Amazon web services 如果EC2中有任何实例未在安全组下运行，是否可以发出警报？

基本上，如果我的一个安全组中有3个实例在运行，那么如果突然，3个实例中有一个没有响应，那么我需要发送cloudWatch警报。可能吗？如果没有，则任何替代解决方案都将不胜感激。

我希望能够设置cloudwatch警报，以监控某个安全组的实例正在运行的数量，如果该安全组正在运行的实例数量低于某个数量，则应发出警报。

如果可能，这是一个理想的情况，我建议创建自动缩放组，然后创建CloudWatch报警，甚至可能创建自动缩放操作，自动执行您想要的操作，而不必让人响应事件

如果这不起作用，是的，您总是可以在特定EC2实例上创建CloudWatch警报，以监视

StatusCheckFailed

或类似的情况

这与安全组无关。

此方法使用以下服务

• • 创建一个具有发布SNS消息和通过Cloudwatch日志记录权限的

创建一个 创建一个SNS主题，并向接收者订阅Lambda函数的未来通知。让我们调用

MyTopic

使用以下策略创建一个 让我们称之为

DummyRole

（此角色的名称由您决定）。 此角色将附加到新的Lambda函数，以授予发布、记录和描述EC2实例的权限

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "logs:CreateLogGroup",
            "Resource": "arn:aws:logs:us-east-1:450338205852:*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "logs:CreateLogStream",
                "logs:PutLogEvents"
            ],
            "Resource": [
                "arn:aws:logs:us-east-1:450338205852:log-group:/aws/lambda/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "sns:Publish"
            ],
            "Resource": [
                "arn:aws:sns:us-east-1:450338205852:MyTopic"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeInstances"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}

将

accountId

替换为当前帐户

创建一个新的Lambda函数

• 此新Lambda函数的名称由您决定，例如，名称为

  InstancesInSG

  ，让我们附加IAM角色

  DummyRole

  。此Lambda函数的实现，以获取具有安全组的实例并发送电子邮件，取决于您。在本例中，我只记录来自Cloudwatch的事件

Lambda函数节点示例

var AWS = require('aws-sdk');

"use strict";

//These constants must be declared in Environment variables.
const THRESHOLD = 5; // Lesser than this will notify to SNS topic.
const SECURITY_GROUPS = ['sg-11111']; //Only EC2 instances with this security group.
const TOPIC_ARN = "arn:aws:sns:us-east-1:AccountId:MyTopic";

exports.handler = (event, context, callback) => {
    var settings = { apiVersion: '2017-01-01', region: process.env.AWS_REGION };
    var ec2 = new AWS.EC2(settings);
    var params = {
        DryRun: false,
        MaxResults: THRESHOLD, // This value must be equals to the THRESHOLD.  The min value is 5.
        Filters: []
    };
            
    // You can use 'instance.group-name' to filter by security group's name.
    params.Filters = [
        {
            Name: 'instance.group-id',
            Values: SECURITY_GROUPS
        }, 
        {
            Name: 'instance-state-code',
            Values: ['16']
        }
    ];
    
    ec2.describeInstances(params, function(err, data) {
        if (err) {
            callback(err);
        } else {
            let count = 0;
            let reservations = data['Reservations'] || [];
            for (let i = 0; i < reservations.length; i++) {
                count += reservations[i]['Instances'].length;
            }
            
            if (count < THRESHOLD) {
                console.log("Sending SNS notification!");

                var sns = new AWS.SNS({region: process.env.AWS_REGION});
                let snsparams = { TargetArn: TOPIC_ARN, Message: `Only ${count} Instance(s) with security group '${SECURITY_GROUPS}' are running, please take action.`, Subject: 'EC2 Notification' };
                sns.publish(snsparams, callback);
                callback();
            }
        }
    });
};

int THRESHOLD = 5; // Lesser than this will notify to SNS topic.
String[] SECURITY_GROUPS = new String[]{"sg-11111"}; //Only EC2 instances with this security group.
String TOPIC_ARN = "arn:aws:sns:us-east-1:AccountId:MyTopic";

AmazonEC2 ec2 = AmazonEC2ClientBuilder.defaultClient();

DescribeInstancesRequest request = new DescribeInstancesRequest();
request.setMaxResults(THRESHOLD);
ArrayList<Filter> filters = new ArrayList<Filter>();
Filter filter = new Filter();
filter.setName("instance.group-id");
filter.setValues(Arrays.asList(SECURITY_GROUPS));

filter = new Filter();
filter.setName("instance-state-code");
filter.setValues(Collections.singletonList("16"));

request.setFilters(filters);
DescribeInstancesResult response = ec2.describeInstances(request);

int count = response.getReservations().stream().mapToInt(reservation -> reservation.getInstances().size()).sum();
if (count < THRESHOLD) {
    AmazonSNS sns = AmazonSNSClientBuilder.defaultClient();
    String msg = String.format("Only %d Instance(s) with security group '%s' are running, please take action.", count, Arrays.toString(SECURITY_GROUPS));
    PublishRequest publishRequest = new PublishRequest(TOPIC_ARN, msg, "EC2 Notification");
    sns.publish(publishRequest);
}

var AWS=require（'AWS-sdk'）；
“严格使用”；
//这些常量必须在环境变量中声明。
常数阈值=5；//小于此值将通知SNS主题。
const SECURITY_group=['sg-11111']//只有具有此安全组的EC2实例。
const TOPIC_ARN=“ARN:aws:sns:us-east-1:AccountId:MyTopic”；
exports.handler=（事件、上下文、回调）=>{
var设置={apiVersion:'2017-01-01'，region:process.env.AWS_region}；
var ec2=新AWS.ec2（设置）；
变量参数={
DryRun：错误，
MaxResults:THRESHOLD，//此值必须等于阈值。最小值为5。
过滤器：[]
};
//您可以使用“instance.group name”按安全组的名称进行筛选。
参数过滤器=[
{
名称：“实例.组id”，
值：安全组
}, 
{
名称：'实例状态代码'，
值：['16']
}
];
ec2.描述说明（参数、函数（错误、数据）{
如果（错误）{
回调（err）；
}否则{
让计数=0；
让保留=数据['reservations']| |[]；
for（设i=0；i

