Automating snapshots of EC2 instances every 24 hours

Question

Pulumi · Accepted Answer

Automating the creation of snapshots for Amazon EC2 instances is an essential task for ensuring the durability and availability of your data. This process can be automated using Pulumi's AWS provider. The approach involves creating an Amazon CloudWatch event rule that triggers an AWS Lambda function to create the snapshots on a schedule.

Here's how to set this up step by step:

1. **Create an AWS Lambda Function**: This function will be responsible for creating EC2 snapshots. AWS Lambda allows you to run code in response to triggers such as an incoming request or a scheduled event without provisioning or managing servers.

2. **Schedule a CloudWatch Event Rule**: Amazon CloudWatch Events delivers a near real-time stream of system events that describe changes in AWS resources. We'll use CloudWatch to trigger our Lambda function every 24 hours.

3. **Assign Necessary IAM Roles and Policies**: To allow the Lambda function to create snapshots, it will need the appropriate permissions. AWS Identity and Access Management (IAM) roles will grant our Lambda function the necessary permissions to create snapshots of EC2 instances.

4. **Create the Snapshot with the Lambda Function**: When triggered by the CloudWatch event, the Lambda function will create a snapshot of the specified EC2 instance.

Now, let's write the Pulumi program in TypeScript that expresses these resources and their relationships:

```typescript
import * as aws from "@pulumi/aws";

const snapshotRole = new aws.iam.Role("snapshotRole", {
    assumeRolePolicy: aws.iam.assumeRolePolicyForPrincipal({ Service: "lambda.amazonaws.com" }),
});

new aws.iam.RolePolicyAttachment("lambdaPolicyAttachment", {
    policyArn: aws.iam.ManagedPolicy.AWSLambdaExecute,
    role: snapshotRole,
});

new aws.iam.RolePolicyAttachment("ec2SnapshotPolicy", {
    policyArn: "arn:aws:iam::aws:policy/AmazonEC2FullAccess",
    role: snapshotRole,
});

const snapshotLambda = new aws.lambda.Function("snapshotLambda", {
    code: new pulumi.asset.AssetArchive({ /* ... */ }), // Your Lambda Function code archive
    handler: "index.handler",
    role: snapshotRole.arn,
    runtime: aws.lambda.NodeJS12dXRuntime,
});

const snapshotRule = new aws.cloudwatch.EventRule("snapshotRule", {
    scheduleExpression: "rate(24 hours)",
});

new aws.cloudwatch.EventTarget("snapshotRuleTarget", {
    rule: snapshotRule.name,
    arn: snapshotLambda.arn,
});

new aws.lambda.Permission("snapshotLambdaPermission", {
    action: "lambda:InvokeFunction",
    function: snapshotLambda,
    principal: "events.amazonaws.com",
    sourceArn: snapshotRule.arn,
});
```

In this program:
- We first create an IAM role (`snapshotRole`) which the Lambda function will assume. This role has a trust relationship policy that allows Lambda functions to assume the role.
- Then, we attach two policies to the `snapshotRole`: one for basic Lambda execution permissions (`AWSLambdaExecute`) and another to provide full access to EC2 operations (`AmazonEC2FullAccess`).
- We define the Lambda function itself (`snapshotLambda`), specifying the code, handler, role, and runtime. The code for the Lambda function needs to be provided as a ZIP archive, and the handler is the entry point in your code (e.g., `index.handler` refers to the `handler` function in `index.js`).
- We set up a CloudWatch Event Rule (`snapshotRule`) to trigger the Lambda function every 24 hours using a `scheduleExpression`.
- We create a `EventTarget` that connects the `snapshotRule` with our `snapshotLambda` function.
- Finally, we grant CloudWatch Events permission to invoke the Lambda function through a Lambda permission resource (`snapshotLambdaPermission`).

You would need to replace the placeholder comment `/* ... */` with your actual Lambda function code archive. The Lambda function code should include the logic to identify the EC2 instances and create snapshots accordingly.

Remember to replace `yourEc2InstanceIdHere` with the actual instance ID you intend to take snapshots of. Also, note that this code does not include error handling or the actual Lambda function's content; you'd need to fill in those details according to the specific logic you want to achieve within the function.