Lambda 関数を利用して、SSM Ping ステータス監視による EC2 Auto Scaling グループのインスタンス自動置換を実装してみた

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "lambda.amazonaws.com"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ssm:DescribeInstanceInformation",
                "ssm:DeregisterManagedInstance"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeInstances",
                "ec2:TerminateInstances",
                "autoscaling:DescribeAutoScalingInstances",
                "autoscaling:DetachInstances"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "logs:CreateLogGroup"
            ],
            "Resource": "arn:aws:logs:${REGION}:${ACCOUNT_ID}:*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "logs:CreateLogStream",
                "logs:PutLogEvents"
            ],
            "Resource": [
                "arn:aws:logs:${REGION}:${ACCOUNT_ID}:log-group:/aws/lambda/${FUNCTION_NAME}:*"
            ]
        }
    ]
}

import boto3
import logging
from datetime import datetime, timezone

# ロガーの設定
logger = logging.getLogger()
logger.setLevel(logging.INFO)

def handle_managed_instance(ssm_client, instance_id):
    """ハイブリッドインスタンス（mi-）の処理"""
    try:
        logger.info(f"Deregistering managed instance: {instance_id}")
        ssm_client.deregister_managed_instance(
            InstanceId=instance_id
        )
        logger.info(f"Successfully deregistered managed instance: {instance_id}")
    except Exception as e:
        logger.error(f"Error deregistering managed instance {instance_id}: {str(e)}")

def handle_ec2_instance(instance_id, asg_client, ec2_client):
    """EC2インスタンス（i-）の処理"""
    try:
        # インスタンスの存在確認
        ec2_response = ec2_client.describe_instances(
            InstanceIds=[instance_id]
        )
        logger.info(f"EC2 instance details: {str(ec2_response)}")

        # AutoScalingGroup情報の取得
        asg_response = asg_client.describe_auto_scaling_instances(
            InstanceIds=[instance_id]
        )

        if not asg_response['AutoScalingInstances']:
            logger.info(f"Instance {instance_id} is not part of an ASG")
            return

        asg_name = asg_response['AutoScalingInstances'][0]['AutoScalingGroupName']

        # インスタンスのデタッチと終了
        logger.info(f"Detaching instance {instance_id} from ASG {asg_name}")
        asg_client.detach_instances(
            InstanceIds=[instance_id],
            AutoScalingGroupName=asg_name,
            ShouldDecrementDesiredCapacity=False
        )

        logger.info(f"Terminating instance {instance_id}")
        ec2_client.terminate_instances(
            InstanceIds=[instance_id]
        )
    except Exception as e:
        logger.error(f"Error processing EC2 instance {instance_id}: {str(e)}")

def lambda_handler(event, context):
    ssm_client = boto3.client('ssm')
    ec2_client = boto3.client('ec2')
    asg_client = boto3.client('autoscaling')

    try:
        ssm_instances = ssm_client.describe_instance_information()

        for instance in ssm_instances['InstanceInformationList']:
            instance_id = instance['InstanceId']
            ping_status = instance['PingStatus']
            resource_type = instance.get('ResourceType', '')

            logger.info(f"Processing instance: {instance_id}")
            logger.info(f"Resource type: {resource_type}")
            logger.info(f"Ping status: {ping_status}")

            if ping_status != 'ConnectionLost':
                continue

            if resource_type == 'ManagedInstance' or instance_id.startswith('mi-'):
                handle_managed_instance(ssm_client, instance_id)
            elif resource_type == 'EC2Instance' or instance_id.startswith('i-'):
                handle_ec2_instance(instance_id, asg_client, ec2_client)
            else:
                logger.warning(f"Unknown instance type: {instance_id}")

        return {
            'statusCode': 200,
            'body': 'Successfully processed instances'
        }

    except Exception as e:
        logger.error(f"Error in lambda execution: {str(e)}")
        raise