All Products
Search
Document Center

Auto Scaling:Apply an automatic snapshot policy to ECS instances

Last Updated:Apr 16, 2026

Auto Scaling lifecycle hooks let you pause newly added instances and run automated tasks before they join a scaling group. This tutorial shows how to combine a lifecycle hook with a CloudOps Orchestration Service (OOS) template to automatically apply an automatic snapshot policy to ECS instances during a scale-out event — no manual intervention required.

Prerequisites

Before you begin, make sure you have:

This tutorial uses OOSServiceRole as the RAM role name. You can use a different role name.

How it works

When a scale-out event occurs, Auto Scaling pauses each new ECS instance in the Pending Add state instead of letting it join the group immediately. During this pause, Auto Scaling signals OOS to run the ACS-ESS-LifeCycleApplyAutoSnapshotPolicy template. OOS applies the specified automatic snapshot policy to the instance's cloud disks and then notifies Auto Scaling to let the instance proceed.

Auto Scaling (scale-out) → lifecycle hook puts instance in Pending Add → OOS runs template and applies snapshot policy → ECS disk receives snapshot policy → lifecycle hook completes → instance joins scaling group

Step 1: Grant the OOS RAM role permissions

The ACS-ESS-LifeCycleApplyAutoSnapshotPolicy template needs permissions to describe ECS disks, apply snapshot policies, and complete lifecycle actions. Create a dedicated policy and attach it to your OOS RAM role.

Create the policy

  1. Log on to the RAM console.

  2. In the left-side navigation pane, choose Grant Permission > Policies.

  3. Click Create Policy.

  4. On the Create Policy page, click the JSON tab and enter the following policy content:

    {
        "Version": "1",
        "Statement": [
            {
                "Action": [
                    "ecs:DescribeDisks",
                    "ecs:ApplyAutoSnapshotPolicy",
                    "ecs:DescribeInstances"
                ],
                "Resource": "*",
                "Effect": "Allow"
            },
            {
                "Action": [
                    "ess:CompleteLifecycleAction"
                ],
                "Resource": "*",
                "Effect": "Allow"
            }
        ]
    }
  5. Click OK.

  6. In the Create Policy dialog box, enter a policy name and description, then click OK.

    This tutorial uses ESSHookPolicyForApplyAutoSnapshotPolicy as the policy name.

    To modify the policy content, click Cancel to return to the JSON tab.

Attach the policy to the RAM role

  1. In the left-side navigation pane, choose Identities > Roles.

  2. Find OOSServiceRole and click Grant Permission in the Actions column.

  3. In the Grant Permission panel, configure the following parameters and click Grant Permission:

    Parameter Setting
    Resource scope Account
    Policies ESSHookPolicyForApplyAutoSnapshotPolicy

Step 2: Create a lifecycle hook and trigger a scale-out event

Create the lifecycle hook

  1. Log on to the Auto Scaling console.

  2. In the left-side navigation pane, click Scaling Groups.

  3. In the top navigation bar, select a region.

  4. Find the scaling group and open its details page by clicking its ID in the Scaling Group Name/ID column or by clicking Details in the Actions column.

  5. Click the Lifecycle Hook tab, then click Create Lifecycle Hook.

  6. Configure the following parameters and click OK:

    Parameter Setting
    Name ESSHookForApplyAutoSnapshotPolicy
    Scaling activity Scale-out Event
    Timeout period 300 (adjust based on how long the OOS template takes to run)
    Default execution policy Continue
    Send notification when lifecycle hook takes effect Select OOS Template > Public Templates > ACS-ESS-LifeCycleApplyAutoSnapshotPolicy

    In the ACS-ESS-LifeCycleApplyAutoSnapshotPolicy template parameters:

    • AutoSnapshotPolicyId: Enter the ID of your automatic snapshot policy.

    • OOSAssumeRole: Select OOSServiceRole.

    Set the timeout period long enough to cover the full OOS template execution. If the timeout is too short, OOS may not finish applying the snapshot policy before the hook expires.

Trigger a scale-out event

This tutorial triggers a scale-out event by manually executing a scaling rule. You can also use scheduled tasks or event-triggered tasks.

Lifecycle hooks take effect when scaling rules are executed. They do not take effect when you manually add ECS instances to a scaling group.
  1. On the scaling group details page, click the Scaling Rules and Event-triggered Tasks tab.

