Auto Scaling:Automatically add ECS instances to or remove them from the whitelist of a MongoDB instance

Create a policy

1. Log on to the RAM console.

2. In the left-side navigation pane, choose Permissions > Policies.

3. Click Create Policy.

4. On the Create Policy page, click the JSON tab, enter the following policy document, and then click OK.

   Parameter	Value
   Name	ESSHookPolicyForMongoDBWhitelist
   Policy document	See the JSON below

   {
       "Version": "1",
       "Statement": [
           {
               "Action": [
                   "ecs:DescribeInstances"
               ],
               "Resource": "*",
               "Effect": "Allow"
           },
           {
               "Action": [
                   "dds:ModifySecurityIps"
               ],
               "Resource": "*",
               "Effect": "Allow"
           },
           {
               "Action": [
                   "ess:CompleteLifecycleAction"
               ],
               "Resource": "*",
               "Effect": "Allow"
           }
       ]
   }

Attach the policy to OOSServiceRole

1. In the left-side navigation pane, choose Identities > Roles.

2. Find OOSServiceRole and click Grant Permission in the Actions column.

3. In the Grant Permission panel, configure the following settings and click Grant permissions.

   Parameter	Value
   Resource Scope	Account
   Policy	ESSHookPolicyForMongoDBWhitelist

Create the lifecycle hook

1. Log on to the Auto Scaling console.

2. In the left-side navigation pane, click Scaling Groups.

3. In the top navigation bar, select the region where Auto Scaling is activated.

4. Find your scaling group and click its ID in the Scaling Group Name/ID column, or click Details in the Actions column.

5. On the scaling group details page, click the Lifecycle Hook tab.

6. Click Create Lifecycle Hook.

7. Configure the following parameters and click OK.

   Parameter	Value
   Name	ESSHookForAddMongoDBWhitelist
   Scaling Activity	Scale-out Event
   Timeout Period	Set this to a value long enough for OOS to complete the whitelist update. This example uses 300 seconds. If the timeout expires before OOS finishes, the lifecycle action defaults to Continue and the instance goes live without the IP being added.
   Default Execution Policy	Continue
   Send Notification When Lifecycle Hook Takes Effect	Select OOS Template > Public Templates > LifeCycleModifyMongoDBIPWhitelist
   dbInstanceId	The ID of your MongoDB instance (this example uses a replica set instance)
   modifyMode	Append
   OOSAssumeRole	OOSServiceRole

If your scaling group already contains ECS instances, manually add their private IP addresses to the MongoDB whitelist before enabling this automation. If those IPs are absent from the whitelist when a scale-in event runs, the removal step will fail.

Trigger a scale-out event

In this example, trigger the scale-out by manually executing a scaling rule. Production environments typically use scheduled or event-triggered tasks.

1. On the scaling group details page, click the Scaling Rules and Event-triggered Tasks tab.

2. On the Scaling Rules tab, click Create Scaling Rule.

3. Configure the following parameters and click OK.

   Parameter	Value
   Rule Name	Add1
   Rule Type	Simple Scaling Rule
   Operation	Add 1 Instances

4. Find the Add1 rule and click Execute in the Actions column.

5. In the Execute Scaling Rule message, click OK.

Auto Scaling adds one ECS instance to the scaling group. The instance enters Pending Add state because the ESSHookForAddMongoDBWhitelist lifecycle hook is in effect. During the timeout period, OOS runs the ACS-ESS-LifeCycleModifyMongoDBIPWhitelist template to update the MongoDB whitelist.

IP address not added to the whitelist

Symptom: The scale-out event completes, but the ECS instance's private IP address does not appear in the MongoDB whitelist.

Steps:

1. Open the OOS execution log (see Step 4) and check whether the execution status is Failed.

2. If the execution failed, look for one of the following error messages and apply the corresponding fix:

   Error message	Cause	Fix
   Forbidden.Unauthorized: A required authorization for the specified action is not supplied	OOSServiceRole is missing the required permissions	Attach the ESSHookPolicyForMongoDBWhitelist policy to OOSServiceRole as described in Step 1
   Forbidden.RAM: User not authorized to operate on the specified resource, or this API doesn't support RAM	OOSServiceRole is missing the required permissions	Attach the ESSHookPolicyForMongoDBWhitelist policy to OOSServiceRole as described in Step 1

3. If the execution log shows no record of the OOS task being triggered, the lifecycle hook may not be configured correctly. Confirm that the hook targets Scale-out Event and that the OOS template is set to ACS-ESS-LifeCycleModifyMongoDBIPWhitelist.

Lifecycle action times out before OOS finishes

Symptom: The instance transitions out of Pending Add state before the IP is added to the whitelist, or the OOS execution log shows a task that was interrupted.

Steps:

1. Open the OOS execution log and check whether the execution ended with a LifecycleHookIdAndLifecycleActionToken.Invalid error:

   LifecycleHookIdAndLifecycleActionToken.Invalid: The specified lifecycleActionToken
   and lifecycleActionId you provided does not match any in process lifecycle action.

2. If this error appears, the lifecycle hook's Timeout Period is too short. Increase Timeout Period on the lifecycle hook to give OOS enough time to complete the whitelist update, then re-execute the scaling rule to test again.