aws-cf-amzn2-epel-wordpress.yaml

---
AWSTemplateFormatVersion: '2010-09-09'

Description: Create VPC and Install WordPress on Amazon Linux 2.

# Create the following AWS resources:
#
# - An Amazon VPC (VpcName)
# - A subnet (PublicSubnet)
# - A security group for ssh access to the EC2 instance (WPSGSSH)
# - A security group for web (80/443) access to the EC2 instance (WPSGWeb)
# - An Internet gateway
# - A route table (RouteTable) with a default route to the Internet gateway
# - A Lambda execution role (LambdaExecutioRole)
# - An AWS Lambda function that looks up the AMIs for Amazon Linux 2 (AMIInfo)
# - An Amazon EC2 instance running Amazon Linux 2 (WPInstance)
#
# Then:
#
# - Install some core Linux components
# - Install EPEL (Extra Packages for Enterprise Linux)
# - Install and configure Apache, PHP, and MySQL
# - Download and perform initial configuration of WordPress
# - Clean up
#
# After this template runs, you will then need to do:
#
# - Set up encryption with LetsEncrypt
# - Browse to port 80 of the instance at the installation directory you created
# - Perform the post installation setup and specify:
#   Your e-mail
#   Your password
# - In the General Settings, specify the Site URL as well as the WordPress URL.
#   (This allows you to keep the WordPress core files separate.)
# - Save the changes
# - Copy .htaccess and index.php to the web site root (/var/www/html)
# - Set the owner and group .htaccess and index.php to "apache"
# - Sign into WordPress
# - Set your permalinks to the desired format
# - Enjoy WordPress!

# Notes:
#
# - The MySQL root password is stored in the /home/ec2-user directory
# - The WordPress database password is stored in the /home/ec2-user directory

Parameters:
  AZName:
    Type: AWS::EC2::AvailabilityZone::Name
    Description: Subnet availability zone

  HostKeyPairName:
    Type: AWS::EC2::KeyPair::KeyName
    Description: EC2 keypair for host

  HostInstanceType:
    Type: String
    Description: Instance type for host (t2.micro (default), t2.small, or t2.medium)
    Default: t2.micro
    AllowedValues:
    - t2.micro
    - t2.small
    - t2.medium

  CFNamePrefix:
    Type: String
    Description: AWS resource name tag prefix (2-64 alphanumerics)
    Default: wp
    MinLength: 2
    MaxLength: 64
    AllowedPattern: "[a-zA-Z][a-zA-Z0-9]*"

  SGSSHCidr:
    Type: String
    Description: The CIDR address range that can SSH to the EC2 instance
    MinLength: 9
    MaxLength: 18
    Default: "0.0.0.0/0"
    AllowedPattern: "(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})/(\\d{1,2})"
    ConstraintDescription: Must be a valid IP CIDR range of the form x.x.x.x/x

  SGWebCidr:
    Type: String
    Description: The CIDR address range that can browse to the EC2 instance
    MinLength: 9
    MaxLength: 18
    Default: "0.0.0.0/0"
    AllowedPattern: "(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})/(\\d{1,2})"
    ConstraintDescription: Must be a valid IP CIDR range of the form x.x.x.x/x

  WPDB:
    Type: String
    Description: WP database name
    Default: wpdb
    MinLength: 1
    MaxLength: 64

  WPUser:
    Type: String
    Description: WP database user name (2-32 alphanumerics)
    Default: wpuser
    MinLength: 1
    MaxLength: 32
    AllowedPattern: "[a-zA-Z][a-zA-Z0-9]*"

  WPDir:
    Type: String
    Description: WP installation directory (13-64 characters)
    MinLength: 13
    MaxLength: 64
    Default: /var/www/html/wpinstall

  WPTablePrefix:
    Type: String
    Description: WP table prefix (2-16 alphanumerics)
    MinLength: 2
    MaxLength: 16
    Default: wp
    AllowedPattern: "[a-zA-Z][a-zA-Z0-9]*"

Resources:
  VpcName:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.200.0.0/16
      EnableDnsSupport: 'true'
      EnableDnsHostnames: 'true'
      Tags:
      - Key: Name
        Value: !Join [ '', [ Ref: CFNamePrefix, '-vpc' ]]

  PublicSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      AvailabilityZone: !Ref AZName
      CidrBlock: 10.200.11.0/24
      MapPublicIpOnLaunch: 'true'
      Tags:
      - Key: Name
        Value: !Join [ '', [ Ref: CFNamePrefix, '-sn' ]]
      VpcId: !Ref VpcName

  VpcIgw:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
      - Key: Name
        Value: !Join [ '', [ Ref: CFNamePrefix, '-igw' ]]

  VpcIgwAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      InternetGatewayId: !Ref VpcIgw
      VpcId: !Ref VpcName

  RouteTable:
    Type: AWS::EC2::RouteTable
    DependsOn: VpcIgwAttachment
    Properties:
      VpcId: !Ref VpcName
      Tags:
      - Key: Name
        Value: !Join [ '', [ Ref: CFNamePrefix, '-rtb' ]]

