使用 AWS EventBridge+Lambda+Aurora 实现实例资源自动预留

#创建 Aurora 时已经自动执行，不需要额外操作
CREATE DATABASE IF NOT EXISTS <database> DEFAULT CHARACTER SET utf8

#创建资源预留表，其中 InstanceType 为需要预留的实例类型，AvailabilityZone 为可用区名称，Target_Capacity 为预期的实例需求数量，Current_Capacity 为当前已完成的实例预留数量。为保证数据唯一性，这里对 InstanceType 和 AvailabilityZone 列做了复合主键
CREATE Table IF NOT EXISTS <database>.odcr_capacity 
(InstanceType varchar(255),
AvailabilityZone varchar(255),PRIMARY KEY (InstanceType,AvailabilityZone),
Target_Capacity int NOT NULL,
Current_Capacity int DEFAULT 0)

#根据具体的资源需求，在表中插入对应数据，当 Target_Capacity > Current_Capacity时会调用 ODCR API。如：需要在 ap-northeast-1c 可用区预留15台 r5b.2xlarge 实例，则可执行以下 SQL
INSERT INTO <database>.odcr_capacity VALUES ('r5b.2xlarge','ap-northeast-1c',15,0)

#根据资源需求变化更新相关数据
update <database>.odcr_capacity set Current_Capacity=5 where InstanceType='r5b.2xlarge' and AvailabilityZone='ap-northeast-1a'

SELECT * FROM <database>.odcr_capacity

~$ aws --version

#指定要部署的 region 和 az
~$ export AWS_Region=<region_name>
~$ export AWS_AZ_a=<az-a>
~$ export AWS_AZ_c=<az-c>
~$ export VPC_ID=$(aws ec2 create-vpc --cidr-block 172.18.0.0/16 --instance-tenancy default  --tag-specifications ResourceType=vpc,Tags='[{Key=Project,Value=ODCR}]' --region $AWS_Region --output text --query Vpc.[VpcId][0])

~$ export Public_Subnet_ID=$(aws ec2 create-subnet --tag-specifications ResourceType=subnet,Tags='[{Key=Project,Value=ODCR}]' --availability-zone $AWS_AZ_a --cidr-block 172.18.1.0/24 --vpc-id $VPC_ID --region $AWS_Region --output text --query Subnet.[SubnetId][0])

~$ export Allocation_ID=$(aws ec2 allocate-address --tag-specifications ResourceType=elastic-ip,Tags='[{Key=Project,Value=ODCR}]' --region $AWS_Region --output text --query AllocationId)
~$ export NatGW_ID=$(aws ec2 create-nat-gateway --subnet-id $Public_Subnet_ID --tag-specifications ResourceType=natgateway,Tags='[{Key=Project,Value=ODCR}]' --connectivity-type public --allocation-id $Allocation_ID --region $AWS_Region --output text --query NatGateway.[NatGatewayId][0])

~$ export IGW_ID=$(aws ec2 create-internet-gateway --tag-specifications ResourceType=internet-gateway,Tags='[{Key=Project,Value=ODCR}]' --region $AWS_Region --output text --query InternetGateway.[InternetGatewayId][0])
~$ aws ec2 attach-internet-gateway --internet-gateway-id $IGW_ID --vpc-id $VPC_ID --region $AWS_Region

~$ export Private_Subnet_DB_1=$(aws ec2 create-subnet --tag-specifications ResourceType=subnet,Tags='[{Key=Project,Value=ODCR}]' --availability-zone $AWS_AZ_a --cidr-block 172.18.2.0/24 --vpc-id $VPC_ID --region $AWS_Region --output text --query Subnet.[SubnetId][0])
~$ export Private_Subnet_DB_2=$(aws ec2 create-subnet --tag-specifications ResourceType=subnet,Tags='[{Key=Project,Value=ODCR}]' --availability-zone $AWS_AZ_c --cidr-block 172.18.3.0/24 --vpc-id $VPC_ID --region $AWS_Region --output text --query Subnet.[SubnetId][0])
~$ export Private_Subnet_Lambda_1=$(aws ec2 create-subnet --tag-specifications ResourceType=subnet,Tags='[{Key=Project,Value=ODCR}]' --availability-zone $AWS_AZ_a --cidr-block 172.18.4.0/24 --vpc-id $VPC_ID --region $AWS_Region --output text --query Subnet.[SubnetId][0])
~$ export Private_Subnet_Lambda_2=$(aws ec2 create-subnet --tag-specifications ResourceType=subnet,Tags='[{Key=Project,Value=ODCR}]' --availability-zone $AWS_AZ_c --cidr-block 172.18.5.0/24 --vpc-id $VPC_ID --region $AWS_Region --output text --query Subnet.[SubnetId][0])

