The best way to give one component access to another is usually the one that leaves no secret lying around. A local socket instead of an open network port. A temporary role instead of a hardcoded key. Day 20 was two versions of that idea, Nginx talking to PHP over a Unix socket, and EC2 getting AWS permissions through a role.
One Linux task, one AWS task. Wire Nginx to PHP-FPM through a Unix socket, then create an IAM role that EC2 instances can assume. The tasks come from the KodeKloud Engineer platform.
Nginx and PHP-FPM: connected by a socket, not a port
Nginx serves static files itself, but it cannot run PHP. It hands PHP requests off to PHP-FPM, a separate process that does the actual execution. The question is how the two talk, and here the answer is a Unix socket:
location ~ \.php$ {
include fastcgi_params;
fastcgi_pass unix:/var/run/php-fpm/default.sock; # PHP-FPM over a Unix socket
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
}
The location ~ \.php$ regex sends only .php requests to PHP-FPM; everything else Nginx serves statically. fastcgi_pass points at a socket file, not an IP and port. You could connect them over TCP with 127.0.0.1:9000 instead, but the Unix socket is the better local choice. It is a file on disk, so there is no network stack in the path and nothing listening on a port that could be reached from off the box. Less overhead, smaller surface.
The trap is ownership. Nginx and PHP-FPM have to agree on who owns that socket file, or Nginx gets permission-denied when it tries to connect. So PHP-FPM is configured to run as the nginx user and create the socket with matching ownership:
# In /etc/php-fpm.d/www.conf
# user = nginx
# group = nginx
# listen = /var/run/php-fpm/default.sock
# listen.owner = nginx
# listen.group = nginx
If PHP downloads as a file instead of running, or you get a 502, socket ownership is the first place to look.
IAM roles: permissions without a stored key
On AWS, the task was an IAM role for EC2. A role is how you grant an instance permission to call AWS services without putting an access key on the box. The instance assumes the role and receives temporary, rotating credentials instead.
# Trust policy: who is allowed to assume this role (the EC2 service)
aws iam create-role \
--role-name EC2-Custom-Role \
--assume-role-policy-document file://ec2-role-trust-policy.json
# Permissions policy: what the role can do once assumed
aws iam attach-role-policy \
--role-name EC2-Custom-Role \
--policy-arn <policy-arn>
A role has two policies doing two different jobs. The trust policy says who can assume it, here ec2.amazonaws.com. The permissions policy says what it can do once assumed. Two documents, two questions, do not mix them up.
Here is the step the task leaves out, and the one that trips people moving from the console to the CLI. A role by itself cannot be attached to an EC2 instance. EC2 uses an instance profile, a container that wraps the role, and in the console AWS creates that wrapper for you invisibly. From the CLI you do it by hand:
aws iam create-instance-profile --instance-profile-name EC2-Custom-Profile
aws iam add-role-to-instance-profile \
--instance-profile-name EC2-Custom-Profile \
--role-name EC2-Custom-Role
Then you attach the instance profile, not the role, to the instance. Miss this, and you have a perfectly good role that EC2 simply cannot use (per the AWS IAM docs).
Connect without leaking
Both tasks were about connecting two things the clean way. The Unix socket links Nginx and PHP without opening a port or leaving a network path exposed. The role links EC2 to AWS without a stored key that could leak. The lazy versions, a TCP port and a hardcoded credential, both work and both widen your attack surface for nothing in return.
So here is the Day 20 question. Would you rather connect your components the convenient way and carry the exposure, or the clean way that leaves nothing lying around to steal?
Day 20 down. Eighty to go.
Top comments (2)
One-fifth of the way there. Keep going — keep the quality coming 💪
Ha, the 36 Stratagems man himself, showing up to cheer the tortoise on. It means a lot that you keep coming back to these, it really does. I'll keep the quality high, you keep stacking those stratagems, and I'll be right there when you hit #36. Thank you, @xulingfeng😉.