I need an EBS Volume ARN to specify it when creating a resource set with Route 53 Recovery Application Controller. But EBS Volumes don't have this attribute.
Here's an example description of an EBS Volume:
In:
aws ec2 describe-volumes --volume-ids vol-03303bf453f8d7ee5
Out:
{
"Volumes": [
{
"Attachments": [],
"AvailabilityZone": "ap-southeast-1a",
"CreateTime": "2021-11-03T15:43:40.087000+00:00",
"Encrypted": false,
"Size": 1,
"SnapshotId": "",
"State": "available",
"VolumeId": "vol-03303bf453f8d7ee5",
"Iops": 100,
"VolumeType": "gp2",
"MultiAttachEnabled": false
}
]
}
This is the format that worked for me:
arn:[partition]:ec2:[region]:[account-id]:volume/[volume-id]
For example:
arn:aws:ec2:ap-southeast-1:123456789123:volume/vol-03303bf453f8d7ee5
Related
I have private snapshots in one account (source) that I have shared with another account (target). I am able to see the snapshots themselves from the target account, but the tags are not available, neither on the console nor via the cli. This makes it impossible to filter for a desired snapshot from the target account. For background, the user in the target account has the following policy in effect:
"Effect": "Allow",
"Action": "ec2:*",
"Resource": "*"
Here's an example of what I'm seeing; from the source account:
$ aws --region us-east-2 ec2 describe-snapshots --snapshot-ids snap-XXXXX
{
"Snapshots": [
{
"Description": "snapshot for testing",
"VolumeSize": 50,
"Tags": [
{
"Value": "test-snapshot",
"Key": "Name"
}
],
"Encrypted": true,
"VolumeId": "vol-XXXXX",
"State": "completed",
"KmsKeyId": "arn:aws:kms:us-east-2:XXXXX:key/mrk-XXXXX",
"StartTime": "2022-04-19T18:29:36.069Z",
"Progress": "100%",
"OwnerId": "XXXXX",
"SnapshotId": "snap-XXXXX"
}
]
}
but from the target account
$ aws --region us-east-2 ec2 describe-snapshots --owner-ids 012345678900 --snapshot-ids snap-11111111111111111
{
"Snapshots": [
{
"Description": "snapshot for testing",
"VolumeSize": 50,
"Encrypted": true,
"VolumeId": "vol-22222222222222222",
"State": "completed",
"KmsKeyId": "arn:aws:kms:us-east-2:012345678900:key/mrk-00000000000000000000000000000000",
"StartTime": "2022-04-19T18:29:36.069Z",
"Progress": "100%",
"OwnerId": "012345678900",
"SnapshotId": "snap-11111111111111111"
}
]
}
Any ideas on what's going on here?
Cheers!
From https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Using_Tags.html#tag-restrictions
When you tag public or shared resources, the tags you assign are
available only to your AWS account; no other AWS account will have
access to those tags. For tag-based access control to shared
resources, each AWS account must assign its own set of tags to control
access to the resource.
I want to terminate my AWS Elastic Beanstalk environment, but I would like to keep a snapshot of the RDS database instance associated with the environment.
I have successfully created a snapshot of the concerned RDS database, but when I go to terminate the Elastic Beanstalk environment, it says that doing so will:
Terminate database-in-question with snapshot.
Does this mean that the snapshot I created will be deleted as well as the database instance? If so, how can I avoid the snapshot being deleted?
Elastic Beanstalk uses CloudFormation in the background to provision your environment. CloudFormation works so that it has a stack that contains all the resources that it has created, and once you delete your Beanstalk environment, said stack is removed. Thus, it will remove all the resources which are part of your stack. You can go to CloudFormation in console, and check it out.
If you created a DB Snapshot manually, it will be outside of the CloudFormation stack, and thus it won't be removed.
However, as part of Beanstalk environment setup, there will be some automated backups of your DB. These are removed, when you terminate your environment.
Here's my test environment stack:
$ aws cloudformation describe-stack-resources --stack-name awseb-e-jjqgv3nwgp-stack --profile=personal
{
"StackResources": [
[...],
{
"StackName": "awseb-e-jjqgv3nwgp-stack",
"StackId": "arn:aws:cloudformation:eu-central-1:[my_account]:stack/awseb-e-jjqgv3nwgp-stack/f21c2e00-ea6d-11eb-9f61-02ad9e7e97f6",
"LogicalResourceId": "AWSEBRDSDBSecurityGroup",
"PhysicalResourceId": "awseb-e-jjqgv3nwgp-stack-AWSEBRDSDBSecurityGroup-1SDABJ60VF7G8",
"ResourceType": "AWS::EC2::SecurityGroup",
"Timestamp": "2021-07-21T21:52:52.931000+00:00",
"ResourceStatus": "CREATE_COMPLETE",
"DriftInformation": {
"StackResourceDriftStatus": "NOT_CHECKED"
}
},
{
"StackName": "awseb-e-jjqgv3nwgp-stack",
"StackId": "arn:aws:cloudformation:eu-central-1:[my_account]:stack/awseb-e-jjqgv3nwgp-stack/f21c2e00-ea6d-11eb-9f61-02ad9e7e97f6",
"LogicalResourceId": "AWSEBRDSDatabase",
"PhysicalResourceId": "aa1v9kyuepq8x1c",
"ResourceType": "AWS::RDS::DBInstance",
"Timestamp": "2021-07-21T21:59:24.817000+00:00",
"ResourceStatus": "CREATE_COMPLETE",
"DriftInformation": {
"StackResourceDriftStatus": "NOT_CHECKED"
}
},
[...]