  DefaultRoute:
    Type: AWS::EC2::Route
    Properties:
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref VpcIgw
      RouteTableId: !Ref RouteTable

  PublicSubnetRtb01:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref RouteTable
      SubnetId: !Ref PublicSubnet

  WPSGSSH:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Enable SSH access via port 22
      SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: '22'
        ToPort: '22'
        CidrIp: !Ref SGSSHCidr
      Tags:
      - Key: Name
        Value: !Join [ '', [ Ref: CFNamePrefix, '-sshsg' ]]
      VpcId: !Ref VpcName

  WPSGWeb:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Enable SSH access via port 22
      SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: '80'
        ToPort: '80'
        CidrIp: !Ref SGWebCidr
      - IpProtocol: tcp
        FromPort: '443'
        ToPort: '443'
        CidrIp: !Ref SGWebCidr
      Tags:
      - Key: Name
        Value: !Join [ '', [ Ref: CFNamePrefix, '-websg' ]]
      VpcId: !Ref VpcName

  LambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - lambda.amazonaws.com
          Action:
          - sts:AssumeRole
      Path: "/"
      Policies:
      - PolicyName: root
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - logs:CreateLogGroup
            - logs:CreateLogStream
            - logs:PutLogEvents
            Resource: arn:aws:logs:*:*:*
          - Effect: Allow
            Action:
            - ec2:DescribeImages
            Resource: "*"

# AMIInfoFunction - Look up an AMI based on a NameFilter
#
# This AWS Lambda function is used to look up an Amazon EC2 AMI based
# on a name filter. An example of a name filter would be:
#
# amzn2-ami-hvm\*ebs
#
# After looking up the names of all images that satify the filter,
# they are sorted in reverse by date/time stamp and the first AMI
# ID (which corresponds to the newest AMI) is returned.
#
# Using a Lambda function makes it possible to look up the AMI
# dynamically.  THe alternative would be to create a static map.

  AMIInfoFunction:
    Type: AWS::Lambda::Function
    Properties: 
      Description: "Look up an AMI based on a filter"
      Handler: index.handler
      MemorySize: 128
      Role: !GetAtt LambdaExecutionRole.Arn
      Runtime: "python3.6"
      Timeout: 30
      Tags: 
      - Key: Name
        Value: !Join [ '', [ Ref: CFNamePrefix, '-lambda' ]]
      Code:
        ZipFile: |
          import json
          import boto3
          import cfnresponse
          def handler(event, context):
            if event['RequestType'] == 'Delete':
              responseData = {}      
              cfnresponse.send(event, context, cfnresponse.SUCCESS, responseData)
              return
            
            ec2=boto3.client('ec2')
            imageDescriptions=ec2.describe_images(
              Owners=['amazon'],
              Filters=[
                {'Name': 'name', 'Values': [event['ResourceProperties']['NameFilter']]}
              ],
            )
            
            if len(imageDescriptions) == 0:
              responseData = {}
              cfnresponse.send(event, context, cfnresponse.FAILED)
            else:
              amiNames = sorted(imageDescriptions['Images'],
                key=lambda x: x['CreationDate'],
                reverse=True)
              responseData = {}
              responseData['Id'] = amiNames[0]['ImageId']
              cfnresponse.send(event, context, cfnresponse.SUCCESS, responseData)

            return

# AMIInfo - The AWS Lambda-backed resource for looking up an Amazon EC2 AMI
#
# Parameters
#
# ServiceToken - a pointer to the AWS Lambda function
# NameFilter - the name filter to pass to the describe_images API

  AMIInfo:
    Type: Custom::AMIInfo
    Properties:
      ServiceToken: !GetAtt AMIInfoFunction.Arn
      NameFilter: 'amzn2-ami-hvm*gp2'

  WPInstance:
    Type: AWS::EC2::Instance
    DependsOn: VpcIgwAttachment

    CreationPolicy:
      ResourceSignal:
        Timeout: PT15M

    Properties:
      AvailabilityZone: !Ref AZName
      ImageId: !GetAtt AMIInfo.Id
      InstanceInitiatedShutdownBehavior: stop
      InstanceType: !Ref HostInstanceType
      KeyName: !Ref HostKeyPairName
      Monitoring: 'true'
      NetworkInterfaces:
      - AssociatePublicIpAddress: 'true'
        DeviceIndex: '0'
        GroupSet:
        - !Ref WPSGSSH
        - !Ref WPSGWeb
        SubnetId: !Ref PublicSubnet
      Tags:
      - Key: Name
        Value: !Join [ '', [ Ref: CFNamePrefix, '-server' ]]
      Tenancy: default
      UserData:
        Fn::Base64: !Sub |
          #!/bin/bash -xe
          HOMEDIR=/home/ec2-user
          EPELRPM=https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm
          WPCONFIG=/tmp/wordpress/wp-config.php
          HTTPDCONF=/etc/httpd/conf/httpd.conf