  2. Click the Scaling Rules tab, then click Create Scaling Rule.

  3. Configure the following parameters and click OK:

    Parameter Setting
    Rule name Add1
    Rule type Simple Scaling Rule
    Operation Add 1 Instances
  4. On the Scaling Rules tab, find the Add1 rule and click Execute in the Actions column.

  5. In the Execute Scaling Rule message, click OK.

    Auto Scaling adds one ECS instance to the scaling group. The ESSHookForApplyAutoSnapshotPolicy lifecycle hook puts the instance in the Pending Add state. Auto Scaling then signals OOS to run the ACS-ESS-LifeCycleApplyAutoSnapshotPolicy template and apply the snapshot policy.

Verify the result

  1. On the scaling group details page, click the Instances tab.

  2. Find the new ECS instance and click its ID in the ECS Instance ID/Name column.

  3. On the instance details page, click the Block Storage (Disks) tab.

  4. Find the cloud disk and click Configure Automatic Snapshot Policy in the Actions column.

Success: The Automatic Snapshot Policy toggle is on and shows the policy you specified in the OOS template.

SCR-20240710-lpiu

Failure: The toggle is off. Check the OOS execution to find out why — see (Optional) Step 3: View OOS execution status below.

(Optional) Step 3: View OOS execution status

If the snapshot policy was not applied, check the OOS execution logs to diagnose the issue.

  1. Log on to the OOS console.

  2. In the left-side navigation pane, choose Automated Task > Task Execution Management.

  3. Find the execution by time and click Details in the Actions column.

  4. Review the execution details:

    • Basic Information section: Shows the execution ID and status.

    • Execution Steps and Results section: Click individual task nodes to see step-level details.

    • Execution Result section: If the execution failed, the error message appears here. Cross-reference the error with the FAQ section below.

    For more information, see View the details of an execution.

Clean up

If you created resources specifically for this tutorial and no longer need them, delete them to avoid unnecessary charges.

RAM policy:

  1. In the RAM console, go to Grant Permission > Policies.

  2. Find ESSHookPolicyForApplyAutoSnapshotPolicy and detach it from OOSServiceRole before deleting it.

Lifecycle hook:

  1. In the Auto Scaling console, open the scaling group's details page.

  2. Click the Lifecycle Hook tab, find ESSHookForApplyAutoSnapshotPolicy, and delete it.

Scaling rule:

  1. On the scaling group's details page, click the Scaling Rules and Event-triggered Tasks tab.

  2. Find the Add1 scaling rule and delete it.

FAQ

If an O&M task fails, check the error message in the OOS execution result and refer to the following table.

Error message Cause Solution
Forbidden.Unauthorized message: A required authorization for the specified action is not supplied. Auto Scaling is not authorized to perform the action. Check that OOSServiceRole has the required permissions.
Forbidden.RAM message: User not authorized to operate on the specified resource, or this API doesn't support RAM. The RAM role lacks permissions to manage the required resources. Grant OOS the required permissions on the RAM role. Before OOS can manage resources declared in an OOS template, the RAM role must have the corresponding permissions.
LifecycleHookIdAndLifecycleActionToken.Invalid message: The specified lifecycleActionToken and lifecycleActionId you provided does not match any in process lifecycle action. The lifecycle hook action ended or was stopped before OOS completed. Increase the lifecycle hook timeout period to give OOS enough time to complete all O&M tasks.

What's next

Use the same lifecycle hook pattern to automatically run scripts on ECS instances during a scale-in event. For more information, see Automatically execute scripts on ECS instances.

FAQ

If an Operation and Maintenance (O&M) task fails, find the cause based on the error message in the execution result. For more information, see FAQ.

Common error messages are as follows:

Error message

Cause

Solution

Forbidden.Unauthorized message: A required authorization for the specified action is not supplied.

Auto Scaling is not authorized to perform the specified action.

Verify that the required permissions are granted to the OOSServiceRole RAM role.

Forbidden.RAM message: User not authorized to operate on the specified resource, or this API doesn't support RAM.

The RAM user or RAM role does not have the permissions to operate on the corresponding resource.

Verify that the OOSServiceRole RAM role has the required permissions. For example, you can grant the sample permissions for the OOS service to the RAM role. You must add operation permissions to the RAM role to ensure that the OOS service can manage the resources specified in the OOS template.

LifecycleHookIdAndLifecycleActionToken.Invalid message: The specified lifecycleActionToken and lifecycleActionId you provided does not match any in process lifecycle action.

The ongoing lifecycle action has expired or has been aborted.

Evaluate the timeout period of the lifecycle hook to ensure that the O&M tasks defined in the OOS template can be completed within the timeout period.