使用 Cloudformation 为 EBS 快照创建 Cloudwatch 事件

Question

我正在尝试创建 cloudwatch 计划事件来拍摄我的 ebs 快照。我是 cloudformation 的新手，不太熟悉它，这就是实现这一点的复杂性的原因。我正在附加生成我的 ec2 实例并将默认卷从 10gb 覆盖到 20gb 的当前模板。我想在完全相同的已创建卷上创建一个 cloudwatch 事件，以拍摄从该模板创建的该卷的快照。如果有人可以帮助我使用 cloudformation 语法设置带有目标的事件，我将很高兴。

Parameters:
  KeyName:
    Description: The EC2 Key Pair to allow SSH access to the instance
    Type: 'AWS::EC2::KeyPair::KeyName'
Resources:
  Ec2Instance:
    Type: 'AWS::EC2::Instance'
    DependsOn:
      - InstanceSecurityGroup
      - CWIAMRole
      - EC2CWInstanceProfile
    Properties:
      KeyName: !Ref KeyName
      ImageId: ami-057a963e8be173b19
      InstanceType: t3a.micro
      IamInstanceProfile: !Ref EC2CWInstanceProfile
      NetworkInterfaces:
        - AssociatePublicIpAddress: 'True'
          DeleteOnTermination: 'True'
          DeviceIndex: '0'
          # Add subnet id below
          SubnetId: subnet-031c6fb8172d780aa
          GroupSet:
            - !Ref InstanceSecurityGroup
      BlockDeviceMappings:
        - DeviceName: /dev/xvda
          Ebs:
            VolumeType: gp2
            DeleteOnTermination: 'true'
            VolumeSize: '20'
  LambdaSecurityGroup:
    Type: 'AWS::EC2::SecurityGroup'
    Properties:
      GroupDescription: Enable SSH access via port 22
      # Add you vpc id below
      VpcId: vpc-02e91d5d082e3a097
      GroupName: DS Lambda Security Group
  InstanceSecurityGroup:
    Type: 'AWS::EC2::SecurityGroup'
    DependsOn:
      - LambdaSecurityGroup
    Properties:
      GroupDescription: Enable SSH access via port 22
      # Add you vpc id below
      VpcId: vpc-02e91d5d082e3a097
      GroupName: DS DB Instance Security Group
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: '22'
          ToPort: '22'
          # Add vpn ip below for e.g 192.168.78.2/32
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: '5432'
          ToPort: '5432'
          SourceSecurityGroupId: !Ref LambdaSecurityGroup
  CWIAMRole:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/CloudWatchAgentAdminPolicy'
      RoleName: DS_CW_AGENT_ROLE
  EC2CWInstanceProfile:
    Type: 'AWS::IAM::InstanceProfile'
    Properties:
      InstanceProfileName: EC2CWInstanceProfile
      Roles:
        - !Ref CWIAMRole
  S3VPCEndpoint:
    Type: 'AWS::EC2::VPCEndpoint'
    Properties:
      RouteTableIds:
        - 'rtb-031f3057458433643'
      ServiceName: com.amazonaws.ap-southeast-1.s3
      VpcId: vpc-02e91d5d082e3a097

Answer 1

遗憾的是，您无法轻松做到这一点。原因是实例资源没有 return 其根卷的 ID。

此外，您无法创建 独立的AWS::EC2::Volume 资源并将其用作实例中的根卷。这仅适用于额外的卷。

获取根设备卷 ID 的唯一方法是开发 custom resource。这将采用 lambda 函数 的形式，它将获取实例 ID，并使用 AWS SDK 查找卷 ID 和 return 以形成云。使用该卷 ID，您可以创建 CloudWatch 事件规则。

使用 Cloudformation 为 EBS 快照创建 Cloudwatch 事件

Create Cloudwatch Event for EBS Snapshot using Cloudformation

amazon-ebs

amazon-web-services

amazon-cloudformation

amazon-cloudwatch

amazon-cloudwatch-events