A Guide to Automating WordPress Application Database with AWS Secrets Manager and AWS Lambda Functions

Overview

In the ever-evolving cybersecurity landscape, safeguarding sensitive data, especially database credentials, is paramount. For WordPress applications utilizing Amazon RDS MySQL databases, it’s essential to ensure robust security measures are in place. One effective way to enhance security is by regularly rotating database passwords. In this comprehensive guide, we’ll walk you through automating the password rotation of your WordPress application’s Amazon RDS MySQL database using AWS Secrets Manager and AWS Lambda functions.

Pioneers in Cloud Consulting & Migration Services

Reduced infrastructural costs
Accelerated application deployment

Get Started

Set up your AWS Environment

Before diving into the automation process, ensure you have an AWS account and have set up your WordPress application with an Amazon RDS MySQL database. Once your environment is ready, proceed to the next steps.

Step-by-Step Guide

Step 1: Secure the Amazon RDS credentials by storing them in AWS Secrets Manager

The first step in automating password rotation is to create a secret in AWS Secrets Manager. AWS Secrets Manager allows you to securely store, manage, and retrieve sensitive information such as database credentials, API keys, and other secrets.

Access AWS Secrets Manager:

Go to the AWS Management Console and navigate to Secrets Manager.
Create a New Secret: Click the “Store a new secret” button.
Enter the necessary Amazon RDS database credentials – including username, password, host, and database name and save the secret.

step1

Step 2: Automate AWS Lambda Function Creation with Secrets Manager

AWS Secrets Manager simplifies rotating passwords by automatically generating an AWS Lambda function that manages the rotation process. Here’s how you can do it:

Configure Rotation: Select the secret you created in the AWS Secrets Manager console. Configure the rotation settings, specifying the rotation AWS Lambda function. AWS Secrets Manager will automatically generate the AWS Lambda function.

step2

Review and Enable Rotation: Review the rotation settings and enable rotation for the secret. The AWS Secrets Manager will oversee the rotation process, regularly updating your Amazon RDS MySQL database passwords.

step2b

Step 3: Assign Permissions to Amazon EC2 Instances

You need to assign the necessary permissions for the WordPress application hosted on Amazon EC2 instances to access the secrets stored in Secrets Manager. Here’s how you can do it:

Create an AWS IAM Role: Create an AWS IAM role that grants Amazon EC2 instances permissions to retrieve secrets from Secrets Manager.
Attach the AWS IAM Role: Attach the AWS IAM role to your Amazon EC2 instances. This grants the instances the necessary permissions to access the secrets securely. Add the below AWS-managed policy to the role.

step3

Step 4: Update WordPress Files to Access Secrets

With AWS Secrets Manager and AWS Lambda handling the password rotation seamlessly, you must ensure your WordPress application can retrieve the updated credentials. Modify the WordPress files to access the database credentials securely from AWS Secrets Manager.

Install AWS SDK for PHP: If you haven’t already, install the AWS SDK for PHP on your WordPress server. This SDK allows your WordPress application to interact with AWS services, including AWS Secrets Manager. Execute the commands below in the WordPress directory to install AWS SDK.

# php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');"
# php composer-setup.php --install-dir=/usr/local/bin --filename=composer
# composer --version
# composer require aws/aws-sdk-php

# php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');"

# php composer-setup.php --install-dir=/usr/local/bin --filename=composer

# composer --version

# composer require aws/aws-sdk-php

Modify wp-config.php: Update the wp-config.php file of your WordPress application. Replace the hard-coded database credentials with calls to Secrets Manager to fetch the credentials dynamically. Add the code below to the “wp-config” file and remove the hardcoded database credentials.

require '/var/www/html/wordpress/vendor/autoload.php'; // Include the AWS SDK
 
use Aws\SecretsManager\SecretsManagerClient;
 
// Create a Secrets Manager client
$client = new SecretsManagerClient([
    'version' => 'latest',
    'region' => 'ap-south-1', // Change this to your desired AWS region
]);
 
// Specify the Secret Manager secret name that stores RDS credentials
$secretName = 'RDS_Secret';
 
// Retrieve the secret value from AWS Secret Manager
$result = $client->getSecretValue([
    'SecretId' => $secretName,
]);
 
// Parse the secret JSON string to get RDS credentials
$secret = json_decode($result['SecretString'], true);
 
// Update the WordPress configuration file with RDS credentials
define('DB_NAME', $secret['dbname']);
define('DB_USER', $secret['username']);
define('DB_PASSWORD', $secret['password']);
define('DB_HOST', $secret['host']);
define('DB_CHARSET', 'utf8');
define('DB_COLLATE', '');

require '/var/www/html/wordpress/vendor/autoload.php'; // Include the AWS SDK

use Aws\SecretsManager\SecretsManagerClient;

// Create a Secrets Manager client

$client = new SecretsManagerClient([

'version' => 'latest',

'region' => 'ap-south-1', // Change this to your desired AWS region

]);

// Specify the Secret Manager secret name that stores RDS credentials

$secretName = 'RDS_Secret';

// Retrieve the secret value from AWS Secret Manager

$result = $client->getSecretValue([

'SecretId' => $secretName,

]);

// Parse the secret JSON string to get RDS credentials

$secret = json_decode($result['SecretString'], true);

// Update the WordPress configuration file with RDS credentials

define('DB_NAME', $secret['dbname']);

define('DB_USER', $secret['username']);

define('DB_PASSWORD', $secret['password']);

define('DB_HOST', $secret['host']);

define('DB_CHARSET', 'utf8');

define('DB_COLLATE', '');

With these modifications, your WordPress application will dynamically fetch the Amazon RDS MySQL database credentials from AWS Secrets Manager, ensuring the most up-to-date and secure access to your database.

Conclusion

Following this step-by-step guide, you’ve successfully automated the password rotation process for your WordPress application’s Amazon RDS MySQL database.

With AWS Secrets Manager and AWS Lambda functions seamlessly handling the rotation and your WordPress files securely accessing the updated credentials, you’ve significantly enhanced the security posture of your WordPress environment.

Drop a query if you have any questions regarding WordPress or AWS Migration and we will get back to you quickly.

Making IT Networks Enterprise-ready – Cloud Management Services

Accelerated cloud migration
End-to-end view of the cloud environment

Get Started

About CloudThat

CloudThat is a leading provider of Cloud Training and Consulting services with a global presence in India, the USA, Asia, Europe, and Africa. Specializing in AWS, Microsoft Azure, GCP, VMware, Databricks, and more, the company serves mid-market and enterprise clients, offering comprehensive expertise in Cloud Migration, Data Platforms, DevOps, IoT, AI/ML, and more.

FAQs

1. How frequently should I rotate my Amazon RDS database password for optimal security?

ANS: – The frequency of password rotation depends on your organization’s security policies and compliance requirements. However, it’s generally recommended to rotate passwords at least every 90 days (about three months). Automated rotation with Secrets Manager allows you to customize rotation intervals, ensuring compliance with your security standards.

2. Is there any additional cost associated with using AWS Secrets Manager for password rotation?

ANS: – Yes, there might be additional costs associated with using AWS Secrets Manager, particularly based on the number of secrets stored and the frequency of rotation. It’s advisable to check AWS’s pricing page for detailed information on AWS Secrets Manager pricing.

WRITTEN BY Rohit Lovanshi

Rohit Lovanshi works as a Research Associate (Infra, Migration, and Security Team) at CloudThat. He is AWS Developer Associate certified. He has a positive attitude and works effectively in a team. He loves learning about new technology and trying out different approaches to problem-solving.