ブログ

AWSコンソール
  → 右上のアカウント名クリック
  → 「請求とコスト管理」
  → 左メニュー「請求設定」
  → 「アラート設定」「AWS 無料利用枠アラート」にチェック
  → 保存

AWSコンソール
　→ https://us-east-1.console.aws.amazon.com/cloudwatch/home?region=us-east-1#home:
　→ 左メニュー「アラーム」
　→ 右上「アラーム作成」
　→ メトリクスの選択で「EstimatedCharges」を選択してメトリクスを追加
　→ 条件を「静的」「しきい値以上」「3(ドル)」で次へ
　→ アラーム状態トリガー「アラーム状態」、通知の送信先:BillingCharges
　→ 名前をつける
　→ アラームの作成を押して終了

cd Project/AWS
ssh -i PersonalLern.pem ec2-user@IPアドレス

sudo dnf update -y

sudo dnf install -y nginx
sudo systemctl start nginx
sudo systemctl enable nginx

sudo dnf install -y php php-fpm php-mysqlnd php-gd php-xml php-mbstring php-json
sudo systemctl start php-fpm
sudo systemctl enable php-fpm

sudo dnf install -y mariadb1011-server
sudo systemctl start mariadb
sudo systemctl enable mariadb
sudo mysql_secure_installation

[ec2-user@ip- ~]$ sudo mysql_secure_installation

NOTE: RUNNING ALL PARTS OF THIS SCRIPT IS RECOMMENDED FOR ALL MariaDB
      SERVERS IN PRODUCTION USE!  PLEASE READ EACH STEP CAREFULLY!

In order to log into MariaDB to secure it, we'll need the current
password for the root user. If you've just installed MariaDB, and
haven't set the root password yet, you should just press enter here.

Enter current password for root (enter for none):
OK, successfully used password, moving on...

Setting the root password or using the unix_socket ensures that nobody
can log into the MariaDB root user without the proper authorisation.

You already have your root account protected, so you can safely answer 'n'.

Switch to unix_socket authentication [Y/n] n
 ... skipping.

You already have your root account protected, so you can safely answer 'n'.

Change the root password? [Y/n] n
 ... skipping.

By default, a MariaDB installation has an anonymous user, allowing anyone
to log into MariaDB without having to have a user account created for
them.  This is intended only for testing, and to make the installation
go a bit smoother.  You should remove them before moving into a
production environment.

Remove anonymous users? [Y/n] Y
 ... Success!

Normally, root should only be allowed to connect from 'localhost'.  This
ensures that someone cannot guess at the root password from the network.

Disallow root login remotely? [Y/n] Y
 ... Success!

By default, MariaDB comes with a database named 'test' that anyone can
access.  This is also intended only for testing, and should be removed
before moving into a production environment.

Remove test database and access to it? [Y/n] Y
 - Dropping test database...
 ... Success!
 - Removing privileges on test database...
 ... Success!

Reloading the privilege tables will ensure that all changes made so far
will take effect immediately.

Reload privilege tables now? [Y/n] Y
 ... Success!

Cleaning up...

All done!  If you've completed all of the above steps, your MariaDB
installation should now be secure.

Thanks for using MariaDB!

sudo systemctl status nginx
sudo systemctl status php-fpm
sudo systemctl status mariadb

sudo mysql -u root -p

CREATE DATABASE wordpress CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER 'wpuser'@'localhost' IDENTIFIED BY 'パスワード';
GRANT ALL PRIVILEGES ON wordpress.* TO 'wpuser'@'localhost';
FLUSH PRIVILEGES;
EXIT;

cd /tmp
wget https://wordpress.org/latest.tar.gz
tar -xzf latest.tar.gz
rm -f latest.tar.gz
sudo mv wordpress /var/www/html/
sudo chown -R nginx:nginx /var/www/html/wordpress

sudo vi /etc/nginx/conf.d/wordpress.conf

server {
    listen 80;
    server_name _;

    root /var/www/html/wordpress;
    index index.php index.html;

    location / {
        try_files $uri $uri/ /index.php?$args;
    }

    location ~ \.php$ {
        fastcgi_pass unix:/run/php-fpm/www.sock;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;
    }

    location ~ /\.ht {
        deny all;
    }
}

基本設定の一部を無効化
sudo vi /etc/nginx/nginx.conf

serverブロックを削除

NginXリロード
sudo nginx -t
sudo systemctl reload nginx

cd /var/www/html/wordpress
sudo cp wp-config-sample.php wp-config.php
sudo vi wp-config.php

開いたファイルの以下を修正
define( 'DB_NAME', 'wordpress' );
define( 'DB_USER', 'wpuser' );
define( 'DB_PASSWORD', '設定したパスワード' );

sudo dnf install -y ruby wget

以下は北米(バージニア北部)の例なので、別リージョンならus-east-1の部分を変更してください
cd /home/ec2-user
wget https://aws-codedeploy-us-east-1.s3.us-east-1.amazonaws.com/latest/install

chmod +x ./install
sudo ./install auto

インストール確認
sudo systemctl status codedeploy-agent

name: Deploy to EC2 via CodeDeploy

on:
  push:
    branches:
      - main

permissions:
  id-token: write
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Configure AWS credentials (OIDC)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
          aws-region: ${{ secrets.AWS_REGION }}

      - name: Zip and upload to S3
        run: |
          zip -r deploy.zip . -x "*.git*"
          aws s3 cp deploy.zip s3://${{ secrets.S3_BUCKET }}/deploy.zip

      - name: Deploy via CodeDeploy
        run: |
          aws deploy create-deployment \
            --application-name wordpress-app \
            --deployment-group-name wordpress-deploy-group \
            --s3-location bucket=${{ secrets.S3_BUCKET }},key=deploy.zip,bundleType=zip \
            --region ${{ secrets.AWS_REGION }}

#!/bin/bash
systemctl restart php-fpm
systemctl restart nginx

# WordPress - ignore core, configuration, examples, uploads and logs.
# https://github.com/github/gitignore/blob/main/WordPress.gitignore

# Core
#
# Note: if you want to stage/commit WP core files
# you can delete this whole section/until Configuration.
/wp-admin/
/wp-content/index.php
/wp-content/languages
/wp-content/plugins/index.php
/wp-content/themes/index.php
/wp-includes/
/index.php
/license.txt
/readme.html
/wp-*.php
/xmlrpc.php

# Configuration
wp-config.php

# Example themes
/wp-content/themes/twenty*/

# Example plugin
/wp-content/plugins/hello.php

# Uploads
/wp-content/uploads/

# Log files
*.log

# htaccess
/.htaccess

# All plugins
#
# Note: If you wish to whitelist plugins,
# uncomment the next line
#/wp-content/plugins

# All themes
#
# Note: If you wish to whitelist themes,
# uncomment the next line
#/wp-content/themes

version: 0.0
os: linux
files:
  - source: /
    destination: /var/www/html/wordpress
file_exists_behavior: OVERWRITE

permissions:
  - object: /var/www/html/wordpress
    pattern: "**"
    owner: nginx
    group: nginx

hooks:
  AfterInstall:
    - location: scripts/after_install.sh
      timeout: 300
      runas: root