]
}
Here are my RDS snapshots:
$ aws rds describe-db-snapshots --profile=personal
{
"DBSnapshots": [
{
"DBSnapshotIdentifier": "foobar-snapshot-test",
"DBInstanceIdentifier": "aa1v9kyuepq8x1c",
"SnapshotCreateTime": "2021-07-21T22:09:03.752000+00:00",
"Engine": "mysql",
"AllocatedStorage": 5,
"Status": "available",
"Port": 3306,
"AvailabilityZone": "eu-central-1a",
"VpcId": "vpc-128d5178",
"InstanceCreateTime": "2021-07-21T21:56:51.205000+00:00",
"MasterUsername": "foo",
"EngineVersion": "8.0.23",
"LicenseModel": "general-public-license",
"SnapshotType": "manual",
"OptionGroupName": "default:mysql-8-0",
"PercentProgress": 100,
"StorageType": "standard",
"Encrypted": false,
"DBSnapshotArn": "arn:aws:rds:eu-central-1:[my_account]:snapshot:foobar-snapshot-test",
"IAMDatabaseAuthenticationEnabled": false,
"ProcessorFeatures": [],
"DbiResourceId": "db-PFQFQBRFBELDWUQTONIPRJRVCU",
"TagList": []
},
{
"DBSnapshotIdentifier": "rds:aa1v9kyuepq8x1c-2021-07-21-21-57",
"DBInstanceIdentifier": "aa1v9kyuepq8x1c",
"SnapshotCreateTime": "2021-07-21T21:57:05.277000+00:00",
"Engine": "mysql",
"AllocatedStorage": 5,
"Status": "available",
"Port": 3306,
"AvailabilityZone": "eu-central-1a",
"VpcId": "vpc-128d5178",
"InstanceCreateTime": "2021-07-21T21:56:51.205000+00:00",
"MasterUsername": "foo",
"EngineVersion": "8.0.23",
"LicenseModel": "general-public-license",
"SnapshotType": "automated",
"OptionGroupName": "default:mysql-8-0",
"PercentProgress": 100,
"StorageType": "standard",
"Encrypted": false,
"DBSnapshotArn": "arn:aws:rds:eu-central-1:[my_account]:snapshot:rds:aa1v9kyuepq8x1c-2021-07-21-21-57",
"IAMDatabaseAuthenticationEnabled": false,
"ProcessorFeatures": [],
"DbiResourceId": "db-PFQFQBRFBELDWUQTONIPRJRVCU",
"TagList": []
}
]
}
So, we have one automated snapshot, and one manual.
After deleting the application, the CloudFormation stack was removed, and what's left is the manual snapshot, but the automated one has been deleted:
$ aws rds describe-db-snapshots --profile=personal
{
"DBSnapshots": [
{
"DBSnapshotIdentifier": "foobar-snapshot-test",
"DBInstanceIdentifier": "aa1v9kyuepq8x1c",
"SnapshotCreateTime": "2021-07-21T22:09:03.752000+00:00",
"Engine": "mysql",
"AllocatedStorage": 5,
"Status": "available",
"Port": 3306,
"AvailabilityZone": "eu-central-1a",
"VpcId": "vpc-128d5178",
"InstanceCreateTime": "2021-07-21T21:56:51.205000+00:00",
"MasterUsername": "foo",
"EngineVersion": "8.0.23",
"LicenseModel": "general-public-license",
"SnapshotType": "manual",
"OptionGroupName": "default:mysql-8-0",
"PercentProgress": 100,
"StorageType": "standard",
"Encrypted": false,
"DBSnapshotArn": "arn:aws:rds:eu-central-1:[my_account]:snapshot:foobar-snapshot-test",
"IAMDatabaseAuthenticationEnabled": false,
"ProcessorFeatures": [],
"DbiResourceId": "db-PFQFQBRFBELDWUQTONIPRJRVCU",
"TagList": []
}
]
}
You can always double check your RDS snapshots to be sure you have a manual one there, before terminating anything on Beanstalk.
