PHPアプリケーションを想定したECS FargateのEFSマウントやRDS接続を検証してみた

<?php

declare(strict_types=1);

/**
 * 必須環境変数を取得する。
 */
function requiredEnv(string $name): string
{
    $value = getenv($name);

    if ($value === false || trim($value) === '') {
        throw new RuntimeException(
            sprintf(
                'Required environment variable is missing: %s',
                $name,
            ),
        );
    }

    return $value;
}

/**
 * Boolean形式の環境変数を取得する。
 */
function booleanEnv(string $name, bool $default): bool
{
    $value = getenv($name);

    if ($value === false || trim($value) === '') {
        return $default;
    }

    $parsed = filter_var(
        $value,
        FILTER_VALIDATE_BOOLEAN,
        FILTER_NULL_ON_FAILURE,
    );

    if ($parsed === null) {
        throw new RuntimeException(
            sprintf(
                'Environment variable %s must be a boolean value: %s',
                $name,
                $value,
            ),
        );
    }

    return $parsed;
}

/**
 * EFSの読み書きを確認する。
 */
function verifyEfs(): void
{
    $mountPath = getenv('EFS_MOUNT_PATH') ?: '/mnt/efs';
    $mountPath = rtrim($mountPath, '/');

    if ($mountPath === '') {
        throw new RuntimeException(
            'EFS_MOUNT_PATH must not be empty',
        );
    }

    if (!is_dir($mountPath)) {
        throw new RuntimeException(
            sprintf(
                'EFS mount path does not exist: %s',
                $mountPath,
            ),
        );
    }

    if (!is_readable($mountPath)) {
        throw new RuntimeException(
            sprintf(
                'EFS mount path is not readable: %s',
                $mountPath,
            ),
        );
    }

    if (!is_writable($mountPath)) {
        throw new RuntimeException(
            sprintf(
                'EFS mount path is not writable: %s',
                $mountPath,
            ),
        );
    }

    $verificationFile = $mountPath
        . '/ECS on Fargate-fargate-efs-verification.log';

    $marker = bin2hex(random_bytes(16));

    $record = sprintf(
        "%s\thost=%s\tmarker=%s\n",
        gmdate(DATE_ATOM),
        gethostname() ?: 'unknown',
        $marker,
    );

    $handle = fopen($verificationFile, 'c+b');

    if ($handle === false) {
        throw new RuntimeException(
            sprintf(
                'Failed to open EFS verification file: %s',
                $verificationFile,
            ),
        );
    }

    $locked = false;

    try {
        $locked = flock($handle, LOCK_EX);

        if (!$locked) {
            throw new RuntimeException(
                sprintf(
                    'Failed to lock EFS verification file: %s',
                    $verificationFile,
                ),
            );
        }

        if (fseek($handle, 0, SEEK_END) !== 0) {
            throw new RuntimeException(
                sprintf(
                    'Failed to seek EFS verification file: %s',
                    $verificationFile,
                ),
            );
        }

        $writtenBytes = fwrite($handle, $record);

        if (
            $writtenBytes === false
            || $writtenBytes !== strlen($record)
        ) {
            throw new RuntimeException(
                sprintf(
                    'Failed to write EFS verification file: %s',
                    $verificationFile,
                ),
            );
        }

        if (!fflush($handle)) {
            throw new RuntimeException(
                sprintf(
                    'Failed to flush EFS verification file: %s',
                    $verificationFile,
                ),
            );
        }

        if (fseek($handle, 0, SEEK_SET) !== 0) {
            throw new RuntimeException(
                sprintf(
                    'Failed to rewind EFS verification file: %s',
                    $verificationFile,
                ),
            );
        }

        $contents = stream_get_contents($handle);

        if (
            $contents === false
            || !str_contains($contents, $marker)
        ) {
            throw new RuntimeException(
                sprintf(
                    'Failed to read the written marker from EFS: %s',
                    $verificationFile,
                ),
            );
        }

