1
0

Delete article

Deleted articles cannot be recovered.

Draft of this article would be also deleted.

Are you sure you want to delete this article?

More than 1 year has passed since last update.

SSM AutomationでRDS Clusterの自動停止起動設定(Cloudformation)

Last updated at Posted at 2021-07-01

はじめに

普段、私はCDKでCloudformationを作成します。
今回はCDKでEventBridgeのターゲットにSSM Automationを設定することがL2 Constructではできなかったため一部を手動で設定してCloudformationを作成しました。
そのためスケジューラの部分などパラメータ化されていない部分もありますので、ご了承ください。
構成としてはCloudwatchスケジューラにSSM AutomationとRDSクラスタの実行権限を付与し、AWSが提供しているRDSクラスタの自動起動停止用のドキュメントをスケジュールで実行しています。

前提

  • RDSクラスタが作成されていること
  • Cloudformationの実行権限があること

2021-07-01_09h27_39.png

Cloudformation

全体はこちらです。

{
  "Parameters": {
    "RDSCluster1": {
      "Type": "String",
      "Description": "RDSCluster1",
      "Default": "test-cluster"
    }
  },
  "Resources": {
    "rdsautomationrole": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Statement": [
            {
              "Action": "sts:AssumeRole",
              "Effect": "Allow",
              "Principal": {
                "Service": "events.amazonaws.com"
              }
            }
          ],
          "Version": "2012-10-17"
        },
        "ManagedPolicyArns": [
          {
            "Fn::Join": [
              "",
              [
                "arn:",
                {
                  "Ref": "AWS::Partition"
                },
                ":iam::aws:policy/service-role/AmazonSSMAutomationRole"
              ]
            ]
          }
        ],
        "RoleName": "rds_automation_role"
      }
    },
    "rdsautomationroleDefaultPolicy": {
      "Type": "AWS::IAM::Policy",
      "Properties": {
        "PolicyDocument": {
          "Statement": [
            {
              "Action": [
                "rds:DescribeDBInstances",
                "rds:DescribeDBClusters",
                "rds:StartDBCluster",
                "rds:StopDBCluster"
              ],
              "Effect": "Allow",
              "Resource": "*"
            }
          ],
          "Version": "2012-10-17"
        },
        "PolicyName": "rdsautomationroleDefaultPolicy",
        "Roles": [
          {
            "Ref": "rdsautomationrole"
          }
        ]
      }
    },
    "RDSStartSceduleRule": {
      "Type": "AWS::Events::Rule",
      "Properties": {
        "Name": "rds_start_schedule_rule",
        "ScheduleExpression": "cron(00 23 ? * SUN-THU *)",
        "State": "ENABLED",
        "Targets": [
          {
            "Arn": "arn:aws:ssm:ap-northeast-1::automation-definition/AWS-StartStopAuroraCluster:$DEFAULT",
            "Id": "TargetStartAuroraCluster1",
            "RoleArn": {
              "Fn::Sub":"${rdsautomationrole.Arn}"
            },
            "Input": {
              "Fn::Sub": "{\"Action\":[\"Start\"],\"ClusterName\":[\"${RDSCluster1}\"]}"
            }
          }
        ]
      }
    },
    "RDSStopSceduleRule": {
      "Type": "AWS::Events::Rule",
      "Properties": {
        "Name": "rds_stop_schedule_rule",
        "ScheduleExpression": "cron(00 15 * * ? *)",
        "State": "ENABLED",
        "Targets":  [
          {
            "Arn": "arn:aws:ssm:ap-northeast-1::automation-definition/AWS-StartStopAuroraCluster:$DEFAULT",
            "Id": "TargetStopAuroraCluster1",
            "RoleArn": {
              "Fn::Sub":"${rdsautomationrole.Arn}"
            },
            "Input": {
              "Fn::Sub": "{\"Action\":[\"Stop\"],\"ClusterName\":[\"${RDSCluster1}\"]}"
            }
          }
        ]
      }
    }
  }
}

RDSクラスタ名をパラメータ化しています。

{
  "Parameters": {
    "RDSCluster1": {
      "Type": "String",
      "Description": "RDSCluster1",
      "Default": "test-cluster"
    }
  },

EventBridgeが実行する権限を定義します。

"Resources": {
    "rdsautomationrole": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Statement": [
            {
              "Action": "sts:AssumeRole",
              "Effect": "Allow",
              "Principal": {
                "Service": "events.amazonaws.com"
              }
            }
          ],
          "Version": "2012-10-17"
        },
        "ManagedPolicyArns": [
          {
            "Fn::Join": [
              "",
              [
                "arn:",
                {
                  "Ref": "AWS::Partition"
                },
                ":iam::aws:policy/service-role/AmazonSSMAutomationRole"
              ]
            ]
          }
        ],
        "RoleName": "rds_automation_role"
      }
    },
    "rdsautomationroleDefaultPolicy": {
      "Type": "AWS::IAM::Policy",
      "Properties": {
        "PolicyDocument": {
          "Statement": [
            {
              "Action": [
                "rds:DescribeDBInstances",
                "rds:DescribeDBClusters",
                "rds:StartDBCluster",
                "rds:StopDBCluster"
              ],
              "Effect": "Allow",
              "Resource": "*"
            }
          ],
          "Version": "2012-10-17"
        },
        "PolicyName": "rdsautomationroleDefaultPolicy",
        "Roles": [
          {
            "Ref": "rdsautomationrole"
          }
        ]
      }
    },

