicIpOnLaunch: 'true'
      VpcId: !Ref VPC
      Tags:
      - Key: Name
        Value: WP-VPC-PublicSubnet-C

  # ------------------------------------------------------------#
  #  Private Sunbet C
  # ------------------------------------------------------------#
  PrivateSubnetC:
    Type: AWS::EC2::Subnet
    Properties:
      AvailabilityZone: "ap-northeast-1c"
      CidrBlock: 10.0.4.0/24
      MapPublicIpOnLaunch: 'false'
      VpcId: !Ref VPC
      Tags:
      - Key: Name
        Value: WP-VPC-PrivateSubnet-C

  # ------------------------------------------------------------#
  #  ALB Security Group
  # ------------------------------------------------------------#
  ALBSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: WP-ALB-SG
      GroupDescription: Allow HTTP access from internet
      VpcId: !Ref VPC
      SecurityGroupIngress:
        # http
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: "0.0.0.0/0"
      Tags:
        - Key: Name
          Value: WP-ALB-SG

  # ------------------------------------------------------------#
  #  ALB
  # ------------------------------------------------------------#
  ApplicationLoadBalancer:
    Type : AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      Name: WP-ALB
      Scheme: "internet-facing"
      SecurityGroups:
        - !Ref ALBSecurityGroup
      # At least two subnet is needed
      Subnets:
        - !Ref PublicSubnetA
        - !Ref PublicSubnetC
      Tags:
        - Key: Name
          Value: WP-ALB

  # ------------------------------------------------------------#
  #  EC2 Security Group
  # ------------------------------------------------------------#
  EC2SecurityGroup:
    Type: AWS::EC2::SecurityGroup
    DependsOn: ALBSecurityGroup
    Properties:
      GroupName: WP-EC2-SG
      GroupDescription: Allow SSH from Internet
      VpcId: !Ref VPC
      SecurityGroupIngress:
        # SSH
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          CidrIp: 0.0.0.0/0
        # HTTP
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          SourceSecurityGroupId: !Ref ALBSecurityGroup
      Tags:
        - Key: Name
          Value: WP-EC2-SG

  # ------------------------------------------------------------#
  #  EC2
  # ------------------------------------------------------------#
  EC2Instance:
    Type: AWS::EC2::Instance
    Properties:
      AvailabilityZone: "ap-northeast-1a"
      BlockDeviceMappings:
        - DeviceName: /dev/xvda
          Ebs:
            VolumeSize: 8
            VolumeType: gp2
      ImageId: !Ref EC2AMIId
      InstanceInitiatedShutdownBehavior: 'stop'
      InstanceType: t2.micro
      KeyName: !Ref KeyName
      SecurityGroupIds:
        - !Ref EC2SecurityGroup
      SubnetId: !Ref PublicSubnetA
      Tenancy: default
      Tags:
        - Key: Name
          Value: WP-EC2-Instance
      UserData:
        Fn::Base64: |
          #!/bin/bash
          echo "===========yum -y install httpd==========="
          yum -y update
          echo "===========amazon-linux-extras install php7.2 -y==========="
          amazon-linux-extras install php7.2 -y
          echo "===========yum -y install mysql httpd php-mbstring php-xml gd php-gd==========="
          yum -y install mysql httpd php-mbstring php-xml gd php-gd
          echo "===========systemctl enable/start httpd.service ==========="
          systemctl enable httpd.service
          systemctl start httpd.service
          echo "=========== http://ja.wordpress.org/latest-ja.tar.gz ~/ ==========="
          wget http://ja.wordpress.org/latest-ja.tar.gz
          echo "=========== tar zxvf ~/latest-ja.tar.gz ==========="
          tar zxvf latest-ja.tar.gz
          echo "=========== cp -r wordpress/* /var/www/html/ ==========="
          cp -r wordpress/* /var/www/html/
          chown apache:apache -R /var/www/html
          cd /var/www/html/
          mkdir healths
          cd healths
          touch wp-check

  # ------------------------------------------------------------#
  #  Target Group
  # ------------------------------------------------------------#
  ALBTargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      # Health check enabled must be true for target groups with target type 'instance' 
      HealthCheckPath: /healths/wp-check
      HealthCheckEnabled: True
      Name: WP-ALB-TG
      Port: 80
      Protocol: HTTP
      Tags:
        - Key: Name
          Value: WP-ALB-TG
      Targets:
        # If the target type is instance, you cannot override the Availability Zone
        - Id: !Ref EC2Instance
          Port: 80
      VpcId: !Ref VPC