        $recordCount = count(
            array_filter(
                explode("\n", trim($contents)),
                static fn (string $line): bool => $line !== '',
            ),
        );
    } finally {
        if ($locked) {
            flock($handle, LOCK_UN);
        }

        fclose($handle);
    }

    printf(
        "[OK] EFS read/write succeeded: path=%s records=%d marker=%s\n",
        $verificationFile,
        $recordCount,
        $marker,
    );
}

/**
 * RDS MySQL / Aurora MySQLへのTLS接続を確認する。
 */
function verifyRds(): void
{
    $driver = getenv('DB_CONNECTION') ?: 'mysql';

    if ($driver !== 'mysql') {
        throw new RuntimeException(
            sprintf(
                'This verification script supports mysql only: %s',
                $driver,
            ),
        );
    }

    if (!extension_loaded('pdo_mysql')) {
        throw new RuntimeException(
            'The pdo_mysql PHP extension is not loaded',
        );
    }

    $host = requiredEnv('DB_HOST');
    $port = getenv('DB_PORT') ?: '3306';
    $database = requiredEnv('DB_DATABASE');
    $username = requiredEnv('DB_USERNAME');
    $password = requiredEnv('DB_PASSWORD');

    if (!ctype_digit($port)) {
        throw new RuntimeException(
            sprintf(
                'DB_PORT must be numeric: %s',
                $port,
            ),
        );
    }

    $dsn = sprintf(
        'mysql:host=%s;port=%s;dbname=%s;charset=utf8mb4',
        $host,
        $port,
        $database,
    );

    $options = [
        PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
        PDO::ATTR_TIMEOUT => 5,
        PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
        PDO::ATTR_EMULATE_PREPARES => false,
    ];

    $sslCa = requiredEnv('MYSQL_ATTR_SSL_CA');

    if (!is_file($sslCa) || !is_readable($sslCa)) {
        throw new RuntimeException(
            sprintf(
                'RDS CA bundle is not readable: %s',
                $sslCa,
            ),
        );
    }

    $options[PDO::MYSQL_ATTR_SSL_CA] = $sslCa;

    $verifyServerCertificate = booleanEnv(
        'DB_SSL_VERIFY_SERVER_CERT',
        true,
    );

    if (defined('PDO::MYSQL_ATTR_SSL_VERIFY_SERVER_CERT')) {
        $option = constant(
            'PDO::MYSQL_ATTR_SSL_VERIFY_SERVER_CERT',
        );

        $options[$option] = $verifyServerCertificate;
    } elseif ($verifyServerCertificate) {
        throw new RuntimeException(
            'PDO::MYSQL_ATTR_SSL_VERIFY_SERVER_CERT is not available',
        );
    }

    $pdo = new PDO(
        $dsn,
        $username,
        $password,
        $options,
    );

    $connectionResult = $pdo
        ->query(
            <<<'SQL'
SELECT
    1 AS connection_test,
    DATABASE() AS database_name,
    CURRENT_USER() AS current_user
SQL,
        )
        ->fetch();

    if ((int) ($connectionResult['connection_test'] ?? 0) !== 1) {
        throw new RuntimeException(
            'Unexpected RDS SELECT 1 result',
        );
    }

    $sslStatus = $pdo
        ->query("SHOW SESSION STATUS LIKE 'Ssl_cipher'")
        ->fetch();

    $sslCipher = '';

    if (is_array($sslStatus)) {
        $sslCipher = (string) (
            $sslStatus['Value']
            ?? $sslStatus['VALUE']
            ?? ''
        );
    }

    if ($sslCipher === '') {
        throw new RuntimeException(
            'RDS connection succeeded, but TLS is not enabled',
        );
    }

    printf(
        "[OK] RDS connection succeeded: host=%s database=%s user=%s server=%s tlsCipher=%s\n",
        $host,
        (string) ($connectionResult['database_name'] ?? ''),
        (string) ($connectionResult['current_user'] ?? ''),
        (string) $pdo->getAttribute(PDO::ATTR_SERVER_VERSION),
        $sslCipher,
    );
}

try {
    verifyEfs();
    verifyRds();