起動設定と停止設定をそれぞれ定義します。

"RDSStartSceduleRule": {
      "Type": "AWS::Events::Rule",
      "Properties": {
        "Name": "rds_start_schedule_rule",
        "ScheduleExpression": "cron(00 23 ? * SUN-THU *)",
        "State": "ENABLED",
        "Targets": [
          {
            "Arn": "arn:aws:ssm:ap-northeast-1::automation-definition/AWS-StartStopAuroraCluster:$DEFAULT",
            "Id": "TargetStartAuroraCluster1",
            "RoleArn": {
              "Fn::Sub":"${rdsautomationrole.Arn}"
            },
            "Input": {
              "Fn::Sub": "{\"Action\":[\"Start\"],\"ClusterName\":[\"${RDSCluster1}\"]}"
            }
          }
        ]
      }
    },
    "RDSStopSceduleRule": {
      "Type": "AWS::Events::Rule",
      "Properties": {
        "Name": "rds_stop_schedule_rule",
        "ScheduleExpression": "cron(00 15 * * ? *)",
        "State": "ENABLED",
        "Targets":  [
          {
            "Arn": "arn:aws:ssm:ap-northeast-1::automation-definition/AWS-StartStopAuroraCluster:$DEFAULT",
            "Id": "TargetStopAuroraCluster1",
            "RoleArn": {
              "Fn::Sub":"${rdsautomationrole.Arn}"
            },
            "Input": {
              "Fn::Sub": "{\"Action\":[\"Stop\"],\"ClusterName\":[\"${RDSCluster1}\"]}"
            }
          }
        ]
      }
    }
  }
}

構築したサービス

  • EventBridge(旧Cloudwatch Schedule)
    実際に構築されるものはEventBridgeだけです。

2021-07-01_09h27_22.png

詳細は編集で確認できます。
2021-07-01_23h47_12.png
2021-07-01_23h47_27.png

yaml ver

Parameters:
  RDSCluster1:
    Type: String
    Description: RDSCluster1
    Default: test-cluster
Resources:
  rdsautomationrole:
    Type: 'AWS::IAM::Role'
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action: 'sts:AssumeRole'
            Effect: Allow
            Principal:
              Service: events.amazonaws.com
        Version: 2012-10-17
      ManagedPolicyArns:
        - !Join 
          - ''
          - - 'arn:'
            - !Ref 'AWS::Partition'
            - ':iam::aws:policy/service-role/AmazonSSMAutomationRole'
      RoleName: rds_automation_role
  rdsautomationroleDefaultPolicy:
    Type: 'AWS::IAM::Policy'
    Properties:
      PolicyDocument:
        Statement:
          - Action:
              - 'rds:DescribeDBInstances'
              - 'rds:DescribeDBClusters'
              - 'rds:StartDBCluster'
              - 'rds:StopDBCluster'
            Effect: Allow
            Resource: '*'
        Version: 2012-10-17
      PolicyName: rdsautomationroleDefaultPolicy
      Roles:
        - !Ref rdsautomationrole
  RDSStartSceduleRule:
    Type: 'AWS::Events::Rule'
    Properties:
      Name: rds_start_schedule_rule
      ScheduleExpression: cron(00 23 ? * SUN-THU *)
      State: ENABLED
      Targets:
        - Arn: >-
            arn:aws:ssm:ap-northeast-1::automation-definition/AWS-StartStopAuroraCluster:$DEFAULT
          Id: TargetStartAuroraCluster1
          RoleArn: !Sub '${rdsautomationrole.Arn}'
          Input: !Sub '{"Action":["Start"],"ClusterName":["${RDSCluster1}"]}'
  RDSStopSceduleRule:
    Type: 'AWS::Events::Rule'
    Properties:
      Name: rds_stop_schedule_rule
      ScheduleExpression: cron(00 15 * * ? *)
      State: ENABLED
      Targets:
        - Arn: >-
            arn:aws:ssm:ap-northeast-1::automation-definition/AWS-StartStopAuroraCluster:$DEFAULT
          Id: TargetStopAuroraCluster1
          RoleArn: !Sub '${rdsautomationrole.Arn}'
          Input: !Sub '{"Action":["Stop"],"ClusterName":["${RDSCluster1}"]}'

1
0
0

Register as a new user and use Qiita more conveniently

  1. You get articles that match your needs
  2. You can efficiently read back useful information
  3. You can use dark theme
What you can do with signing up
1
0

Delete article

Deleted articles cannot be recovered.

Draft of this article would be also deleted.

Are you sure you want to delete this article?