#关联公有子网并添加默认路由到 IGW
~$ export Main_Route_Table_ID=$(aws ec2 describe-route-tables --filters Name=vpc-id,Values=$VPC_ID --region $AWS_Region --output text --query RouteTables[0].[RouteTableId][0])
~$ aws ec2 associate-route-table --route-table-id $Main_Route_Table_ID --subnet-id $Public_Subnet_ID --region $AWS_Region
~$ aws ec2 create-route --destination-cidr-block 0.0.0.0/0 --gateway-id $IGW_ID --route-table-id $Main_Route_Table_ID --region $AWS_Region

#创建私有路由表
~$ export Private_Route_Table_ID=$(aws ec2 create-route-table --vpc-id $VPC_ID --tag-specifications ResourceType=route-table,Tags='[{Key=Project,Value=ODCR}]' --region $AWS_Region --output text --query RouteTable.[RouteTableId])
#关联私有子网
~$ aws ec2 associate-route-table --route-table-id $Private_Route_Table_ID --subnet-id $Private_Subnet_DB_1 --region $AWS_Region
~$ aws ec2 associate-route-table --route-table-id $Private_Route_Table_ID --subnet-id $Private_Subnet_DB_2 --region $AWS_Region
~$ aws ec2 associate-route-table --route-table-id $Private_Route_Table_ID --subnet-id $Private_Subnet_Lambda_1 --region $AWS_Region
~$ aws ec2 associate-route-table --route-table-id $Private_Route_Table_ID --subnet-id $Private_Subnet_Lambda_2 --region $AWS_Region
#添加默认路由到 NAT GW
~$ aws ec2 create-route --destination-cidr-block 0.0.0.0/0 --gateway-id $NatGW_ID --route-table-id $Private_Route_Table_ID --region $AWS_Region

#创建 Lambda SG，inbound rules 保持为空，outbound rules 放开所有
~$ export ODCR_Lambda_SG_Name=<odcr-lambda-sg>
~$ export ODCR_Lambda_SG_ID=$(aws ec2 create-security-group --description "odcr-lambda-sg" --group-name $ODCR_Lambda_SG_Name --vpc-id $VPC_ID --tag-specifications ResourceType=security-group,Tags='[{Key=Project,Value=ODCR}]' --region $AWS_Region --output text --query GroupId)
#创建 Aurora security group，inbound rules 配置为允许上一步的 Lambda 的 SG 访问 3306 端口
~$ export ODCR_RDS_SG_Name=<odcr-rds-sg>
~$ export ODCR_RDS_SG_ID=$(aws ec2 create-security-group --description "odcr-rds-sg" --group-name $ODCR_RDS_SG_Name --vpc-id $VPC_ID --tag-specifications ResourceType=security-group,Tags='[{Key=Project,Value=ODCR}]' --region $AWS_Region --output text --query GroupId)
~$ aws ec2 authorize-security-group-ingress --group-id $ODCR_RDS_SG_ID --protocol tcp --port 3306 --source-group $ODCR_Lambda_SG_ID --tag-specifications  ResourceType=security-group-rule,Tags='[{Key=Project,Value=ODCR}]'  --region $AWS_Region

#指定 Subnet Groups 名称
~$ export ODCR_RDS_Subnet_Group_Name=<odcr-rds-subnet-group>
~$ aws rds create-db-subnet-group --db-subnet-group-name $ODCR_RDS_Subnet_Group_Name --db-subnet-group-description "ODCR RDS Subnet Group"  --subnet-ids $Private_Subnet_DB_1 $Private_Subnet_DB_2  --tags Key=Project,Value=ODCR --region $AWS_Region

#指定数据库相关参数
~$ export rds_username=<db_username>
~$ export rds_password=<db_password>
~$ export rds_db_cluster_identifier=<db_identifier>
~$ export rds_endpoint=$(aws rds create-db-cluster --database-name odcr_db --db-cluster-identifier $rds_db_cluster_identifier --vpc-security-group-ids $ODCR_RDS_SG_ID --db-subnet-group-name $ODCR_RDS_Subnet_Group_Name --engine aurora --port 3306 --master-username $rds_username --master-user-password $rds_password  --engine-mode serverless --scaling-configuration MinCapacity=1,MaxCapacity=4,AutoPause=false,TimeoutAction=ForceApplyCapacityChange  --enable-http-endpoint --tags Key=Project,Value=ODCR --output text --query DBCluster.[Endpoint][0] --region $AWS_Region)

