{"id":1943,"date":"2021-12-11T16:00:55","date_gmt":"2021-12-11T16:00:55","guid":{"rendered":"https:\/\/benfreke.org\/?p=1943"},"modified":"2021-12-12T11:03:23","modified_gmt":"2021-12-12T11:03:23","slug":"hosting-wordpress-on-aws","status":"publish","type":"post","link":"https:\/\/wordpress.benfreke.org\/2021\/12\/11\/hosting-wordpress-on-aws\/","title":{"rendered":"Hosting WordPress on AWS"},"content":{"rendered":"\n<p>This site runs on AWS, using CloudFront, ECS, RDS and EFS (among other services). Here&#8217;s how I built it.<\/p>\n\n\n\n<!--more-->\n\n\n\n<p>This site is on WordPress &#8211; as much as this isn&#8217;t ideal anymore, until I come to completely rebuild it and all the other sites I run, it&#8217;ll have to do. As such, I wanted to switch it to a highly available setup in AWS (previously it was running on a single server hosting both Apache and MySQL with no automated backups <em>[shudder]<\/em>).<\/p>\n\n\n\n<p>This is all deployed via Terraform and GitHub Actions.<\/p>\n\n\n\n<p>The configuration is stored in <a href=\"https:\/\/github.com\/ben-freke\/wordpress-on-aws\">GitHub<\/a>.<\/p>\n\n\n\n<h2>Architecture<\/h2>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" width=\"1792\" height=\"1063\" src=\"https:\/\/benfreke.org\/wp-content\/uploads\/2021\/12\/Web-App-Reference-Architecture-1.svg\" alt=\"\" class=\"wp-image-1946\"\/><\/figure>\n\n\n\n<p>Here were my requirements:<\/p>\n\n\n\n<ul><li>Cheap (ish)<\/li><li>Secure<\/li><li>Highly available (ish)<\/li><li>Automated<\/li><li>Running WordPress Multisite (Network)<\/li><\/ul>\n\n\n\n<p>I chose to go with the <a href=\"https:\/\/hub.docker.com\/_\/wordpress\">WordPress Docker container<\/a> running on ECS, using EFS for file storage and RDS for the database. I chose to use Fargate for ECS so there&#8217;s no need to manage the hosts. All of this sits behind an Application Load Balancer, which is fronted by a CloudFront Distribution and a WAF is attached to that. DNS is managed by Route53. <\/p>\n\n\n\n<h2>ECS<\/h2>\n\n\n\n<p>Running ECS gave several advantages. Firstly, it&#8217;s always best to use the mantra of &#8220;<a href=\"http:\/\/cloudscaling.com\/blog\/cloud-computing\/the-history-of-pets-vs-cattle\/\">cattle not pets<\/a>&#8221; and ECS is designed to run ephemeral tasks. The community-maintained WordPress container meant I didn&#8217;t have to bother too much with building and maintaining my own WordPress instance or container, and finally (big win) the use of Fargate to alleviate the to maintain my own container instance(s). <\/p>\n\n\n\n<p>To keep it cheap, I only run one task. I could run two but I&#8217;m honestly not <em>that <\/em>fussed if my website goes down for a bit when the alternative is a higher cost of maintaining multiple tasks. The Application Load Balancer performs a <a href=\"https:\/\/github.com\/ben-freke\/wordpress-on-aws\/blob\/master\/modules\/load_balancer\/listener_rule\/main.tf#L7\">HTTP Health Check<\/a>, looking for a HTTP 200 code from WordPress. ECS will replace the task if that health-check fails.<\/p>\n\n\n\n<h2>CloudFront<\/h2>\n\n\n\n<p>CloudFront is used to cache content. There&#8217;s a different CloudFront distribution for each website, with the origin being the load balancer. There&#8217;s a random string, generated by Terraform, that <a href=\"https:\/\/github.com\/ben-freke\/wordpress-on-aws\/blob\/master\/modules\/wordpress_site\/cloudfront\/main.tf#L31\">CloudFront passes<\/a> as a header and the <a href=\"https:\/\/github.com\/ben-freke\/wordpress-on-aws\/blob\/master\/modules\/load_balancer\/listener_rule\/main.tf#L24\">Load Balancer checks<\/a> to ensure it has the correct value. This is a fairly crude way to ensure that only requests originating from CloudFront are permitted to reach the back-end servers. Terraform also uses the published IP ranges for CloudFront to create Security Group Rules.