Lambda函数Java示例

var AWS = require('aws-sdk');

"use strict";

//These constants must be declared in Environment variables.
const THRESHOLD = 5; // Lesser than this will notify to SNS topic.
const SECURITY_GROUPS = ['sg-11111']; //Only EC2 instances with this security group.
const TOPIC_ARN = "arn:aws:sns:us-east-1:AccountId:MyTopic";

exports.handler = (event, context, callback) => {
    var settings = { apiVersion: '2017-01-01', region: process.env.AWS_REGION };
    var ec2 = new AWS.EC2(settings);
    var params = {
        DryRun: false,
        MaxResults: THRESHOLD, // This value must be equals to the THRESHOLD.  The min value is 5.
        Filters: []
    };
            
    // You can use 'instance.group-name' to filter by security group's name.
    params.Filters = [
        {
            Name: 'instance.group-id',
            Values: SECURITY_GROUPS
        }, 
        {
            Name: 'instance-state-code',
            Values: ['16']
        }
    ];
    
    ec2.describeInstances(params, function(err, data) {
        if (err) {
            callback(err);
        } else {
            let count = 0;
            let reservations = data['Reservations'] || [];
            for (let i = 0; i < reservations.length; i++) {
                count += reservations[i]['Instances'].length;
            }
            
            if (count < THRESHOLD) {
                console.log("Sending SNS notification!");

                var sns = new AWS.SNS({region: process.env.AWS_REGION});
                let snsparams = { TargetArn: TOPIC_ARN, Message: `Only ${count} Instance(s) with security group '${SECURITY_GROUPS}' are running, please take action.`, Subject: 'EC2 Notification' };
                sns.publish(snsparams, callback);
                callback();
            }
        }
    });
};

int THRESHOLD = 5; // Lesser than this will notify to SNS topic.
String[] SECURITY_GROUPS = new String[]{"sg-11111"}; //Only EC2 instances with this security group.
String TOPIC_ARN = "arn:aws:sns:us-east-1:AccountId:MyTopic";

AmazonEC2 ec2 = AmazonEC2ClientBuilder.defaultClient();

DescribeInstancesRequest request = new DescribeInstancesRequest();
request.setMaxResults(THRESHOLD);
ArrayList<Filter> filters = new ArrayList<Filter>();
Filter filter = new Filter();
filter.setName("instance.group-id");
filter.setValues(Arrays.asList(SECURITY_GROUPS));

filter = new Filter();
filter.setName("instance-state-code");
filter.setValues(Collections.singletonList("16"));

request.setFilters(filters);
DescribeInstancesResult response = ec2.describeInstances(request);

int count = response.getReservations().stream().mapToInt(reservation -> reservation.getInstances().size()).sum();
if (count < THRESHOLD) {
    AmazonSNS sns = AmazonSNSClientBuilder.defaultClient();
    String msg = String.format("Only %d Instance(s) with security group '%s' are running, please take action.", count, Arrays.toString(SECURITY_GROUPS));
    PublishRequest publishRequest = new PublishRequest(TOPIC_ARN, msg, "EC2 Notification");
    sns.publish(publishRequest);
}

int THRESHOLD=5；//小于此值将通知SNS主题。
字符串[]安全组=新字符串[]{“sg-11111”}//只有具有此安全组的EC2实例。
字符串TOPIC\u ARN=“ARN:aws:sns:us-east-1:AccountId:MyTopic”；
AmazonEC2 ec2=AmazonEC2ClientBuilder.defaultClient（）；
DescribeInstancesRequest请求=新的DescribeInstancesRequest（）；
setMaxResults（阈值）；
ArrayList过滤器=新的ArrayList（）；
过滤器=新过滤器（）；
filter.setName（“instance.group id”）；
filter.setValues（Arrays.asList（SECURITY_group））；
过滤器=新过滤器（）；
filter.setName（“实例状态代码”）；
filter.setValues（Collections.singletonList（“16”））；
请求。设置过滤器（过滤器）；
DescribeInstancesResult response=ec2.describeInstances（请求）；
int count=response.getReservations（）.stream（）.mapToInt（reservation->reservation.getInstances（）.size（））.sum（）；
如果（计数<阈值）{
AmazonSNS sns=amazonsclientbuilder.defaultClient（）；
String msg=String.format（“只有%d个安全组为“%s”的实例正在运行，请执行操作。”，count，Arrays.toString（安全组））；
PublishRequest PublishRequest=新的PublishRequest（主题为“EC2通知”）；
sns.发布（发布请求）；
}

您可以下载Java Maven项目

我的收件箱中的通知消息：只有2个安全组为“sg-09311111”的实例正在运行，请采取措施

---

创建Cloudwatch计划事件 在这里，您需要选择一个计划事件规则，将定期窗口设置为1分钟，然后选择目标。目标将是Lambda函数

实例insg

这是打印到Cloudwatch日志中的事件：

希望能有所帮助

定义“未运行”-EC2已停止，web服务器未响应。。。安全组如何融入您的团队