Appendix H: Creating tasks with custom resources - Ops Automator

Appendix H: Creating tasks with custom resources

Ops Automator features a custom resource you can use to create templates that include multiple tasks to help implement full end-to-end scenarios. The solution includes example templates in the TaskConfiguration/ScenarioTemplates folder.

First, create the custom resource.

  1. In the resource section, create a custom resource with a type of Custom::TaskConfig.

  2. Set the service token to the Amazon Resource Name (ARN) of the Ops Automator standard AWS Lambda function: arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function<ops-automator-stackname>-OpsAutomatorStandard.

Then, generate an AWS CloudFormation resource snippet.

  1. In the TaskConfiguration/ScenarioTemplates folder, use an action template to create a task.

  2. After the task has been created, download the BuildTaskCustomResource.py script from the TaskConfiguration/Scripts folder.

    Note

    You must have Python and boto3 installed, and you must have a profile that is allowed to read from the Ops Automator configuration table.

  3. At a command prompt, run the following command:

    python BuildTaskCustomResource.py <task name> <optional profile name>

An AWS CloudFormation snippet for the custom resource is created and written to the standard output. You can modify the snippet and include it in your custom templates. Note that the snippet gives the same name as the name of the task that was used to generate it. You must change the name of the snippet or delete the task stack you used to create the snippet to allow the custom resource to successfully create tasks.

We strongly recommend that you use the AWS CloudFormation template and user interface to set the required properties for a task. Then, use the included helper script to create a custom snippet to use in your custom templates.

The following table contains a list of properties you can use in custom resources.

Property Type and example value Description
Accounts

List of strings

“777788889999”, “000000000000”

A list of account roles used by the task.
Action String The name of the action.
Debug

Boolean

True | False

Choose whether to enable detailed logging.
Description String The task description.
Enabled

Boolean

True | False

Choose whether to enable the task.
Event scope

Dictionary with event structure source/detail/event. Scope values are region | resource.

The dictionary below shows the structure with all supported events use scopes. Currently, Ec2SetTags supports this parameter.

source: "aws.ec2" detail: "EC2 Instance State-change Notification" events: "started", "stopped", "terminated"

For example:

{ "aws.ec2": { "EC2 Instance State-change Notification": { "started": "region", "stopped": "region", "terminated": "region } } }
Scope for selecting resources for tasks triggered by an event. The default value is resource. This property is only stored in the configuration database, if it is set to region.
Source event tag filter String If Event scope is set to region, this property is used to filter the events that trigger the action using the tags on the resource that is the source of the event. Review Appendix A to determine which actions support this property.
Events

Dictionary containing the events structure source/detail/list of events

source: "aws.ec2" detail: "EBS Snapshot Notification" events: "copySnapshot","createSnapshot", "shareSnapshot" detail: "EC2 Instance State-change Notification events: "terminated", "running","stopped" source: "ec2.aws.tag" detail: "TagChangeOnResource" events: "ChangedInstanceTags", "ChangedSnapshotTags"

For example:

{ "aws.ec2": { "EC2 Instance State-change Notification": [ "running", "stopped"] } }
The events that trigger the task.
Interval String The scheduled expression (cron syntax) that specifies when to run the task.
Parameters Dictionary Action-specific parameters. The dictionary contains the parameters as parameter-name:parameter-value pairs.
Regions

List of strings

"eu-west-1", "eu-central-1"

List of Regions where the task will run.
Tag filter String Expression used to select resources for the action.
Completion size

String

Standard | Medium | Large | XLarge | XXLarge | XXXLarge

The size of the Lambda function used for completion checking for the action.
Cross-account role name String Custom role name used for cross-account action execution.
Execute size

String

Standard | Medium | Large | XLarge | XXLarge | XXXLarge

The size of the Lambda function used for action execution.
Task metrics

Boolean

True | False

Choose whether to collect CloudWatch metrics for the task.
Name String Unique name of the task.
Task notifications

Boolean

True | False

Choose whether to send notifications for started/ended task executions to an Amazon SNS topic.
Select size

String

Standard | Medium | Large | XLarge | XXLarge | XXXLarge

The size of the Lambda function used for resource selection.
Task timeout

String

60

The time, in minutes, the solution waits for a task to complete before reporting timing out.
This account

Boolean

True | False

Choose whether to run the task on resources in this account.
Timezone String The time zone used for scheduling tasks.

You can use the following helper script to create a custom snippet for your custom templates.

{ "Properties": { "Accounts": [ "000000000000","111111111111" ], "Action": "Ec2CreateSnapshot", "CompletionSize": "Medium", "Debug": "True", "Enabled": "True", "Events": {}, "ExecuteSize": "Medium", "Interval": "0 ) * ** ?", "Name": " create-snapshot", "Parameters": { "BackupDataVolumes": "True", "BackupRootVolumes": "True", "CreateVolumePermission": [ "2222222222222" ], "InstanceTags": "last-snapshots={snapshot-ids}", "SetSnapshotName": "True", "SnapshotDescription": "Snapshot for volume {volume-id}", "SnapshotName": "{instance-id}-{volume-id}-{datetime}", "TagSharedSnapshots": "True", "VolumeTagFilter": null, "VolumeTags": "last-snapshot={snapshot-id}" }, "Regions": [ "eu-west-1" ], "SelectSize": "Medium", "ServiceToken": "arn:aws:lambda:eu-west-1:ACCOUNT-NR:function:STACKNAME-OpsAutomator-Standard", "TaskMetrics": "True", "TaskNotifications": "False", "TaskTimeout": "30", "ThisAccount": "False", "Timezone": "UTC" }, "Type": "Custom::TaskConfig" }

The following custom resource snippet creates a task is triggered by a create-snapshot event. The task deletes snapshots and retains the last three snapshots.

{ "Properties": { "Accounts": [ "000000000000" ], "Action": "Ec2DeleteSnapshot", "CompletionSize": "Medium", "Debug": "True", "Description": "Deletes snapshots, keeps latest 3", "Enabled": "True", "Events": { "aws.ec2": { "EBS Snapshot Notification": [ "createSnapShotForVolume" ] } }, "ExecuteSize": "Medium", "Name": "delete-snapshot-3 ", "Parameters": { "RetentionCount": "3", "RetentionDays": "0" }, "Regions": [ "eu-west-1" ], "SelectSize": "Medium", "ServiceToken": "arn:aws:lambda:eu-west-1:ACCOUNT_NUM:function:STACK-OpsAutomator-Standard", "TaskMetrics": "True", "TaskNotifications": "False", "ThisAccount": "False" }, "Type": "Custom::TaskConfig" }