Lambdaを使うのもカスタムリソースを作成するのもはじめてなので、練習も含めてAMIを作成するカスタムリソースを作成してみた。
つくるもの
- InstanceIDをパラメータとして、AMIを作成してAMI IDをリターンするカスタムリソース
- CloudFormationのRequestTypeに応じて、挙動を変える
- Create: AMIの作成
- Update: 以前のAMIを削除して、新しく作成
- Delete: 以前のAMIを削除
- Optionで削除をしなくできるようにする
使い方イメージ
以下のようなリソースをCloudFormationに入れる感じにしたい。
"InstanceImage" : {
"Type" : "Custom::CreateImage",
"Properties" : {
"ServiceToken" : { "Fn::GetAtt" : [ "CreateImageLambdaFunction", "Arn" ] },
"InstanceId" : { "Ref" : "Instance" }, <-- InstanceIDをパラメータに
"DeletionPolicy" : "Retain" <-- Optionで削除しないように
}
}
完成コード
node.jsで開発。CloudFormationテンプレートの中で埋め込みしたかったので、外部ライブラリは使わなかった。
node.js
var AWS = require('aws-sdk'),
response = require('cfn-response'),
domain = require('domain');
exports.handler = function(event, context) {
var requestType = event.RequestType,
resourceId = event.PhysicalResourceId,
instanceId = event.ResourceProperties.InstanceId,
deletionPolicy = event.ResourceProperties.DeletionPolicy,
ec2 = new AWS.EC2(),
d = domain.create();
d.on('error', function (err) {
console.error(err, err.stack);
return response.send(event, context, response.FAILED);
});
var succeed = function (imageId) {
response.send(event, context, response.SUCCESS, { ImageId: imageId }, imageId);
};
var createImage = function (instanceId, callback) {
ec2.describeInstances({
InstanceIds: [ instanceId ]
}, d.intercept(function (data) {
var instance = data.Reservations[0].Instances[0];
var instanceName = instance.Tags.filter(function (tag) {
return tag.Key == 'Name'
})[0].Value;
ec2.createImage({
InstanceId: instanceId,
Name: instanceName + '-' + Date.now(),
NoReboot: true
}, d.intercept(function (data) {
callback(data.ImageId);
}));
}));
};
var deleteSnapshots = function (snapshots, callback) {
if (snapshots.length === 0) {
return callback();
}
var snapshotId = snapshots.shift();
ec2.deleteSnapshot({
SnapshotId: snapshotId
}, d.intercept(function (data) {
deleteSnapshots(snapshots, callback);
}));
};
var deleteImage = function (imageId, callback) {
ec2.describeImages({
ImageIds: [ imageId ]
}, function (err, data) {
if (err) {
return callback();
}
var snapshots = data
.Images[0].BlockDeviceMappings
.map(function (blockDevice) { return blockDevice.Ebs })
.map(function (ebs) { return ebs.SnapshotId });
ec2.deregisterImage({
ImageId: imageId
}, d.intercept(function (data) {
deleteSnapshots(snapshots, callback);
}));
});
};
if (resourceId && deletionPolicy !== 'Retain') {
deleteImage(resourceId, function () {
if (requestType === 'Delete') {
return succeed(resourceId);
}
createImage(instanceId, succeed);
});
} else {
createImage(instanceId, succeed);
}
};
サンプル
インスタンス作ってついでにAMIも作成するCloudFormation。
{
"AWSTemplateFormatVersion": "2010-09-09",
"Description" : "Sample Template",
"Parameters" : {
"KeyName" : {
"Description" : "Name of an existing EC2 KeyPair to enable SSH access to the instances.",
"Type" : "AWS::EC2::KeyPair::KeyName",
"ConstraintDescription" : "can contain only alphanumeric characters, spaces, dashes and underscores."
},
"InstanceName" : {
"Description" : "Instance Name for node.",
"Type" : "String",
"AllowedPattern" : "[-a-zA-Z0-9]+"
},
"InstanceType" : {
"Description" : "Instance type for node.",
"Type" : "String",
"Default" : "t2.nano",
"AllowedValues" : [ "t2.nano", "t2.micro","t2.small","t2.medium","m3.medium","m3.large","m3.xlarge","m3.2xlarge","c3.large","c3.xlarge","c3.2xlarge","c3.4xlarge","c3.8xlarge" ],
"ConstraintDescription" : "must be a valid T2, M3 or C3 instance type."