#指定 secrets manager 名称
~$ export secret_manager_rds_name=<secret-manager-name>
~$ aws secretsmanager create-secret --name $secret_manager_rds_name --description "Credentials for serverless DB" --secret-string "{\"username\":\"${rds_username}\",\"password\":\"${rds_password}\",\"host\":\"${rds_endpoint}\",\"port\":3306,\"dbname\":\"odcr_db\"}" --tags Key=Project,Value=ODCR --region $AWS_Region

#将 json 文件保存到本地
~$ cat odcr-iam-policy.json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "ec2:CreateNetworkInterface",
                "ec2:DeleteNetworkInterface",
                "ec2:Describe*"
            ],
            "Resource": "*"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "ec2:ModifyCapacityReservation",
                "ec2:CreateCapacityReservation",
                "ec2:CancelCapacityReservation"
            ],
            "Resource": "arn:aws:ec2:*:*:capacity-reservation/*"
        },
        {
            "Sid": "VisualEditor2",
            "Effect": "Allow",
            "Action": "ec2:CreateTags",
            "Resource": "arn:aws:ec2:*:*:capacity-reservation/*"
        },
        {
            "Sid": "VisualEditor3",
            "Effect": "Allow",
            "Action": [
                "secretsmanager:GetRandomPassword",
                "secretsmanager:GetResourcePolicy",
                "secretsmanager:GetSecretValue",
                "secretsmanager:DescribeSecret",
                "secretsmanager:ListSecretVersionIds",
                "secretsmanager:ListSecrets"
            ],
            "Resource": "*"
        }
    ]
}
#指定 iam policy 名称
~$ export odcr_iam_policy_name=<iam-policy-name>
#<your-path>为odcr-iam-policy.json文件本地路径
~$ export odcr_policy_arn=$(aws iam create-policy --policy-name $odcr_iam_policy_name --policy-document file://<your-path>/odcr-iam-policy.json --tags Key=Project,Value=ODCR --region $AWS_Region --output text --query Policy.[Arn][0])

#将 json 文件保存到本地
~$ cat iam-assume-role.json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Service": "lambda.amazonaws.com"
            },
            "Action": "sts:AssumeRole"
        }
    ]
}
#指定 iam role 名称
~$ export odcr_role_name=<iam-role-name>
#<your-path>为iam-assume-role.json文件本地路径
~$ export odcr_role_arn=$(aws iam create-role --role-name $odcr_role_name --assume-role-policy-document file://<your-path>/iam-assume-role.json --tags Key=Project,Value=ODCR --region $AWS_Region --output text --query Role.[Arn][0])
#附加自定义策略和托管策略
~$ aws iam attach-role-policy --policy-arn $odcr_policy_arn --role-name $odcr_role_name --region $AWS_Region
~$ aws iam attach-role-policy --policy-arn arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole --role-name $odcr_role_name --region $AWS_Region
~$ aws iam attach-role-policy --policy-arn arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole --role-name $odcr_role_name --region $AWS_Region

#指定 lambda function 名称
~$ export odcr_lambda_name=<lambda-name>
#<your-path>为odcr-deployment-package.zip文件本地路径
~$ export odcr_lambda_arn=$(aws lambda create-function \
    --function-name $odcr_lambda_name \
    --runtime python3.9 \
    --architectures x86_64 \
    --package-type Zip \
    --zip-file fileb://<your-path>/odcr-deployment-package.zip \
    --handler odcr_lambda.lambda_handler \
    --timeout 300 \
    --vpc-config SubnetIds=$Private_Subnet_Lambda_1,$Private_Subnet_Lambda_2,SecurityGroupIds=$ODCR_Lambda_SG_ID \
    --environment "Variables={RegionName=$AWS_Region,SecretName=$secret_manager_rds_name}" \
    --role $odcr_role_arn \
    --tags Key=Project,Value=ODCR \
    --region $AWS_Region \
    --output text \
    --query FunctionArn)

#创建 event bridge，其中：schedule-expression 'rate(5 minutes)  表示每5分钟执行一次，可根据实际情况进行调整
~$ export event_bridge_arn=$(aws events put-rule --name my-scheduled-rule --schedule-expression 'rate(5 minutes)' --tags Key=Project,Value=ODCR --region $AWS_Region --output text --query RuleArn)
~$ aws lambda add-permission --function-name $odcr_lambda_name --statement-id my-scheduled-event --action 'lambda:InvokeFunction' --principal events.amazonaws.com --source-arn $event_bridge_arn --region $AWS_Region
~$ aws events put-targets --rule my-scheduled-rule --targets "Id"="1","Arn"=$odcr_lambda_arn --region $AWS_Region