Auto Scaling:Automatically add ECS instances to or remove them from the whitelist of an AnalyticDB for MySQL cluster

Prerequisites

Before you begin, make sure you have:

• A scaling group in the Enabled state

• An AnalyticDB for MySQL cluster

• A RAM role for CloudOps Orchestration Service (OOS) — the trusted entity must be Alibaba Cloud Service, the trusted service must be CloudOps Orchestration Service. For setup details, see Use RAM to grant permissions to OOS

This tutorial uses OOSServiceRole as the RAM role name. You can use a different role name.

How it works

When a scale-out event occurs:

1. Auto Scaling launches a new ECS instance and triggers the lifecycle hook.

2. The instance enters the Pending Add state — it cannot serve traffic yet.

3. Auto Scaling notifies OOS to run the ACS-ESS-LifeCycleModifyAnalyticDBIPWhitelist public template.

4. OOS retrieves the instance's private IP address and appends it to the AnalyticDB for MySQL cluster's IP address whitelist.

5. After the task completes, OOS signals Auto Scaling to continue, and the instance moves to the InService state.

If the lifecycle hook times out before OOS finishes, the instance proceeds based on the Default Execution Policy you set:

• Continue: The instance enters service even if the whitelist update did not complete.

• Abandon: The instance is terminated.

Step 1: Grant the RAM role permissions on OOS

The ACS-ESS-LifeCycleModifyAnalyticDBIPWhitelist template needs permissions to describe ECS instances, modify the AnalyticDB for MySQL whitelist, and signal Auto Scaling lifecycle actions.

1. Log on to the RAM console.

2. Create a policy.

   1. In the left-side navigation pane, choose Permissions > Policies.

   2. Click Create Policy.

   3. On the Create Policy page, click the JSON tab, enter the following policy document, and click OK.

      Set Name to ESSHookPolicyForAnalyticDBWhitelist.

      {
          "Version": "1",
          "Statement": [
              {
                  "Action": [
                      "ecs:DescribeInstances"
                  ],
                  "Resource": "*",
                  "Effect": "Allow"
              },
              {
                  "Action": [
                      "adb:ModifyDBClusterAccessWhiteList"
                  ],
                  "Resource": "*",
                  "Effect": "Allow"
              },
              {
                  "Action": [
                      "ess:CompleteLifecycleAction"
                  ],
                  "Resource": "*",
                  "Effect": "Allow"
              }
          ]
      }

3. Attach the policy to the OOSServiceRole RAM role.

   1. In the left-side navigation pane, choose Identities > Roles.

   2. Find OOSServiceRole and click Grant Permission in the Actions column.

   3. In the Grant Permission panel, set Resource Scope to Account, select the ESSHookPolicyForAnalyticDBWhitelist custom policy, and click Grant permissions.

Step 2: Create a lifecycle hook for scale-out

1. Log on to the Auto Scaling console.

2. In the left-side navigation pane, click Scaling Groups.

3. In the top navigation bar, select the region where your scaling group is located.

4. Click the ID of the scaling group or click Details in the Actions column.

5. On the Lifecycle Hook tab, click Create Lifecycle Hook.

6. Configure the following parameters and click OK.

   Parameter	Description
   Name	Enter ESSHookForAddAnalyticDBWhitelist.
   Scaling Activity	Select Scale-out Event.
   Timeout Period	Set this to a value higher than the expected OOS execution time. If the hook times out before OOS finishes, the whitelist update fails. This example uses 300 seconds.
   Default Execution Policy	Select Continue to let the instance enter service if the hook times out. Select Abandon to terminate the instance instead.
   Send Notification When Lifecycle Hook Takes Effect	Select OOS Template > Public Templates > ACS-ESS-LifeCycleModifyAnalyticDBIPWhitelist. Then configure the template parameters: dbClusterId (the ID of your AnalyticDB for MySQL cluster), modifyMode (Append — adds the private IP address to the whitelist on scale-out), and OOSAssumeRole (OOSServiceRole).

Step 3: Trigger a scale-out event and verify the whitelist

(Optional) Step 4: View the OOS execution

1. Log on to the OOS console.

2. In the left-side navigation pane, choose Automated Tasks > Task Execution Management.

3. Find the execution by time and click Details in the Actions column.

4. In the Basic Information section, check the execution ID and status. In the Execution Steps and Results section, click a task node to view step-level details.

For more information, see View the details of an execution.

If the execution fails, an error message appears on the execution details page.

FAQ

Troubleshooting

If a task fails, locate the error message in the execution result and refer to the following:

`Forbidden.Unauthorized`: A required authorization for the specified action is not supplied.

The OOSServiceRole RAM role is missing the required permissions. Grant the permissions described in Step 1.

`Forbidden.RAM`: User not authorized to operate on the specified resource, or this API doesn't support RAM.

Check whether the required permissions, such as the sample permissions in Step 1, are granted to the OOSServiceRole RAM role. Verify that the ESSHookPolicyForAnalyticDBWhitelist policy is attached to OOSServiceRole with Account-level resource scope.

`LifecycleHookIdAndLifecycleActionToken.Invalid`: The specified lifecycleActionToken and lifecycleActionId you provided does not match any in process lifecycle action.

Check whether the timeout period of the lifecycle hook is sufficient for the O&M task specified in the OOS template to complete.