          # randomstring - a function for returning a string of up to 64random
          # characters.  The length is specified as a parameter.
          # 
          # eg:
          #
          # randomstring 10

          randomstring () { dd if=/dev/urandom count=1 | sha256sum | head -c$1; }

          yum update -y
          
          amazon-linux-extras install lamp-mariadb10.2-php7.2

          echo Installing EPEL...
          cd /tmp
          wget -O epel.rpm -nv $EPELRPM
          yum install -y ./epel.rpm

          echo Installing packages...
          echo Please ignore messages regarding SELinux...
          yum install -y \
            httpd \
            mariadb-server \
            php \
            php-gd \
            php-mbstring \
            php-mysqlnd \
            php-xml \
            php-xmlrpc \
            python2-certbot-apache.noarch

          echo Generating database passwords...
          MYSQL_ROOT_PASSWORD=`randomstring 16`
          echo $MYSQL_ROOT_PASSWORD > $HOMEDIR/MYSQL_ROOT_PASSWORD
          chown ec2-user $HOMEDIR/MYSQL_ROOT_PASSWORD
          MYSQL_WPUSER_PASSWORD=`randomstring 16`
          echo $MYSQL_WPUSER_PASSWORD > $HOMEDIR/MYSQL_WPUSER_PASSWORD
          chown ec2-user $HOMEDIR/MYSQL_WPUSER_PASSWORD

          echo Starting databases...
          sudo systemctl start mariadb
          sudo systemctl enable mariadb

          echo Setting up basic database security...
          mysql -u root <<EOF
          UPDATE mysql.user SET Password=PASSWORD('$MYSQL_ROOT_PASSWORD') WHERE User='root';
          DELETE FROM mysql.user WHERE User='root' AND Host NOT IN ('localhost', '127.0.0.1', '::1');
          DELETE FROM mysql.user WHERE User='';
          DROP DATABASE test;
          CREATE USER '${WPUser}'@'localhost' IDENTIFIED BY '$MYSQL_WPUSER_PASSWORD';
          CREATE DATABASE ${WPDB} CHARACTER SET utf8 COLLATE utf8_unicode_ci;
          GRANT ALL PRIVILEGES ON ${WPDB}.* TO '${WPUser}'@'localhost';
          FLUSH PRIVILEGES;
          EOF

          echo Downloading WordPress...
          cd /tmp
          wget -O latest.tar.gz -nv https://www.wordpress.org/latest.tar.gz 
          tar -xzf latest.tar.gz
          touch wordpress/.htaccess
          chmod 660 wordpress/.htaccess
          mkdir wordpress/wp-content/upgrade
          cp wordpress/wp-config-sample.php $WPCONFIG

          echo Configuring WordPress...
          sed -i \
            -e "s/database_name_here/${WPDB}/g" \
            -e "s/username_here/${WPUser}/g" \
            -e "s/password_here/$MYSQL_WPUSER_PASSWORD/g" \
            -e "/table_prefix/s/wp_/${WPTablePrefix}/" \
            -e "/'AUTH_KEY'/s/put your unique phrase here/`randomstring 64`/" \
            -e "/'SECURE_AUTH_KEY'/s/put your unique phrase here/`randomstring 64`/" \
            -e "/'LOGGED_IN_KEY'/s/put your unique phrase here/`randomstring 64`/" \
            -e "/'NONCE_KEY'/s/put your unique phrase here/`randomstring 64`/" \
            -e "/'AUTH_SALT'/s/put your unique phrase here/`randomstring 64`/" \
            -e "/'SECURE_AUTH_SALT'/s/put your unique phrase here/`randomstring 64`/" \
            -e "/'LOGGED_IN_SALT'/s/put your unique phrase here/`randomstring 64`/" \
            -e "/'NONCE_SALT'/s/put your unique phrase here/`randomstring 64`/" \
            $WPCONFIG

          echo Configuring Apache...
          usermod -a -G apache ec2-user
          chown -R ec2-user:apache /var/www
          chmod 2775 /var/www && find /var/www -type d -exec chmod 2775 {} \;
          find /var/www -type f -exec chmod 0664 {} \;

          sed -i \
            -e '/<Directory "\/var\/www\/html">/,/<\/Directory>/s/AllowOverride None/AllowOverride All/' \
            $HTTPDCONF

          echo Migrating WordPress installation...
          mkdir ${WPDir}
          cp -r wordpress/* ${WPDir}/
          chown -R apache:apache /var/www
          chmod 2775 /var/www
          find /var/www -type d -exec chmod 2775 {} \;

          echo Starting Apache...
          sudo systemctl start httpd
          sudo systemctl enable httpd

          echo Cleaning up...
          rm -r /tmp/wordpress

          /opt/aws/bin/cfn-signal \
            -e $? \
            --stack ${AWS::StackName} \
            --resource WPInstance \
            --region ${AWS::Region}

Outputs:
  VpcId:
    Description: Vpc Id
    Value: !Ref VpcName

  WPInstanceId:
    Description: WPInstance Instance Id
    Value: !Ref WPInstance

  WPInstanceIP:
    Description: WPInstance IP Address
    Value: !GetAtt WPInstance.PublicIp