I am trying to get the Availability Zone ID out of either the AWS CLI or from boto3. However, despite the documentation showing it, the command only returns the AZ, not the id for the AZ. Am I missing a step or is this just bad documentation, etc?
aws ec2 describe-subnets --region us-east-1
{
"VpcId": "vpc-054c741523f481755",
"CidrBlock": "10.150.3.32/27",
"MapPublicIpOnLaunch": false,
"State": "available",
"Ipv6CidrBlockAssociationSet": [],
"AssignIpv6AddressOnCreation": false,
"SubnetId": "subnet-0a36ed4643fb511d1",
"AvailabilityZone": "us-east-1a",
"DefaultForAz": false,
"AvailableIpAddressCount": 27,
"Tags": [
{
"Key": "aws:cloudformation:stack-id",
"Value": "arn:aws:cloudformation:us-east-1:186940489315:stack/dantooine-a-elastic-subnets/dc3f7500-7b39-11ea-a67d-0e763951b664"
},
{
"Key": "aws:cloudformation:stack-name",
"Value": "dantooine-a-elastic-subnets"
},
{
"Key": "Name",
"Value": "dantooine-a-elastic-subnets-endpointSubnet"
},
{
"Key": "aws:cloudformation:logical-id",
"Value": "endpointSubnet"
}
]
}
The documentation shows:
{
"Subnets": [
{
"AvailabilityZone": "us-east-2c",
"AvailabilityZoneId": "use2-az3",
"AvailableIpAddressCount": 251,
"CidrBlock": "10.0.2.0/24",
"DefaultForAz": false,
"MapPublicIpOnLaunch": false,
"State": "available",
"SubnetId": "subnet-0bb1c79de3EXAMPLE",
"VpcId": "vpc-0ee975135dEXAMPLE",
"OwnerId": "111122223333",
"AssignIpv6AddressOnCreation": false,
"Ipv6CidrBlockAssociationSet": [],
"SubnetArn": "arn:aws:ec2:us-east-2:111122223333:subnet/subnet-0bb1c79de3EXAMPLE"
},
If you wish to view the Availability Zone IDs, use:
aws ec2 describe-availability-zones --region us-east-1
It will output:
{
"AvailabilityZones": [
{
"State": "available",
"OptInStatus": "opt-in-not-required",
"Messages": [],
"RegionName": "us-east-1",
"ZoneName": "us-east-1a",
"ZoneId": "use1-az1",
"GroupName": "us-east-1",
"NetworkBorderGroup": "us-east-1"
},
...
You can then map this information to any subnets you have created.
This works fine for me with both the awscli and boto3. For example:
import boto3
client = boto3.client('ec2')
subnets = client.describe_subnets()
for subnet in subnets['Subnets']:
print(subnet['AvailabilityZone'], subnet['AvailabilityZoneId'])
Output is:
us-east-1b use1-az2
us-east-1e use1-az3
us-east-1d use1-az6
...
I think your installation of awscli and boto3 may be out of date.
Here is an example for boto3 in Python:
import json
import boto3
def lambda_handler(event, context):
ec2 = boto3.client('ec2', region_name="us-east-1")
azs = ec2.describe_availability_zones()["AvailabilityZones"]
for az in azs:
print (az['ZoneName'], az['ZoneId'])
This is the output:
us-east-1a use1-az4
us-east-1b use1-az6
us-east-1c use1-az1
us-east-1d use1-az2
us-east-1e use1-az3
us-east-1f use1-az5
aws ec2 create-snapshot --volume-id $VOLUME_ID
output :
Found Services box: i-b657c36c
Found volume id: vol-ba131d5c
{
"Description": ""
"Encrypted": false,
"VolumeId": "vol-ba131d5c",
"State": "pending",
"VolumeSize": 30,
"Progress": "",
"StartTime": "2016-01-21T13:48:34.000Z",
"SnapshotId": "snap-cb1a238d",
"OwnerId": "833371238208"
}
Found private IP address: 172.31.1.147
Is it possible to detect if an attached EBS volume is using GP2 (SSD) or provisioned IOPS (io2)?
Is there a simple curl command I can issue to detect what is attached to my instance? I am on the instance that I want to run this command on.
I'd also like to do it without requiring the AWS credentials
There is no curl command that will let you know what is the volume type. You will either have check that through the console. Or another way is using a AWS CLI command. Also that is not possible without using AWS Credentials .
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ebs-describing-volumes.html
Using CLI Command.
aws ec2 describe-volumes
Sample Output
{
"Volumes": [
{
"AvailabilityZone": "us-east-1a",
"Attachments": [
{
"AttachTime": "2013-12-18T22:35:00.000Z",
"InstanceId": "i-1234567890abcdef0",
"VolumeId": "vol-049df61146c4d7901",
"State": "attached",
"DeleteOnTermination": true,
"Device": "/dev/sda1"
}
],
"VolumeType": "standard",
"VolumeId": "vol-049df61146c4d7901",
"State": "in-use",
"SnapshotId": "snap-1234567890abcdef0",
"CreateTime": "2013-12-18T22:35:00.084Z",
"Size": 8
},
{
"AvailabilityZone": "us-east-1a",
"Attachments": [],
"VolumeType": "io1",
"VolumeId": "vol-1234567890abcdef0",
"State": "available",
"Iops": 1000,
"SnapshotId": null,
"CreateTime": "2014-02-27T00:02:41.791Z",
"Size": 100
}
]
}