},
"SecurityGroups" : {
"Description" : "SecurityGroups.",
"Type" : "List<AWS::EC2::SecurityGroup::Id>"
},
"Subnets": {
"Description" : "ID of your existing subnets.",
"Type" : "List<AWS::EC2::Subnet::Id>"
}
},
"Mappings": {
"AmazonAMI" : {
"ap-northeast-1" : { "AMI" : "ami-383c1956" }
}
},
"Resources" : {
"LambdaExecutionRole" : {
"Type" : "AWS::IAM::Role",
"Properties" : {
"AssumeRolePolicyDocument": {
"Version" : "2012-10-17",
"Statement": [{
"Effect" : "Allow",
"Principal" : { "Service" : [ "lambda.amazonaws.com" ] },
"Action" : [ "sts:AssumeRole" ]
}]
},
"Path" : "/",
"Policies" : [{
"PolicyName" : "root",
"PolicyDocument" : {
"Version" : "2012-10-17",
"Statement" : [{
"Effect" : "Allow",
"Action" : [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents" ],
"Resource" : "arn:aws:logs:*:*:*"
},
{
"Effect" : "Allow",
"Action" : [ "ec2:*" ],
"Resource" : "*"
}]
}
}]
}
},
"CreateImageLambdaFunction" : {
"Type" : "AWS::Lambda::Function",
"Properties" : {
"Code" : {
"ZipFile" : { "Fn::Join" : [ "\n", [
"var AWS = require('aws-sdk'),",
" response = require('cfn-response'),",
" domain = require('domain');",
"exports.handler = function(event, context) {",
" var requestType = event.RequestType,",
" resourceId = event.PhysicalResourceId,",
" instanceId = event.ResourceProperties.InstanceId,",
" deletionPolicy = event.ResourceProperties.DeletionPolicy,",
" ec2 = new AWS.EC2(),",
" d = domain.create();",
" d.on('error', function (err) {",
" console.error(err, err.stack);",
" return response.send(event, context, response.FAILED);",
" });",
" var succeed = function (imageId) {",
" response.send(event, context, response.SUCCESS, { ImageId: imageId }, imageId);",
" };",
" var createImage = function (instanceId, callback) {",
" ec2.describeInstances({",
" InstanceIds: [ instanceId ]",
" }, d.intercept(function (data) {",
" var instance = data.Reservations[0].Instances[0];",
" var instanceName = instance.Tags.filter(function (tag) {",
" return tag.Key == 'Name'",
" })[0].Value;",
" ec2.createImage({",
" InstanceId: instanceId,",
" Name: instanceName + '-' + Date.now(),",
" NoReboot: true",
" }, d.intercept(function (data) {",
" callback(data.ImageId);",
" }));",
" }));",
" };",
" var deleteSnapshots = function (snapshots, callback) {",
" if (snapshots.length === 0) {",
" return callback();",
" }",
" var snapshotId = snapshots.shift();",
" ec2.deleteSnapshot({",
" SnapshotId: snapshotId",
" }, d.intercept(function (data) {",
" deleteSnapshots(snapshots, callback);",
" }));",
" };",
" var deleteImage = function (imageId, callback) {",
" ec2.describeImages({",
" ImageIds: [ imageId ]",
" }, function (err, data) {",
" if (err) {",
" return callback();",
" }",
" var snapshots = data",
" .Images[0].BlockDeviceMappings",
" .map(function (blockDevice) { return blockDevice.Ebs })",
" .map(function (ebs) { return ebs.SnapshotId });",
" ec2.deregisterImage({",
" ImageId: imageId",
" }, d.intercept(function (data) {",
" deleteSnapshots(snapshots, callback);",
" }));",
" });",
" };",
" if (resourceId && deletionPolicy !== 'Retain') {",
" deleteImage(resourceId, function () {",
" if (requestType === 'Delete') {",
" return succeed(resourceId);",
" }",
" createImage(instanceId, succeed);",
" });",
" } else {",
" createImage(instanceId, succeed);",
" }",
"};"
]]}
},
"Handler" : "index.handler",
"Runtime" : "nodejs",
"Timeout" : "30",
"Role" : { "Fn::GetAtt" : [ "LambdaExecutionRole", "Arn" ] }
}
},
"Instance" : {
"Type" : "AWS::EC2::Instance",
"Properties" : {
"InstanceType" : { "Ref" : "InstanceType" },
"KeyName" : { "Ref" : "KeyName" },
"ImageId" : { "Fn::FindInMap" : [ "AmazonAMI", { "Ref" : "AWS::Region" }, "AMI"] },
"Tags": [
{ "Key" : "Name", "Value" : { "Ref" : "InstanceName" } }
],
"NetworkInterfaces": [ {
"AssociatePublicIpAddress" : true,
"DeviceIndex" : 0,
"SubnetId" : { "Fn::Select" : [ "0", { "Ref" : "Subnets" } ] },
"GroupSet" : { "Ref" : "SecurityGroups" }
} ],
"UserData" : { "Fn::Base64" : { "Fn::Join" : [ "", [
"#!/bin/bash\n",
"yum update -y\n",
"yum install -y nginx\n",
"/etc/init.d/nginx start\n",
"chkconfig nginx on\n",
"/opt/aws/bin/cfn-signal -e 0 --stack ", { "Ref": "AWS::StackName" },
" --resource Instance ",
" --region ", { "Ref" : "AWS::Region" }, "\n"
]]}}
},
"CreationPolicy" : {
"ResourceSignal" : {
"Count" : 1,
"Timeout" : "PT10M"
}
}
},
"InstanceImage" : {
"Type" : "Custom::CreateImage",
"Properties" : {
"ServiceToken" : { "Fn::GetAtt" : [ "CreateImageLambdaFunction", "Arn" ] },
"InstanceId" : { "Ref" : "Instance" }
}
}
}
}