    fwrite(
        STDOUT,
        "[OK] All infrastructure checks succeeded.\n",
    );

    exit(0);
} catch (Throwable $exception) {
    fwrite(
        STDERR,
        sprintf(
            "[NG] Infrastructure verification failed: %s: %s\n",
            $exception::class,
            $exception->getMessage(),
        ),
    );

    exit(1);
}

ARG PHP_IMAGE=php:8.5-fpm-alpine
ARG NGINX_IMAGE=nginx:alpine

## PHP-FPM

FROM ${PHP_IMAGE} AS php-fpm

RUN set -eux; \
    apk add --no-cache \
        ca-certificates \
        curl \
        su-exec; \
    \

    docker-php-ext-install -j"$(nproc)" pdo_mysql; \
    \
    mv "$PHP_INI_DIR/php.ini-production" "$PHP_INI_DIR/php.ini"; \
    \
    # RDS TLS接続検証用のAWS公式CA証明書を取得する。
    curl \
        --fail \
        --silent \
        --show-error \
        --location \
        --retry 5 \
        --retry-delay 2 \
        --proto '=https' \
        --tlsv1.2 \
        --output /etc/ssl/certs/rds-global-bundle.pem \
        https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem; \
    \
    test -s /etc/ssl/certs/rds-global-bundle.pem; \
    \
    # 必要なPHP拡張をビルド時に確認する。
    php -r ' \
        $requiredExtensions = ["PDO", "pdo_mysql", "Zend OPcache"]; \
        foreach ($requiredExtensions as $extension) { \
            if (!extension_loaded($extension)) { \
                fwrite(STDERR, "Missing PHP extension: {$extension}\n"); \
                exit(1); \
            } \
        } \
    '

COPY docker/php/zz-app.ini \
    "$PHP_INI_DIR/conf.d/zz-app.ini"

COPY docker/php/zz-fpm.conf \
    /usr/local/etc/php-fpm.d/zz-fpm.conf

WORKDIR /var/www/html

COPY docker/public /var/www/html/public

COPY --chmod=0644 docker/php/verify-infra.php \
    /usr/local/libexec/verify-infra.php

COPY --chmod=0755 docker/php/verify-infra \
    /usr/local/bin/verify-infra

RUN set -eux; \
    \
    # ECS on Fargateタスク定義のEfsMountContainerPathと一致させる。
    # ECS on Fargate起動時、このディレクトリへEFSがマウントされる。
    # この処理はマウントポイントを事前作成するためのものです。EFSマウント後の権限は、EFSアクセスポイントに設定したPOSIXユーザーおよびルートディレクトリの所有者・パーミッションに依存します。
    mkdir -p /mnt/efs; \
    chown www-data:www-data /mnt/efs; \
    chmod 0750 /mnt/efs; \
    \
    # PHPアプリケーション自体はroot所有・読み取り専用にする。
    chown -R root:root /var/www/html; \
    find /var/www/html -type d -exec chmod 0755 {} +; \
    find /var/www/html -type f -exec chmod 0644 {} +; \
    \
    # PHP構文チェック。
    php -l /var/www/html/public/index.php; \
    php -l /usr/local/libexec/verify-infra.php

# 環境固有値および認証情報はECS on Fargateタスク定義から注入する。

ENV APP_ENV=verification \
    APP_DEBUG=false \
    DB_CONNECTION=mysql \
    DB_PORT=3306 \
    MYSQL_ATTR_SSL_CA=/etc/ssl/certs/rds-global-bundle.pem \
    DB_SSL_VERIFY_SERVER_CERT=true \
    EFS_MOUNT_PATH=/mnt/efs

EXPOSE 9000

CMD ["php-fpm", "-F"]

## Nginx

FROM ${NGINX_IMAGE} AS nginx

# ECS on Fargateタスク定義のコンテナHealthCheckでcurlを使用する。
RUN apk add --no-cache curl

COPY docker/nginx/default.conf.template \
    /etc/nginx/templates/default.conf.template