<\/p>\n\n\n\n<p>There are different CloudFront behaviours set up for special WordPress paths. I used <a href=\"https:\/\/jeffreyeverhart.com\/2018\/12\/07\/setup-aws-cloudfront-for-wordpress-scaling-this-blog\/\">this blog<\/a> as guidance on setting up the CloudFront behaviours for various WordPress functionalities. <\/p>\n\n\n\n<h2>Pipelines<\/h2>\n\n\n\n<p>To deploy, I use GitHub Actions. This is the simplest, easiest way to deploy configurations directly from GitHub. <\/p>\n\n\n\n<p>There are two GitHub action:<\/p>\n\n\n\n<ol><li><strong><a href=\"https:\/\/github.com\/ben-freke\/wordpress-on-aws\/blob\/master\/.github\/workflows\/terraform_plan.yml\">On Pull Request<\/a><\/strong> &#8211; when a new PR is created into <em>main<\/em>, an action is run to perform Terraform validation, formatting and security checks (using <a href=\"https:\/\/aquasecurity.github.io\/tfsec\">tfsec<\/a>). It then runs a Terraform Plan and puts this as a comment on the PR. This is really useful (an example screenshot is shown below)<\/li><li><strong><a href=\"https:\/\/github.com\/ben-freke\/wordpress-on-aws\/blob\/master\/.github\/workflows\/deploy_to_prod.yml\">On Merge<\/a><\/strong> &#8211; when a PR has been merged, the GitHub actions deploys automatically. <\/li><\/ol>\n\n\n\n<figure class=\"wp-block-image size-large is-resized\"><img loading=\"lazy\" src=\"https:\/\/benfreke.org\/wp-content\/uploads\/2021\/12\/image-1024x717.png\" alt=\"\" class=\"wp-image-1953\" width=\"676\" height=\"473\" srcset=\"https:\/\/wordpress.benfreke.org\/wp-content\/uploads\/2021\/12\/image-1024x717.png 1024w, https:\/\/wordpress.benfreke.org\/wp-content\/uploads\/2021\/12\/image-300x210.png 300w, https:\/\/wordpress.benfreke.org\/wp-content\/uploads\/2021\/12\/image-768x538.png 768w, https:\/\/wordpress.benfreke.org\/wp-content\/uploads\/2021\/12\/image-1536x1075.png 1536w, https:\/\/wordpress.benfreke.org\/wp-content\/uploads\/2021\/12\/image-676x473.png 676w, https:\/\/wordpress.benfreke.org\/wp-content\/uploads\/2021\/12\/image.png 1846w\" sizes=\"(max-width: 676px) 100vw, 676px\" \/><\/figure>\n\n\n\n<p>All the runners use on-demand EC2 runners from <a href=\"https:\/\/github.com\/machulav\/ec2-github-runner\">this GitHub Action<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>This site runs on AWS, using CloudFront, ECS, RDS and EFS (among other services). Here&#8217;s how I built it.<\/p>\n","protected":false},"author":1,"featured_media":1946,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":[],"categories":[4],"tags":[36,37,39,41,38,35,40],"_links":{"self":[{"href":"https:\/\/wordpress.benfreke.org\/wp-json\/wp\/v2\/posts\/1943"}],"collection":[{"href":"https:\/\/wordpress.benfreke.org\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wordpress.benfreke.org\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.benfreke.org\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.benfreke.org\/wp-json\/wp\/v2\/comments?post=1943"}],"version-history":[{"count":7,"href":"https:\/\/wordpress.benfreke.org\/wp-json\/wp\/v2\/posts\/1943\/revisions"}],"predecessor-version":[{"id":2001,"href":"https:\/\/wordpress.benfreke.org\/wp-json\/wp\/v2\/posts\/1943\/revisions\/2001"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/wordpress.benfreke.org\/wp-json\/wp\/v2\/media\/1946"}],"wp:attachment":[{"href":"https:\/\/wordpress.benfreke.org\/wp-json\/wp\/v2\/media?parent=1943"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wordpress.benfreke.org\/wp-json\/wp\/v2\/categories?post=1943"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wordpress.benfreke.org\/wp-json\/wp\/v2\/tags?post=1943"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}