AWS Developer Tools Blog
Automating the Deployment of Encrypted Web Services with the AWS SDK for PHP (Part 2)
In the first post of this series, we focused on how to use Amazon Route 53 for domain registration and use Amazon Certificate Manager (ACM) to create SSL certificates. With our newly registered domain available for use, we can proceed to deploy and configure the services we need to host the www.dev-null.link website across an encrypted connection. Once complete, the infrastructure configuration will reflect the diagrams below.
The first diagram shows the use of Route 53 to route traffic between AWS Elastic Beanstalk environments across multiple regions. The second example adds Amazon CloudFront support to the design.
AWS Elastic Beanstalk
Our first step is to create the Elastic Beanstalk application, which will provide the necessary infrastructure to host our website. The following is the order of the methods used for the AWS Elastic Beanstalk deployment:
- createApplication
- createApplicationVersion
- createConfigurationTemplate
- createEnvironment
We start by creating the Elastic Beanstalk application.
$ebCreateApplicationData = [ 'ApplicationName' => "DevNullDemo",
'Description' => "Demo application for ACM deployment" ];
$ebCreateApplicationResult = $ebClient->createApplication($ebCreateApplicationData);
print_r($ebCreateApplicationResult);Result
… [Application] => Array ( [ApplicationName] => DevNullDemo [Description] => Demo application for ACM deployment …
Now we’ll create the initial version of the application and name it DevNullDemo. You can use the application archive of your choice, although a simple PHP demo site is available here.
$ebCreateAppVersionData = [ 'ApplicationName' => "DevNullDemo",
'VersionLabel' => 'v1',
'Description' => 'Initial Create',
'SourceBundle' => [ 'S3Bucket' => 'pub-materials',
'S3Key' => 'Sample-App.zip' ] ];
$ebCreateAppVersionResult = $ebClient->createApplicationVersion($ebCreateAppVersionData);
print_r($ebCreateAppVersionResult);Result
…
[ApplicationVersion] => Array
(
[ApplicationName] => DevNullDemo
[Description] => Initial Create
[VersionLabel] => v1
[SourceBundle] => Array
(
[S3Bucket] => pub-materials
[S3Key] => Sample-App.zip
)
[Status] => UNPROCESSED
)
…
Next, we need to create an Elastic Beanstalk configuration template. This template requires the selection of an Elastic Beanstalk solution stack prior to calling the method, createConfigurationTemplate. The solution stack is the platform you choose to run your application within Elastic Beanstalk. You can find a list of available solution stack choices by using the listAvailableSolutionStacks method.
$ebSolutionStacks = $ebClient->listAvailableSolutionStacks();
print_r($ebSolutionStacks);Result
…
[SolutionStacks] => Array
(
[0] => 64bit Windows Server Core 2012 R2 v1.2.0 running IIS 8.5
…
[5] => 64bit Amazon Linux 2016.03 v2.1.6 running Java 7
…
[9] => 64bit Amazon Linux 2014.03 v1.1.0 running Node.js
[14] => 64bit Amazon Linux 2016.03 v2.1.7 running PHP 7.0
[15] => 64bit Amazon Linux 2015.09 v2.0.6 running PHP 5.6
[16] => 64bit Amazon Linux 2015.09 v2.0.4 running PHP 5.6
…
[14] => Array
(
[SolutionStackName] => 64bit Amazon Linux 2016.03 v2.1.7 running PHP 7.0
[PermittedFileTypes] => Array
(
[0] => zip
)
)
…
For our demonstration, we’ll use the, 64bit Amazon Linux 2016.03 v2.1.7 running PHP 7.0 solution stack.
$ebConfigTemplateData = [ 'ApplicationName' => "DevNullDemo",
'TemplateName' => 'DevNullDemoTemplate',
'SolutionStackName' => '64bit Amazon Linux 2016.03 v2.1.7 running PHP 7.0',
'Description' => 'EB Environment template for blog deployment.' ];
$ebConfigTemplateCreateResult = $ebClient->createConfigurationTemplate($ebConfigTemplateData);
print_r($ebConfigTemplateCreateResult);Result
…
(
[SolutionStackName] => 64bit Amazon Linux 2016.03 v2.1.7 running PHP 7.0
[ApplicationName] => DevNullDemo
[TemplateName] => DevNullDemoTemplate
[Description] => EB Environment template for blog deployment.
