Build a WordPress Site on AWS: Step-by-Step Terraform Guide

This hands-on lab will walk you through how to set up infrastructure for a WordPress installation on AWS using Terraform.

Building on the VPC foundation from the previous tutorial, this guide demonstrates how to deploy a real-world application using Amazon EC2 for web hosting and Amazon RDS for database management. This is an excellent hands-on project that shows how you can use Terraform to automate the deployment of cloud resources for production applications.

What is WordPress?

WordPress is the world’s most popular content management system (CMS), powering over 40% of all websites on the internet. It provides a user-friendly interface for creating and managing websites, blogs, and e-commerce platforms. Hosting WordPress on AWS provides scalability, reliability, and security benefits that are essential for production websites.

Architecture Overview

This WordPress deployment uses a multi-tier architecture that separates the web application layer from the database layer, following AWS best practices for scalability and security:

Web Tier (Amazon EC2): Hosts the WordPress application and web server. The EC2 instance runs in a public subnet to serve web traffic directly to users.

Database Tier (Amazon RDS): Hosts the MySQL database in a private subnet, isolated from direct internet access. RDS provides managed database services with automated backups, updates, and high availability options.

This separation of concerns improves security by limiting database exposure and enables independent scaling of web and database resources.

Amazon EC2 for WordPress Hosting

Amazon Elastic Compute Cloud (EC2) provides resizable compute capacity in the cloud. For WordPress hosting, EC2 offers:

• Flexible instance types to match performance requirements
• Complete control over the operating system and software stack
• Integration with other AWS services for enhanced functionality
• Pay-as-you-go pricing that scales with your needs

The EC2 instance configuration includes user data scripts that automate the WordPress installation process, ensuring consistent deployment across environments.

User Data and Automation

User data scripts run automatically when an EC2 instance launches, enabling automated configuration and software installation. For WordPress deployment, user data scripts handle:

• Installing required packages (web server, PHP, MySQL client)
• Downloading and configuring WordPress
• Establishing database connectivity
• Configuring file permissions and ownership
• Starting web services

This automation eliminates manual configuration steps and ensures repeatable deployments.

Security Groups Configuration

Security groups act as virtual firewalls that control inbound and outbound traffic to AWS resources. Proper security group configuration is critical for WordPress security:

Web Server Security Group:

• Allow inbound HTTP (port 80) and HTTPS (port 443) from the internet
• Allow SSH (port 22) from trusted IP addresses for administration
• Allow all outbound traffic for software updates and external API calls

Database Security Group:

• Allow inbound MySQL traffic (port 3306) only from the web server security group
• Deny all traffic from the internet
• Implement least privilege access principles

This layered security approach protects the database while enabling necessary application functionality.

Amazon RDS for Database Management

Amazon Relational Database Service (RDS) simplifies database administration by automating time-consuming tasks such as:

• Hardware provisioning and setup
• Database patching and updates
• Automated backups and point-in-time recovery
• Monitoring and metrics collection
• Read replica creation for scaling read operations

For WordPress, RDS provides a reliable and scalable MySQL database without the overhead of manual database server management. Running RDS in private subnets ensures that the database is never directly accessible from the internet, significantly reducing the attack surface.

WordPress Configuration

After the infrastructure is deployed, WordPress requires initial configuration to connect to the RDS database. This involves:

• Setting database host, name, username, and password
• Configuring security keys and salts for encryption
• Setting file permissions for uploads and plugins
• Optimizing PHP and MySQL settings for performance

Best Practices for Production Deployments

When deploying WordPress to production on AWS, consider these additional best practices:

• Implement SSL/TLS certificates for HTTPS encryption
• Configure automated backups for both EC2 and RDS
• Use CloudFront CDN for improved performance and DDoS protection
• Implement Web Application Firewall (WAF) rules
• Enable RDS Multi-AZ deployment for high availability
• Use Auto Scaling groups for horizontal scaling
• Implement regular security patching and updates
• Monitor application and infrastructure metrics with CloudWatch

Infrastructure as Code Benefits

Using Terraform for WordPress deployment provides:

• Consistent environments across development, staging, and production
• Version control for infrastructure changes
• Easy teardown and recreation of environments
• Clear documentation through code
• Reduced human error in manual configurations