ACS-ECS-BulkyEncryptSystemDisk - CloudOps Orchestration Service

Template name

ACS-ECS-BulkyEncryptSystemDisk

Execute Now

Template description

Encrypts the system disks of multiple Elastic Compute Service (ECS) instances at a time.

Template type

Automated

Owner

Alibaba Cloud

Input parameters

Parameter	Description	Type	Required	Default value	Limit
targets	The ECS instances whose system disks you want to encrypt.	Json	Yes
KMSKeyId	The ID of the Key Management Service (KMS) key that you want to use to encrypt the system disks.	String	Yes
regionId	The region ID.	String	No	{{ ACS::RegionId }}
rateControl	The rate control settings.	Json	No	{'Mode': 'Concurrency', 'MaxErrors': 0, 'Concurrency': 10}
OOSAssumeRole	The Resource Access Management (RAM) role that is assumed by CloudOps Orchestration Service (OOS).	String	No	""

Output parameters

Parameter	Description	Type
systemDiskEncryptedInstances		Json

Permission policy that is required to execute the template

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "ecs:CopyImage",
                "ecs:CreateImage",
                "ecs:CreateSnapshot",
                "ecs:DeleteImage",
                "ecs:DeleteSnapshot",
                "ecs:DescribeDisks",
                "ecs:DescribeImages",
                "ecs:DescribeInstances",
                "ecs:DescribeSnapshots",
                "ecs:ReplaceSystemDisk",
                "ecs:StartInstance",
                "ecs:StopInstance"
            ],
            "Resource": "*",
            "Effect": "Allow"
        }
    ]
}

References

For more information, see ACS-ECS-BulkyEncryptSystemDisk.yml at GitHub.

Template content

FormatVersion: OOS-2019-06-01
Description:
  en: Bulky encrypt the system disks
  zh-cn: the description in Chinese
  name-en: ACS-ECS-BulkyEncryptSystemDisk
  name-zh-cn: the description in Chinese
  categories:
    - security
Parameters:
  regionId:
    Type: String
    Label:
      en: RegionId
      zh-cn: the description in Chinese
    AssociationProperty: RegionId
    Default: '{{ ACS::RegionId }}'
  targets:
    Type: Json
    Label:
      en: TargetInstance
      zh-cn: the description in Chinese
    AssociationProperty: Targets
    AssociationPropertyMetadata:
      ResourceType: 'ALIYUN::ECS::Instance'
      RegionId: regionId
  KMSKeyId:
    Label:
      en: KMSKeyId
      zh-cn: the description in Chinese
    AssociationProperty: ALIYUN::KMS::Key::KeyId
    AssociationPropertyMetadata:
      RegionId: regionId
    Type: String
  rateControl:
    Label:
      en: RateControl
      zh-cn: the description in Chinese
    Type: Json
    AssociationProperty: RateControl
    Default:
      Mode: Concurrency
      MaxErrors: 0
      Concurrency: 10
  OOSAssumeRole:
    Label:
      en: OOSAssumeRole
      zh-cn: the description in Chinese
    Type: String
    Default: ''
RamRole: '{{ OOSAssumeRole }}'
Tasks:
- Name: getInstance
  Description:
    en: Views the ECS instances
    zh-cn: the description in Chinese
  Action: ACS::SelectTargets
  Properties:
    ResourceType: ALIYUN::ECS::Instance
    RegionId: '{{ regionId }}'
    Filters:
      - '{{ targets }}'
  Outputs:
    instanceIds:
      Type: List
      ValueSelector: Instances.Instance[].InstanceId
- Name: encryptSystemDisk
  Action: ACS::ECS::EncryptSystemDisk
  Description:
    en: Bulky encrypt the system disks
    zh-cn: the description in Chinese
  Properties:
    regionId: '{{ regionId }}'
    instanceId: '{{ ACS::TaskLoopItem }}'
    KMSKeyId: '{{ KMSKeyId }}'
  Outputs:
    systemDiskEncryptedInstance:
      Type: String
      ValueSelector: .systemDiskEncryptedInstance
  Loop:
    RateControl: '{{ rateControl }}'
    Items: '{{ getInstance.instanceIds }}'
    Outputs:
      systemDiskEncryptedInstances:
        AggregateType: Fn::ListJoin
        AggregateField: systemDiskEncryptedInstance
Outputs:
  systemDiskEncryptedInstances:
    Type: Json
    Value:
      Fn::Jq:
        - First
        - '[.[][]]|.|= map(select(.))'
        - '{{ encryptSystemDisk.systemDiskEncryptedInstances }}'
Metadata:
  ALIYUN::OOS::Interface:
    ParameterGroups:
      - Parameters:
          - regionId
          - targets
          - instancePassword
        Label:
          default:
            zh-cn: the description in Chinese
            en: Select Ecs Instances
      - Parameters:
          - KMSKeyId
        Label:
          default:
            zh-cn: the description in Chinese
            en: Configure KMSKey
      - Parameters:
          - rateControl
          - OOSAssumeRole
        Label:
          default:
            zh-cn: the description in Chinese
            en: Control Options