…
Now we can create and start the infrastructure by using the createEnvironment method. The following example sets additional options such as instance type and ACM SSL certificate. You need to replace the [CERTIFICATEARN] value with the AWS ACM certificate ARN created in part 1 of this series. You can also find this value by using the AWS ACM listCertificates method. For these examples, we’ve created a certificate across multiple regions for the host name eb.dev-null.link, in addition to the previously created www.dev-null.link certificate.
$ebCreateEnvData = [ 'ApplicationName' => "DevNullDemo",
'EnvironmentName' => "DevNullEnv",
'Description' => "Demo environment for ACM EB deployment.",
'TemplateName' => "DevNullDemoTemplate",
'VersionLabel' => 'v1',
'OptionSettings' => [
[ 'Namespace' => 'aws:elb:listener:443',
'OptionName' => 'ListenerProtocol',
'Value' => 'HTTPS' ],
[ 'Namespace' => 'aws:elb:listener:443',
'OptionName' => 'SSLCertificateId',
'Value' => '[CERTIFICATEARN]' ],
[ 'Namespace' => 'aws:elb:listener:443',
'OptionName' => 'InstancePort',
'Value' => '80' ],
[ 'Namespace' => 'aws:elb:listener:443',
'OptionName' => 'InstanceProtocol',
'Value' => 'HTTP' ],
[ 'Namespace' => 'aws:autoscaling:launchconfiguration',
'OptionName' => 'InstanceType',
'Value' => 't2.nano' ],
],
'Tier' => [ 'Name' => 'WebServer',
'Type' => 'Standard',
'Version' => ' ' ],
];
$ebCreateEnvData = $ebClient->createEnvironment($ebCreateEnvData);
print_r($ebCreateEnvData);
Result
…
[EnvironmentName] => DevNullEnv
[EnvironmentId] => e-fnvhjptdjd
[ApplicationName] => DevNullDemo
[VersionLabel] => v1
[SolutionStackName] => 64bit Amazon Linux 2016.03 v2.1.7 running PHP 7.0
[Description] => Demo environment for ACM EB deployment.
[Status] => Launching
[Health] => Grey
[Tier] => Array
(
[Name] => WebServer
[Type] => Standard
[Version] =>
)
…
As the results show, the current status of our environment is Launching. We can periodically check the status with the describeEnvironments method.
$ebDescEnvResult = $ebClient->describeEnvironments();
foreach($ebDescEnvResult['Environments'] as $ebEnvList) {
print "Name:\t".$ebEnvList['EnvironmentName']."\n";
print "ID:\t".$ebEnvList['EnvironmentId']."\n";
print "CNAME:\t".$ebEnvList['CNAME']."\n";
print "Status:\t".$ebEnvList['Status']."\n\n";
}
Result
Name: DevNullEnv ID: [ID] CNAME: DevNullEnv.[ID].[Region].elasticbeanstalk.com Status: Ready
When the environment has a status of Ready, we can proceed to create the necessary DNS records. You can also check that the site is functional by pasting the CNAME value into a web browser. Be sure to record this CNAME value so you can use it later.
You will want to repeat this process across additional AWS Regions to demonstrate latency-based DNS resolution.
Amazon Route 53
Our next step is to create a Route 53 hosted zone. This hosted zone will define a domain name (or subdomain) for which we are authoritative and, thus, allowed to create DNS records. We’ll start with the createHostedZone method.
$route53Client = $sdk->createRoute53();
$route53Data = [ 'Name' => "dev-null.link",
'CallerReference' => "BLOGPOSTREF001",
'HostedZoneConfig' => [ 'Comment' => "AWS SDK sample dev-null.link" ] ];
$route53Result = $route53Client->createHostedZone($route53Data);
Result
[HostedZone] => Array
(
[Id] => /hostedzone/[Amazon Route 53 Zone ID]
[Name] => dev-null.link.
