AWSSupport-StartEC2RescueWorkflow

Description

AWSSupport-StartEC2RescueWorkflow Runbook 會在為修復執行個體而建立的協助程式執行個體上執行提供的 base64 編碼指令碼 (Bash 或 Powershell)。執行個體的根磁碟區會連接並掛載至協助程式執行個體，也稱為 EC2Rescue 執行個體。如果您的執行個體是 Windows，請提供 Powershell 指令碼。否則，請使用 Bash。Runbook 會設定一些可在指令碼中使用的環境變數。環境變數包含您提供之輸入的資訊，以及離線根磁碟區的資訊。離線磁碟區已掛載並可使用。例如，您可以將 Desired State Configuration 檔案儲存至離線的 Windows 根磁碟區，或者 chroot 至離線的 Linux 根磁碟區並執行離線修復。

執行此自動化 （主控台）

其他資訊

若要將指令碼以 base64 編碼，您可以使用 Powershell 或 Bash。Powershell：

[System.Convert]::ToBase64String([System.Text.Encoding]::ASCII.GetBytes([System.IO.File]::ReadAllText('PATH_TO_FILE')))

Bash：

base64 PATH_TO_FILE

以下為您可在離線指令碼中使用的環境變數清單 (取決於目標作業系統)

Windows：

Linux︰

文件類型

 自動化

擁有者

Amazon

平台

Linux、macOS、 Windows

參數

必要的 IAM 許可

AutomationAssumeRole 參數需要下列動作才能成功使用 Runbook。

建議執行自動化的使用者連接 AmazonSSMAutomationRole (AmazonSSMAutomationRole) IAM 受管政策。除了該政策，使用者必須擁有：

{
                "Version": "2012-10-17",
                "Statement": [
                   {
                      "Action": [
                         "lambda:InvokeFunction",
                         "lambda:DeleteFunction",
                         "lambda:GetFunction"
                      ],
                      "Resource": "arn:aws:lambda:*:An-AWS-Account-ID:function:AWSSupport-EC2Rescue-*",
                      "Effect": "Allow"
                   },
                   {
                      "Action": [
                         "s3:GetObject",
                         "s3:GetObjectVersion"
                      ],
                      "Resource": [
                         "arn:aws:s3:::awssupport-ssm.*/*.template",
                         "arn:aws:s3:::awssupport-ssm.*/*.zip"
                      ],
                      "Effect": "Allow"
                   },
                   {
                      "Action": [
                         "iam:CreateRole",
                         "iam:CreateInstanceProfile",
                         "iam:GetRole",
                         "iam:GetInstanceProfile",
                         "iam:PutRolePolicy",
                         "iam:DetachRolePolicy",
                         "iam:AttachRolePolicy",
                         "iam:PassRole",
                         "iam:AddRoleToInstanceProfile",
                         "iam:RemoveRoleFromInstanceProfile",
                         "iam:DeleteRole",
                         "iam:DeleteRolePolicy",
                         "iam:DeleteInstanceProfile"
                      ],
                      "Resource": [
                         "arn:aws:iam::An-AWS-Account-ID:role/AWSSupport-EC2Rescue-*",
                         "arn:aws:iam::An-AWS-Account-ID:instance-profile/AWSSupport-EC2Rescue-*"
                      ],
                      "Effect": "Allow"
                   },
                   {
                      "Action": [
                         "lambda:CreateFunction",
                         "ec2:CreateVpc",
                         "ec2:ModifyVpcAttribute",
                         "ec2:DeleteVpc",
                         "ec2:CreateInternetGateway",
                         "ec2:AttachInternetGateway",
                         "ec2:DetachInternetGateway",
                         "ec2:DeleteInternetGateway",
                         "ec2:CreateSubnet",
                         "ec2:DeleteSubnet",
                         "ec2:CreateRoute",
                         "ec2:DeleteRoute",
                         "ec2:CreateRouteTable",
                         "ec2:AssociateRouteTable",
                         "ec2:DisassociateRouteTable",
                         "ec2:DeleteRouteTable",
                         "ec2:CreateVpcEndpoint",
                         "ec2:DeleteVpcEndpoints",
                         "ec2:ModifyVpcEndpoint",
                         "ec2:Describe*"
                      ],
                      "Resource": "*",
                      "Effect": "Allow"
                   }
                ]
             }

文件步驟

輸出

runScriptForLinux.Output

runScriptForWindows.Output

preScriptBackup.ImageId

postScriptBackup.ImageId