  # ------------------------------------------------------------#
  #  ALB Listner
  # ------------------------------------------------------------#
  ALBListener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      DefaultActions:
        - TargetGroupArn: !Ref ALBTargetGroup
          Type: forward
      LoadBalancerArn: !Ref ApplicationLoadBalancer
      Port: 80
      Protocol: HTTP

  # ------------------------------------------------------------#
  #  Database Subnet Group
  # ------------------------------------------------------------#
  RDSDBSubnetGroup:
    Type: AWS::RDS::DBSubnetGroup
    Properties:
      DBSubnetGroupDescription: WP-RDS-SubnetGroup
      DBSubnetGroupName: WP-RDS-SubnetGroup
      SubnetIds:
        - !Ref PrivateSubnetA
        - !Ref PrivateSubnetC
      Tags:
        - Key: Name
          Value: WP-RDS-SubnetGroup

  # ------------------------------------------------------------#
  #  RDS Security Group
  # ------------------------------------------------------------#
  RDSSG:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: WP-RDS-SG
      GroupDescription: Allow Request from WebServer
      VpcId: !Ref VPC
      SecurityGroupIngress:
        # http
        - IpProtocol: tcp
          FromPort: 3306
          ToPort: 3306
          SourceSecurityGroupId: !Ref EC2SecurityGroup
      Tags:
        - Key: Name
          Value: WP-RDS-SG

  # ------------------------------------------------------------#
  #  RDS
  # ------------------------------------------------------------#
  RDSDatabase:
    Type: AWS::RDS::DBInstance
    Properties:
      AllocatedStorage: 20
      AllowMajorVersionUpgrade: false
      AutoMinorVersionUpgrade: false
      AvailabilityZone: ap-northeast-1a
      BackupRetentionPeriod: 0
      DBInstanceClass: db.t3.micro
      DBInstanceIdentifier: WP-RDS-Database
      DBName: !Ref DatabaseName
      DBSubnetGroupName: !Ref RDSDBSubnetGroup
      DeleteAutomatedBackups: false
      DeletionProtection: false
      Engine: mysql
      EngineVersion: 8.0.30
      MasterUsername: !Ref DatabaseMasterName
      MasterUserPassword: !Ref DatabaseMasterPassword
      MaxAllocatedStorage: 1000
      MultiAZ: false
      PubliclyAccessible: false
      StorageEncrypted: false
      StorageType: gp2
      Tags:
        - Key: Name
          Value: WP-RDS-Database
      VPCSecurityGroups:
        - !Ref RDSSG

3.3. スタックの作成

【AWSサービス】→【CloudFormtion】→【スタック】→【新しいリソースを使用 (標準)】をクリックします｡

【テンプレートの準備完了】→【テンプレートファイルのアップロード】→【ファイルの選択】ここで用意したファイルを選択→【次へ】をクリックします｡

各種項目に対して任意内容を入力します｡

  • 『スタックの名前』 : [任意の名前]
    • (例 : simple-wp)
  • 『DatabaseMasterName』 : [任意の名前]
    • (例 : wordpress)
  • 『DatabaseMasterPassword』 : [任意の名前]
  • 『DatabaseName』 : [任意の名前]
    • (例 : wordpress)
  • 『EC2AMIId』 : [任意のEC2 AMI IDを入力]
  • 『KeyName』 : 【事前に作成したキーペアを選択】

『ステップ3』では何も変更せずに､『ステップ4』については､内容を確認し【スタックの作成】をクリックしリソースを作成します｡

リソースを作成している最中は､下記のような画面が表示されますので､作成完了まで今しばらくお待ちください｡

リソース作成が完了すると､下記のような画面が表示されます｡

4. 動作確認

ここでは､WordPressサイトにアクセスが出来るかを確認します｡

  • 【AWSサービス】→【EC2】→【ロードバランサー】→【WP-ALB】というリソースの『DNS 名』をコピーします｡

  • ブラウザに貼り付けて､下記のような画面が表示されていれば接続完了です(接続に時間がかかります｡)
  • そのままWordPressを利用される場合には､画面の指示に従ってインストールを実施

参考資料

AWS

関連記事

EgressOnlyInternetGatewayを通してIPv6アドレスのみの環境でSSMを使用してEC2を操作したかったけどまだ駄目でした

たぬき

2023.10.01

エスケープ処理されたJSON文字列を整形して必要な情報を抽出してみた

inomaso

2023.09.30

【登壇レポート】 『AWS Control TowerでセキュアでスケーラブルなAWS環境を作るとき 困るポイントn選』 JAWS FESTA 2023 in Kyusyu 直前スペシャル!! #jawsfesta2023

芦沢 広昭

2023.09.30

EC2におけるフォレンジックの手順書SANS「Digital Forensic Analysis of Amazon Linux EC2 Instances」を読んでみた

べこみん

2023.09.30