COPY docker/public /var/www/html/public

ENV PHP_FPM_HOST=127.0.0.1 \
    PHP_FPM_PORT=9000 \
    NGINX_ENVSUBST_FILTER="^(PHP_FPM_HOST|PHP_FPM_PORT)$"

EXPOSE 80

    mkdir -p /mnt/efs; \
    chown www-data:www-data /mnt/efs; \
    chmod 0750 /mnt/efs; \
    \

〜略〜
  TaskDefinition:
    Type: AWS::ECS on Fargate::TaskDefinition
    Properties:
〜略〜
      Volumes:
        - Name: efs-data
          EFSVolumeConfiguration:
            FilesystemId: !Ref EfsFileSystemId
            RootDirectory: "/"
            TransitEncryption: ENABLED
            AuthorizationConfig:
              AccessPointId: !Ref EfsAccessPointId
              IAM: ENABLED
      ContainerDefinitions:
        - Name: php-fpm
          Image: !Ref PhpContainerImage
          Essential: true
          PortMappings:
            - ContainerPort: !Ref PhpFpmPort
              Protocol: tcp
          Environment:
   〜略〜
            - Name: EFS_MOUNT_PATH
              Value: !Ref EfsMountContainerPath
          Secrets:
            - Name: APP_ENV
              ValueFrom: !Sub "${AppConfigSecretArn}:app_environment::"
            - Name: LOG_LEVEL
              ValueFrom: !Sub "${AppConfigSecretArn}:log_level::"
            - Name: API_TIMEOUT_SEC
              ValueFrom: !Sub "${AppConfigSecretArn}:api_timeout_sec::"
            - Name: DB_CONNECTION
              ValueFrom: !Sub "${AppConfigSecretArn}:db_engine::"
            - Name: DB_HOST
              ValueFrom: !Sub "${AppConfigSecretArn}:db_endpoint::"
            - Name: DB_PORT
              ValueFrom: !Sub "${AppConfigSecretArn}:db_port::"
            - Name: DB_DATABASE
              ValueFrom: !Sub "${AppConfigSecretArn}:db_name::"
            - Name: DB_USERNAME
              ValueFrom: !Sub "${DbSecretArn}:username::"
            - Name: DB_PASSWORD
              ValueFrom: !Sub "${DbSecretArn}:password::"
          MountPoints:
            - SourceVolume: efs-data
              ContainerPath: !Ref EfsMountContainerPath
              ReadOnly: false
〜略〜

aws ECS on Fargate execute-command \
   --cluster <ECS on Fargateクラスター名> \
   --task <タスクID> \
   --container <コンテナ名> \
   --interactive \
   --command "/bin/sh"

su-exec www-data php /usr/local/libexec/verify-infra.php

ls /mnt/efs
cat /mnt/efs/<書き込んだファイル>

su-exec www-data php /usr/local/libexec/verify-infra.php

php -r '
$pdo = new PDO(
    sprintf("mysql:host=%s;port=%s;dbname=%s;charset=utf8mb4", getenv("DB_HOST"), getenv("DB_PORT"), getenv("DB_DATABASE")),
    getenv("DB_USERNAME"),
    getenv("DB_PASSWORD"),
);
$stmt = $pdo->query("SELECT * FROM blog_verification_test");
foreach ($stmt->fetchAll(PDO::FETCH_ASSOC) as $row) {
    print_r($row);
}
'

php -r '
$pdo = new PDO(
    sprintf("mysql:host=%s;port=%s;dbname=%s;charset=utf8mb4", getenv("DB_HOST"), getenv("DB_PORT"), getenv("DB_DATABASE")),
    getenv("DB_USERNAME"),
    getenv("DB_PASSWORD"),
);
$stmt = $pdo->prepare("INSERT INTO blog_verification_test (message) VALUES (?)");
for ($i = 1; $i <= 5; $i++) {
    $stmt->execute([sprintf("test record #%d from app container", $i)]);
}
echo "Inserted 5 rows." . PHP_EOL;
'

CannotPullContainerError:
~略~
There is a connection issue between the task and the registry. Check your task network configuration. : failed to copy: httpReadSeeker: failed open: failed to do request:
~略~