Automatically attach or detach secondary ENIs that have EIPs to or from ECS instances during scaling events - Auto Scaling

Use lifecycle hooks and CloudOps Orchestration Service (OOS) to automatically attach secondary elastic network interfaces (ENIs) with elastic IP addresses (EIPs) to Elastic Compute Service (ECS) instances during scale-out events, and automatically detach and release them during scale-in events. This lets you build high-availability clusters, implement low-cost failover, and control internet access — without writing custom automation code.

An ENI is a virtual NIC that can be attached to an ECS instance in a virtual private cloud (VPC). ENIs are classified as primary ENIs or secondary ENIs. For more information, see Overview of ENIs. An EIP is a public IP address that you independently purchase and own. You can associate or disassociate EIPs from resources such as ECS instances and ENIs based on your business requirements. For more information, see What is EIP.

How it works

When a scale-out event is triggered, Auto Scaling adds an ECS instance to the scaling group. The lifecycle hook intercepts the instance and puts it in the Pending Add state. Auto Scaling then notifies OOS to create a secondary ENI, allocate an EIP, and attach both to the instance. After OOS completes the operations, the instance becomes available in the scaling group.

When a scale-in event is triggered, Auto Scaling removes an ECS instance from the scaling group. The lifecycle hook intercepts the instance and puts it in the Pending Remove state. Auto Scaling notifies OOS to detach the secondary ENI and release the EIP. After OOS completes the operations, the instance is released.

Two separate lifecycle hooks and OOS templates handle the two directions:

Direction	Lifecycle hook name	OOS template
Scale-out	`ESSHookForAttachNicWithEip`	`ACS-ESS-LifeCycleCreateNetworkInterfaceAndEipAndAttachToInstance`
Scale-in	`ESSHookForDeleteNicAndEip`	`ACS-ESS-LifeCycleDetachNetworkInterfaceAndDeleteEip`

Prerequisites

Before you begin, ensure that you have:

A scaling group that is created and in the Enabled state. For more information, see Manage scaling groups.
A Resource Access Management (RAM) role named OOSServiceRole with the trusted service set to CloudOps Orchestration Service. Attach the following system policies to the role: For setup instructions, see Use RAM to grant permissions to OOS.
- AliyunECSFullAccess
- AliyunESSFullAccess
- AliyunEIPFullAccess

Attach secondary ENIs with EIPs during scale-out events

Step 1: Create a lifecycle hook for scale-out

Create a lifecycle hook with the following settings. For parameters not listed here, keep the defaults. For more information, see Manage lifecycle hooks.

Parameter	Value
Name	`ESSHookForAttachNicWithEip`
Scaling activity	Scale-out Event
Timeout Period	`300` seconds. The lifecycle hook holds the instance in the Pending Add state for this duration. Configure this value based on your business requirements — if the timeout expires before OOS finishes, the operations may fail. We recommend that you estimate the time required to perform custom operations on instances and configure the Timeout Period accordingly.
Send notification when lifecycle hook takes effect	OOS Template

After selecting OOS Template:

Select Public Templates.
Select ACS-ESS-LifeCycleCreateNetworkInterfaceAndEipAndAttachToInstance.
Click Parameter Settings and set the following: Keep the defaults for all other parameters.
- InternetChargeType: PayByBandwidth (charged by bandwidth) or PayByTraffic (charged by actual traffic). This example uses PayByBandwidth.
- Bandwidth: 5 — sets the peak EIP bandwidth to 5 Mbit/s.
- OOSAssumeRole: OOSServiceRole.

Step 2: Trigger a scale-out event

Trigger a scale-out event by manually executing a scaling rule to add one ECS instance to the scaling group. Alternatively, use a scheduled task or an event-triggered task. For more information, see Manage scaling rules.

Executing a scaling rule triggers the lifecycle hook. Manually adding an ECS instance to the scaling group does not trigger the lifecycle hook.

After the event is triggered, Auto Scaling adds the instance and the ESSHookForAttachNicWithEip lifecycle hook puts it in the Pending Add state. Auto Scaling notifies OOS to attach a secondary ENI with an EIP to the instance.

If the scale-out event fails, the following error is reported. Go to the OOS console to view the execution status. instance-rollback

Step 3: Verify the attachment

Go to Instances > Auto Created and find the scaled-out ECS instance. Click the instance ID in the ECS Instance ID/Name column.
On the instance details page, click the ENIs tab.

A secondary ENI with an EIP should be listed, as shown below. 自动绑定的辅助ENI

If no ENI is attached or no EIP is allocated, check the OOS execution status as described in the next step.

Step 4: (Optional) View OOS execution status

On the OOS execution details page, the Basic Information section shows the execution ID and status. The Execution Steps and Results section shows the execution details and logs. For more information, see View the details of an execution.

Important

If the execution fails, an error message is displayed on the execution details page.

