0

我正在尝试创建 cloudwatch 预定事件以拍摄我的 ebs 快照。我是 cloudformation 的新手，对它不太熟悉，这就是为什么要实现这一点很复杂。我正在附加我当前的模板，该模板生成我的 ec2 实例并将默认卷从 10gb 覆盖到 20gb。我想在完全相同的已创建卷上创建一个 cloudwatch 事件，以获取从该模板创建的该卷的快照。如果有人可以帮助我使用 cloudformation 语法设置目标事件，我会很高兴。

Parameters:
  KeyName:
    Description: The EC2 Key Pair to allow SSH access to the instance
    Type: 'AWS::EC2::KeyPair::KeyName'
Resources:
  Ec2Instance:
    Type: 'AWS::EC2::Instance'
    DependsOn:
      - InstanceSecurityGroup
      - CWIAMRole
      - EC2CWInstanceProfile
    Properties:
      KeyName: !Ref KeyName
      ImageId: ami-057a963e8be173b19
      InstanceType: t3a.micro
      IamInstanceProfile: !Ref EC2CWInstanceProfile
      NetworkInterfaces:
        - AssociatePublicIpAddress: 'True'
          DeleteOnTermination: 'True'
          DeviceIndex: '0'
          # Add subnet id below
          SubnetId: subnet-031c6fb8172d780aa
          GroupSet:
            - !Ref InstanceSecurityGroup
      BlockDeviceMappings:
        - DeviceName: /dev/xvda
          Ebs:
            VolumeType: gp2
            DeleteOnTermination: 'true'
            VolumeSize: '20'
  LambdaSecurityGroup:
    Type: 'AWS::EC2::SecurityGroup'
    Properties:
      GroupDescription: Enable SSH access via port 22
      # Add you vpc id below
      VpcId: vpc-02e91d5d082e3a097
      GroupName: DS Lambda Security Group
  InstanceSecurityGroup:
    Type: 'AWS::EC2::SecurityGroup'
    DependsOn:
      - LambdaSecurityGroup
    Properties:
      GroupDescription: Enable SSH access via port 22
      # Add you vpc id below
      VpcId: vpc-02e91d5d082e3a097
      GroupName: DS DB Instance Security Group
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: '22'
          ToPort: '22'
          # Add vpn ip below for e.g 192.168.78.2/32
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: '5432'
          ToPort: '5432'
          SourceSecurityGroupId: !Ref LambdaSecurityGroup
  CWIAMRole:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      ManagedPolicyArns:
        - 'arn:aws:iam::aws:policy/CloudWatchAgentAdminPolicy'
      RoleName: DS_CW_AGENT_ROLE
  EC2CWInstanceProfile:
    Type: 'AWS::IAM::InstanceProfile'
    Properties:
      InstanceProfileName: EC2CWInstanceProfile
      Roles:
        - !Ref CWIAMRole
  S3VPCEndpoint:
    Type: 'AWS::EC2::VPCEndpoint'
    Properties:
      RouteTableIds:
        - 'rtb-031f3057458433643'
      ServiceName: com.amazonaws.ap-southeast-1.s3
      VpcId: vpc-02e91d5d082e3a097
4

1 回答 1

1

可悲的是，你不能轻易做到这一点。原因是 Instance 资源没有返回其根卷的 id。

此外，您无法创建独立AWS::EC2::Volume资源并将其用作实例中的根卷。这仅适用于附加卷。

获取根设备的卷 ID 的唯一方法是开发自定义资源。这将采用lambda 函数的形式，它将获取实例 ID，并使用 AWS SDK 查找卷 ID 并返回云形成。使用该卷 ID，您可以创建 CloudWatch 事件规则。

于 2020-08-08T02:38:17.150 回答