[CallerReference] => BLOGPOSTREF001
[Config] => Array
(
[Comment] => AWS SDK sample dev-null.link
[PrivateZone] =>
)
[ResourceRecordSetCount] => 2
)
…
[DelegationSet] => Array
(
[NameServers] => Array
(
[0] => ns-999.awsdns-60.net
…
)
)
You should copy the ID of the hosted zone from this result. You can also find a list of all hosted zone ID values by using the listHostedZones method.
$route53ListResult = $route53Client->listHostedZones();
foreach($route53ListResult['HostedZones'] as $zoneItem) {
print "Name:\t".substr($zoneItem['Name'],0,-1)."\n";
print "ID:\t".$zoneItem['Id']."\n\n";
}
Result
Name: dev-null.link ID: /hostedzone/[Amazon Route 53 Zone ID]
We’ll now create a new DNS entry so that our website is visible via web browser with the eb.dev-null.link host name. For this, we need to use the CNAME value from our Elastic Beanstalk application.
$currentDate = date("r");
$hostedZoneId = "/hostedzone/[Amazon Route 53 Zone ID]";
$subDomain = "eb.dev-null.link";
$ebCname = "DevNullEnv.[EB ID].[Region].elasticbeanstalk.com";
$recordComment = "Created $subDomain record on $currentDate";
$route53RecordData = [ 'HostedZoneId' => $hostedZoneId,
'ChangeBatch' => [ 'Comment' => $recordComment,
'Changes' => [
[ 'Action' => 'CREATE',
'ResourceRecordSet' => [ 'Name' => $subDomain,
'Type' => 'CNAME',
'TTL' => 60,
'ResourceRecords' => [ [ 'Value' => $ebCname ] ] ]
] ] ] ];
$route53ChangeResult = $route53Client->changeResourceRecordSets($route53RecordData);
print_r($route53ChangeResult);
Result
…
[ChangeInfo] => Array
(
[Id] => /change/[ChangeInfo ID]
[Status] => PENDING
…
[Comment] => Created test.jf.unicorn.rentals record on Thu, 15 Sep 2016 12:25:07 -0700
)
…
As we can see from the result, the status of the change is PENDING. We can check the status with the getChange method using the value of the ChangeInfo ID.
$route53ChangeData = [ 'Id' => "/change/[ChangeInfo ID]" ];
$route53ChangeResult = $route53Client->getChange($route53ChangeData);
print_r($route53ChangeResult);
Result
…
[ChangeInfo] => Array
(
[Id] => /change/<ChangeInfo ID>
[Status] => INSYNC
…
[Comment] => Created test.jf.unicorn.rentals record on Thu, 15 Sep 2016 12:25:07 -0700
)
…
Now that our change has the status of INSYNC, we can view the secure URL in our browser window with the URL https://eb.dev-null.link/.
Deploying Across Multiple Regions
This deployment is now serving our website across an encrypted connection in a single AWS Region. For those who would like to use multiple regions, we can expand our current configuration. An AWS ACM certificate is needed in each AWS Region used for the deployment. Because we’ll be using CloudFront, we have to ensure that a certificate is created in the us-east-1 region because CloudFront will source the available AWS ACM certificates from there. You can reference the previous blog post for instructions on creating an AWS ACM certificate in additional regions. Next, run the Elastic Beanstalk creation methods shown earlier in each additional region where you want to deploy the application. Be sure to record the CNAME value for each environment.
After we have all of the necessary Elastic Beanstalk environments running, we need to delete the Route 53 resource record for eb.dev-null.link so that we can replace it with a latency-based record set.
$recordComment = "Deleted $subDomain record on $currentDate";
$route53RecordData = [ 'HostedZoneId' => $hostedZoneId,
'ChangeBatch' => [ 'Comment' => $recordComment,
'Changes' => [
[ 'Action' => 'DELETE',
'ResourceRecordSet' => [ 'Name' => $subDomain,
'Type' => 'CNAME',
'TTL' => 60,
'ResourceRecords' => [ [ 'Value' => $ebCname ] ] ]
] ] ] ];
$route53ChangeResult = $route53Client->changeResourceRecordSets($route53RecordData);
You might notice that the method and instructions to delete the record are almost identical to the instructions used to create the record. They even use the same method, changeResourceRecordSets.
Result
…
[ChangeInfo] => Array
(
[Id] => /change/[ChangeInfo ID]
[Status] => PENDING
[Comment] => Deleted www.dev-null.link record on Thu, 15 Sep 2016 14:58:51 -0700
)
…
Our next step is to add the latency-based routing rules. This example provides the CNAME of the Elastic Beanstalk environment via the describeEnvironments method.
$currentDate = date("r");
$hostedZoneId = "HOSTED ZONE ID";
$ebDescEnvData = [ 'EnvironmentNames' => [ 'DevNullEnvProd' ] ];
$ebDescEnvResult = $ebClient->describeEnvironments($ebDescEnvData);
$ebCname = $ebDescEnvResult['Environments'][0]['CNAME'];
$recordComment = "Created www record on $currentDate";
$route53RecordData = [ 'HostedZoneId' => $hostedZoneId,
'ChangeBatch' => [ 'Comment' => $recordComment,
'Changes' => [
[ 'Action' => 'CREATE',
'ResourceRecordSet' => [
'Name' => "eb.dev-null.link",
'Type' => 'CNAME',
'TTL' => 60,
'Region' => $region,
'SetIdentifier' => str_replace("-","",$region),
'ResourceRecords' => [ [ 'Value' => $ebCname ], ],
],
],
],
],
];
$route53ChangeResult = $route53Client->changeResourceRecordSets($route53RecordData);
Result
…
[ChangeInfo] => Array
(
[Id] => /change/[ChangeInfo ID]
[Status] => PENDING
…
In the Route 53 console, we can see there are two CNAMEs that now resolve the host name, eb.dev-null.link. When a user visits the website, the URL returned will correspond to the lower of the record latencies.
Amazon CloudFront
To enhance the user experience, we’ll now configure and deploy a content delivery network solution named Amazon CloudFront. This AWS service provides content delivery acceleration for the media provided with our web application. Each CloudFront deployment is composed of a CloudFront distribution with each distribution having one or more origins. An origin defines the mapping of a URL to a particular destination. The host name, www.dev-null.link, will resolve to our CloudFront distribution, which will then serve pages from the backend eb.dev-null.link load-balanced site. We first create our distribution with the createDistribution method. The value of $cfCreateDistData can be found in this Github Gist.
$cfCreateDistResult = $cfClient->createDistribution($cfCreateDistData);
print_r($cfCreateDistResult);
Result
Aws\Result Object
(
[data:Aws\Result:private] => Array
(
[Distribution] => Array
(
[Id] => [CF ID Value]
[DomainName] => [CloudFront ID].cloudfront.net
…
Once complete, we need to save the value of DomainName from the result returned. Next, we’ll create a new Route 53 CNAME record that points www.dev-null.link to our CloudFront distribution.
$subDomain = "www.dev-null.link";
$cfCname = "[CloudFront ID].cloudfront.net";
$recordComment = "Created $subDomain record on $currentDate";
$route53RecordData = [ 'HostedZoneId' => $hostedZoneId,
'ChangeBatch' => [ 'Comment' => $recordComment,
'Changes' => [
[ 'Action' => 'CREATE',
'ResourceRecordSet' => [ 'Name' => $subDomain,
'Type' => 'CNAME',
'TTL' => 60,
'ResourceRecords' => [ [ 'Value' => $cfCname ] ] ]
] ] ] ];
$route53ChangeResult = $route53Client->changeResourceRecordSets($route53RecordData);
Result
Aws\Result Object
(
[data:Aws\Result:private] => Array
(
[ChangeInfo] => Array
(
[Status] => PENDING
…
Once complete, we can test the new deployment by navigating to the URL (https://www.dev-null.link/) in a web browser.
Conclusion
With our infrastructure configuration completed, we now have a globally load balanced web application that’s accessible via encrypted communications. We’ve shown we can use the AWS SDK for PHP to automate these deployments, which provides the agility to reproduce these environments for customers on demand. Next, we’ll continue this series by reviewing deployments that use Amazon S3 for static content hosting, and the AWS Application Load Balancer and Elastic Load Balancing with Amazon EC2 instance deployments.