EC2 + RDS 環境へインストールした WordPress 上で AWS Secrets Manager Agent 経由で DB 接続情報のシークレットを取得してみた

<?php
/**
 * The base configuration for WordPress
 *
 * The wp-config.php creation script uses this file during the installation.
 * You don't have to use the website, you can copy this file to "wp-config.php"
 * and fill in the values.
 *
 * This file contains the following configurations:
 *
 * * Database settings
 * * Secret keys
 * * Database table prefix
 * * ABSPATH
 *
 * @link https://wordpress.org/documentation/article/editing-wp-config-php/
 *
 * @package WordPress
 */

// ** Database settings - You can get this info from your web host ** //
/** The name of the database for WordPress */
define( 'DB_NAME', 'wordpress' );

/** Database username */
define( 'DB_USER', 'hoge' );

/** Database password */
define( 'DB_PASSWORD', '6XUK-9}fxO%E(e)f' );

/** Database hostname */
define( 'DB_HOST', 'hoge-rds.cpnu9ipu74g4.ap-northeast-1.rds.amazonaws.com' );

/** Database charset to use in creating database tables. */
define( 'DB_CHARSET', 'utf8mb4' );

/** The database collate type. Don't change this if in doubt. */
define( 'DB_COLLATE', '' );

:

[root@ip-10-0-0-86 html]# curl -H "X-Aws-Parameters-Secrets-Token: $(</var/run/awssmatoken)" 'http://localhost:2773/secretsmanager/get?secretId=hoge-secret' | jq
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current                                 Dload  Upload   Total   Spent    Left  Speed100   438  100   438    0     0   389k      0 --:--:-- --:--:-- --:--:--  427k{
  "ARN": "arn:aws:secretsmanager:ap-northeast-1:123456789012:secret:hoge-secret-IKn9tn",
  "Name": "hoge-secret",
  "VersionId": "624cbc68-d1fb-437b-95b6-fb642f675db5",
  "SecretString": "{\"password\":\"6XUK-9}fxO%E(e)f\",\"engine\":\"mariadb\",\"port\":3306,\"dbInstanceIdentifier\":\"hoge-rds\",\"host\":\"hoge-rds.cpnu9ipu74g4.ap-northeast-1.rds.amazonaws.com\",\"username\":\"hoge\"}",
  "VersionStages": [
    "AWSCURRENT"
  ],  "CreatedDate": "1720908102.569"
}

<?php
/**
 * The base configuration for WordPress
 *
 * The wp-config.php creation script uses this file during the installation.
 * You don't have to use the website, you can copy this file to "wp-config.php"
 * and fill in the values.
 *
 * This file contains the following configurations:
 *
 * * Database settings
 * * Secret keys
 * * Database table prefix
 * * ABSPATH
 *
 * @link https://wordpress.org/documentation/article/editing-wp-config-php/
 *
 * @package WordPress
 */

// ** Database settings - You can get this info from your web host ** //
$token = file_get_contents('/var/run/awssmatoken');
$response = file_get_contents('http://localhost:2773/secretsmanager/get?secretId=hoge-secret', false, stream_context_create([
    'http' => [
        'header' => "X-Aws-Parameters-Secrets-Token: $token"
    ]
]));
$secrets = json_decode($response, true);
$dbSettings = json_decode($secrets['SecretString'], true);
/** The name of the database for WordPress */
define( 'DB_NAME', 'wordpress' );

/** Database username */
//define( 'DB_USER', 'hoge' );
define( 'DB_USER', $dbSettings['username'] );

/** Database password */
//define( 'DB_PASSWORD', '6XUK-9}fxO%E(e)f' );
define( 'DB_PASSWORD', $dbSettings['password'] );

/** Database hostname */
//define( 'DB_HOST', 'hoge-rds.cpnu9ipu74g4.ap-northeast-1.rds.amazonaws.com' );
define( 'DB_HOST', $dbSettings['host'] );

/** Database charset to use in creating database tables. */
define( 'DB_CHARSET', 'utf8mb4' );

/** The database collate type. Don't change this if in doubt. */
define( 'DB_COLLATE', '' );

: