EC2 - AWS SDK - config.inc.php where?

Question

I've set up an instance running Amazon Linux AMI x86_64 EBS.

I installed httpd, and PEAR, then installed the AWS SDK.

Now, I'm new to all this server configuration so forgive my naivety.

My web root is at var/www/html. The only reference to the AWS SDK I can find is at tmp/pear/download/sdk-1.4.7 - I'm confused by this, it seems to me this tmp folder is is a temp directory so is the SDK installed somewhere else and i've just not seen it?

But the crux is this: http://aws.amazon.com/articles/PHP/4261#configurecredentials states I need to

To add your AWS credentials the simple way (non-PEAR)

Navigate to the config-sample.inc.php file in the SDK directory, and rename it to config.inc.php.

Open config.inc.php for editing. There are instructions in this file for what each configuration value, should be and where you can find it.

When the SDK is loaded, it will first look for config.inc.php in the same directory as sdk.class.php. You are now ready to run the sample!

or

To add your AWS credentials the flexible way (PEAR)

Create a new configuration file at ~/.aws/sdk/config.inc.php.

You can either download and copy the contents of a config-sample.inc.php file, or grabdirectly from the above GitHub link.

Open config.inc.php for editing. There are instructions in this file for what each configuration value, and where you can find it.

Enter echo getenv('HOME'); to verify that PHP can access the HOME environment variable .

If the previous command doesn't t return the correct file path to your user directory, configure it with putenv('HOME=');.

The first option could work for me, but the folder is not writable. I'm unsure if sudo chown ec2-user /tmp/pear/download/sdk-1.4.7 would be safe to do.

The second option. I placed my config.inc.php file into home/ec2-user/.aws/sdk/config.inc.php (.aws I had to create).

Then on my webpage echo getenv('HOME'); returns /root. If I try and navigate to /root through FTP I get an error 'could not retrieve file listing - make sure you have permission to modify...'.

Where should I go from here? Do I put the putenv('HOME=<your-user-path>'); into my php.ini file? And what exactly is 'your-user-path'? Or do I have to put that at the top of every web accessible file?

If someone could guide me a little I'd be most grateful.

Answer 1

Installing the SDK via PEAR places the files in /usr/share/pear/AWSSDKforPHP; config-sample.inc.php is under this folder.

If you look at php -i | grep include_path (or the output of phpinfo()) you should find something like the following: .:/usr/share/pear:/usr/share/php

This indicates that the path the SDK was installed to is available in your includes (i.e. falls below /usr/share/pear).

You will note that ownership of the SDK files is set to root - with 0644 permissions. The user Apache is running as is presumably neither root, nor in the root group. It should therefore be able to read the files, but not modify them.

/root is the home directory of the user root. The getenv() and setenv() functions are PHP, and need to go in a PHP file - not an INI file.

You don't need to use the environment variables for the method above. However, if you place your configuration in your HOME directory (as per method 2), then PHP needs to know your home directory in order to read the file (there are potentially other issues with this, in that many installations will restrict access to certain folders only, e.g. using open_basedir).

Using the second approach, you will need to verify that PHP can determine your HOME directory. You can create a PHP file and test the getenv() function. If all is well (i.e. you get the correct HOME path - the directory containing your configuration file), then you don't need to use that or the setenv() function at all.

If, on the other hand, the path is incorrect, then you will need to set the correct home path at the top of your script (i.e. the one using the SDK, before you reference it). Essentially, you are exporting the path to the directory containing the .aws folder that you have your configuration in - whenever you call the SDK that variable will need to be set.

As for the response you got (i.e. /root) - if you run the php script from the command line as root, then the response was expected. If you ran it through a web browser, then something isn't quite right. Apache is typically set up as its own user (UID=48), with its home directory set to /var/www - regardless, Apache should not be running as root. Typically, Apache is started as root and then changes to the user specified in your httpd.conf file. If you are running suPHP or php-fpm then there is a good chance that PHP is not running as the same user as the web server. Note that you can run the same script as different users, and will get a different response each time - run it under the conditions you expect it to be run as (i.e. if the script it intended to be accessed via a browser, do so; if it will be a shell script then run it as such).