[AWS] EC2 태깅 Lambda를 ServerlessFramework로 구현했습니다.

TL;DR

1. Lambda 함수 준비

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
import boto3
import logging
import os

# set the simple logging
logger = logging.getLogger()
logger.setLevel(logging.INFO)
region = os.environ['AWS_REGION']
account = os.environ['AWS_ACCOUNT']


def ec2_tagging(event, context):
    logger.info(event)

# Requestor Check
    userType = event['detail']['userIdentity']['type']
    if userType == 'IAMUser':
        Owner = event['detail']['userIdentity']['userName']
    elif userType == 'AssumedRole':
        roleID = event['detail']['userIdentity']['sessionContext']['sessionIssuer']['userName']
        Owner = (event['detail']['userIdentity']['arn'].replace("arn:aws:sts::" + str(account) + ":assumed-role/"+str(roleID)+"/", ""))
    logger.info("Owner: " + Owner)

# Target Resource Check
    instanceIDs = event['detail']['responseElements']['instancesSet']['items']
    logger.info(instanceIDs)
    instance_count = len(instanceIDs)
    try:
        for i in range(0, instance_count):
            instanceID = instanceIDs[i]['instanceId']
            logger.info("target: " + str(instanceID))
            ec2 = boto3.client('ec2')
            r = ec2.create_tags(
                Resources=[instanceID],
                Tags=[
                   {
                        'Key': 'Owner',
                        'Value': Owner
                    },
                ]
            )
    except Exception as e:
        logger.error("error: " + str(e))

2. Lambda 실행을 위한 IAM Role 생성

  {
      "Version": "2012-10-17",
      "Statement": [
          {
              "Action": [
                  "logs:CreateLogStream",
                  "logs:PutLogEvents"
              ],
              "Resource": [
                  "arn:aws:logs:*"
              ],
              "Effect": "Allow"
          },
          {
              "Action": [
                  "ec2:CreateTags"
              ],
              "Resource": [
                  "*"
              ],
              "Effect": "Allow"
          }
      ]
  }

3. serverless.yml 만들기

service: ${self:custom.service}

provider:
  name: aws
  runtime: python3.6
  stage: ${opt:stage, self:custom.defaultStage}
  region: ${opt:region, self:custom.defaultRegion}
  memorySize: 128
  timeout: 60
  role: arn:aws:iam::${self:custom.account}:role/${self:custom.iam}
  environment:
    AWS_ACCOUNT: ${self:custom.account}

custom:
  account: hoge        ## AWS AccountIDを入力してください。
  defaultStage: dev
  defaultRegion: fuga  ## Regionを入力してください。(e.g.ap-northeast-1)
  description: EC2 Auto Tagging Function
  service: Ec2AutoTag
  iam: piyo            ## Lambdaを実行するIAM Role名を入力してください。

functions:
  Ec2AutoTag:
    name: ${self:custom.service}
    handler: handler.ec2_tagging
    description: ${self:custom.description}
    events:
      - cloudwatchEvent:
          event:
            source:
              - "aws.ec2"
            detail-type:
              - "AWS API Call via CloudTrail"
            detail:
              eventSource:
                - "ec2.amazonaws.com"
              eventName:
                - "RunInstances"

4. deploy

$ ls -l
total 8
-rw-rw-r-- 1 ubuntu ubuntu 1453 Aug 29 02:56 handler.py
-rw-rw-r-- 1 ubuntu ubuntu 1012 Aug 29 03:00 serverless.yml
$
$ sls deploy
Serverless: Packaging service...
Serverless: Excluding development dependencies...
Serverless: Creating Stack...
Serverless: Checking Stack create progress...
.....
Serverless: Stack create finished...
Serverless: Uploading CloudFormation file to S3...
Serverless: Uploading artifacts...
Serverless: Uploading service .zip file to S3 (774 B)...
Serverless: Validating template...
Serverless: Updating Stack...
Serverless: Checking Stack update progress...
...................
Serverless: Stack update finished...
Service Information
service: Ec2AutoTag
stage: dev
region: ap-northeast-1
stack: Ec2AutoTag-dev
api keys:
  None
endpoints:
  None
functions:
  Ec2AutoTag: Ec2AutoTag-dev-Ec2AutoTag

5. 확인

6. 마지막으로

StackSet을 지원하면 멀티 리전에 한 번에 배포 할 수 있으며,
보다 편리하게 사용할 수 있을 것 같다. (앞으로 조사 )

참고