Step 5: (Optional) Configure the secondary ENI

Some OS images may not automatically recognize the IP address of a newly attached secondary ENI or configure routes for it. If this occurs, the secondary ENI will not function as expected. For more information, see Configure a secondary ENI.

FAQ

If an Operation and Maintenance (O&M) task fails, find the cause based on the error message in the execution result. For more information, see FAQ.

Common error messages are as follows:

Error message	Cause	Solution
Forbidden.Unauthorized message: A required authorization for the specified action is not supplied.	Auto Scaling is not authorized to perform the specified action.	Verify that the required permissions are granted to the OOSServiceRole RAM role.
Forbidden.RAM message: User not authorized to operate on the specified resource, or this API doesn't support RAM.	The RAM user or RAM role does not have the permissions to operate on the corresponding resource.	Verify that the OOSServiceRole RAM role has the required permissions. For example, you can grant the sample permissions for the OOS service to the RAM role. You must add operation permissions to the RAM role to ensure that the OOS service can manage the resources specified in the OOS template.
LifecycleHookIdAndLifecycleActionToken.Invalid message: The specified lifecycleActionToken and lifecycleActionId you provided does not match any in process lifecycle action.	The ongoing lifecycle action has expired or has been aborted.	Evaluate the timeout period of the lifecycle hook to ensure that the O&M tasks defined in the OOS template can be completed within the timeout period.

Detach and release secondary ENIs with EIPs during scale-in events

Step 1: Create a lifecycle hook for scale-in

Create a lifecycle hook with the following settings. For parameters not listed here, keep the defaults. For more information, see Manage lifecycle hooks.

Parameter	Value
Name	`ESSHookForDeleteNicAndEip`
Scaling activity	Scale-in Event
Timeout Period	`300` seconds. The lifecycle hook holds the instance in the Pending Remove state for this duration. Configure this value based on your business requirements — if the timeout expires before OOS finishes, the operations may fail and the ENI or EIP may not be released.
Send notification when lifecycle hook takes effect	OOS Template

After selecting OOS Template:

Select Public Templates.
Select ACS-ESS-LifeCycleDetachNetworkInterfaceAndDeleteEip.
Click Parameter Settings and set OOSAssumeRole to OOSServiceRole. Keep the defaults for all other parameters.

Step 2: Trigger a scale-in event

Trigger a scale-in event by manually executing a scaling rule to remove one ECS instance from the scaling group. Alternatively, use a scheduled task or an event-triggered task. For more information, see Manage scaling rules.

Executing a scaling rule triggers the lifecycle hook. Manually removing an ECS instance from the scaling group does not trigger the lifecycle hook.

After the event is triggered, Auto Scaling removes the instance and the ESSHookForDeleteNicAndEip lifecycle hook puts it in the Pending Remove state. Auto Scaling notifies OOS to detach the secondary ENI and release the EIP.

Step 3: Verify the release

Go to the Elastic Network Interfaces and Elastic IP Addresses pages to check whether the ENI and EIP still exist. If neither exists, the release was successful.

If the instance is removed but the ENI or EIP still exists, check the OOS execution status as described in the next step.

Step 4: (Optional) View OOS execution status

Important

If the execution fails, an error message is displayed on the execution details page.

Troubleshooting

If an OOS task fails, check the error message in the execution result and refer to the FAQ for more information.

Error message	Cause	Solution
`Forbidden.Unauthorized message: A required authorization for the specified action is not supplied.`	Auto Scaling is not authorized to perform the action.	Verify that the `OOSServiceRole` RAM role has the required permissions.
`Forbidden.RAM message: User not authorized to operate on the specified resource, or this API doesn't support RAM.`	The RAM role lacks permissions to operate on the required resources.	Verify that `OOSServiceRole` has the required permissions. Grant OOS permissions to the RAM role so it can manage the resources declared in the OOS template.
`LifecycleHookIdAndLifecycleActionToken.Invalid message: The specified lifecycleActionToken and lifecycleActionId you provided does not match any in process lifecycle action.`	The lifecycle hook action ended or was stopped before OOS completed its tasks.	Increase the timeout period of the lifecycle hook to give OOS enough time to complete its operations.

Clean up resources

If you created lifecycle hooks solely for testing, remove them to stop incurring EIP charges and avoid unintended behavior during future scaling events.

In the Auto Scaling console, go to the scaling group and open the Lifecycle Hooks tab.
Delete ESSHookForAttachNicWithEip and ESSHookForDeleteNicAndEip.
Go to the Elastic IP Addresses page and release any EIPs that were created during testing.
Go to the Elastic Network Interfaces page and delete any secondary ENIs that were created during testing.

What's next

EIPs incur public traffic fees, configuration fees (public IP retention fees), and binding fees. For more information, see Billing overview.
To bind EIPs directly to ECS instances without secondary ENIs, see Automatically bind and release EIPs.