All Products
Search
Document Center

Auto Scaling:Automatically execute scripts on ECS instances

Last Updated:Apr 16, 2026

Use lifecycle hooks in Auto Scaling together with a CloudOps Orchestration Service (OOS) template to automatically run scripts on Elastic Compute Service (ECS) instances during scale-out events. This lets you bootstrap new instances—installing software, configuring services, or running any initialization commands—before they enter service.

How it works

When a scale-out event occurs, Auto Scaling launches a new ECS instance but holds it in the Pending Add state instead of immediately adding it to the scaling group. During this wait period, Auto Scaling notifies OOS to run the O&M tasks defined in the ACS-ESS-LifeCycleRunCommand public template. After OOS finishes running the script, it calls CompleteLifecycleAction to signal Auto Scaling, which then moves the instance to the In Service state.

The overall flow is:

  1. Auto Scaling launches an ECS instance and triggers the lifecycle hook.

  2. The lifecycle hook holds the instance in the Pending Add state.

  3. Auto Scaling notifies OOS to run the script defined in the ACS-ESS-LifeCycleRunCommand template.

  4. OOS runs the script on the instance via Cloud Assistant.

  5. OOS calls CompleteLifecycleAction, and Auto Scaling moves the instance to the In Service state.

Prerequisites

Before you begin, make sure you have:

  • A scaling group in the Enabled state

  • A script to run on new instances (this tutorial uses a script that installs Apache on a CentOS 7.6 ECS instance)

  • A RAM role for OOS with the following settings:

    • Trusted entity: Alibaba Cloud Service

    • Trusted service: CloudOps Orchestration Service

    • Permissions to perform operations on OOS templates

This tutorial uses a RAM role named OOSServiceRole as an example. For instructions on creating this role, see Use RAM to grant permissions to OOS.

Step 1: Grant the OOSServiceRole RAM role permissions

The ACS-ESS-LifeCycleRunCommand template requires permissions to run commands on ECS instances and to complete lifecycle actions on Auto Scaling. Grant these permissions by creating a custom policy and attaching it to the OOSServiceRole RAM role.

Create a custom policy

  1. Log on to the RAM console.

  2. In the left-side navigation pane, choose Permissions > Policies.

  3. Click Create Policy.

  4. On the Create Policy page, click the JSON tab and configure the following settings, then click OK.

    Parameter Setting
    Name ESSHookPolicyForRunCommand
    Policy Document See the JSON below
    {
        "Version": "1",
        "Statement": [
            {
                "Action": [
                    "ecs:DescribeInvocationResults",
                    "ecs:DescribeInvocations",
                    "ecs:RunCommand"
                ],
                "Resource": "*",
                "Effect": "Allow"
            },
            {
                "Action": [
                    "ess:CompleteLifecycleAction"
                ],
                "Resource": "*",
                "Effect": "Allow"
            }
        ]
    }

Attach the policy to OOSServiceRole

  1. In the left-side navigation pane, choose Identities > Roles.

  2. Find OOSServiceRole and click Grant Permission in the Actions column.

  3. In the Grant Permission panel, configure the following settings, then click Grant permissions.

    Parameter Setting
    Resource Scope Account
    Policies ESSHookPolicyForRunCommand

Step 2: Create a lifecycle hook and trigger a scale-out event

Create the lifecycle hook

  1. Log on to the Auto Scaling console.

  2. In the left-side navigation pane, click Scaling Groups.

  3. In the top navigation bar, select the region where your scaling group is located.

  4. Click the ID of the scaling group in the Scaling Group Name/ID column, or click Details in the Actions column.

  5. On the scaling group details page, click the Lifecycle Hook tab.

  6. Click Create Lifecycle Hook.

  7. Configure the following settings, then click OK. In the ACS-ESS-LifeCycleRunCommand template section, configure the following parameters: Example script to install Apache:

    Timeout Period is the time Auto Scaling waits for the script to finish before the hook times out. Set it long enough for your script to complete. We recommend that you estimate the period of time required to perform custom operations on instances and configure Timeout Period based on your estimations.
    Parameter Setting
    Name ESSHookForRunCommand
    Scaling Activity Scale-out Event
    Timeout Period 300 (seconds)
    Default Execution Policy Continue
    Send Notification When Lifecycle Hook Takes Effect OOS Template > Public Templates > ACS-ESS-LifeCycleRunCommand
    Parameter Setting
    commandType RunShellScript
    commandContent The script to run on each new instance (see example below)
    OOSAssumeRole OOSServiceRole
    yum install -y httpd
    systemctl start httpd
    systemctl enable httpd
  • Log on to the Auto Scaling console.

  • Trigger a scale-out event

    Trigger a scale-out event by executing a scaling rule. You can also trigger scale-out events through scheduled tasks or event-triggered tasks.

    Lifecycle hooks apply only when Auto Scaling triggers scaling events through scaling rules or tasks. They do not apply when you manually add or remove ECS instances from a scaling group.
    1. On the scaling group details page, click the Scaling Rules and Event-triggered Tasks tab.

    2. On the Scaling Rules tab, click Create Scaling Rule.

    3. Configure the following settings, then click OK.

      Parameter Setting
      Rule Name Add1
      Rule Type Simple Scaling Rule
      Operation Add 1 Instances
    4. Find the Add1 scaling rule and click Execute in the Actions column.

    5. In the confirmation dialog box, click OK. Auto Scaling launches one ECS instance and holds it in the Pending Add state while the ESSHookForRunCommand lifecycle hook is active. Auto Scaling notifies OOS to run the O&M tasks in the ACS-ESS-LifeCycleRunCommand template.

    Verify the results

    After triggering the scale-out event, verify that the script ran successfully using one of the following methods.

    Method 1: Check the OOS execution log

    Check the OOS execution log to confirm the script ran and to diagnose failures without needing access to the instance.

    1. Log on to the OOS console.

    2. In the left-side navigation pane, choose Automated Tasks > Task Execution Management.

    3. Find the execution record by time and click Details in the Actions column.

    4. On the execution details page: For more information, see View the details of an execution.

      • In the Basic Information section, check the execution ID and status.

      • In the Execution Steps and Results section, click a task node to view step-level details and any error output.

  • Log on to the OOS console.

  • Method 2: Check the instance directly

    1. On the scaling group details page, click the Instances tab.

    2. Find the newly created ECS instance and click its ID in the ECS Instance ID/Name column.

    3. In the left-side navigation pane, click Cloud Assistant.

    4. In the upper-right corner, click Create/Run Command.

    5. Run the following command to check the Apache status. For instructions on running commands via Cloud Assistant, see Create and run a command.

      systemctl status httpd
    6. On the Command Execution Result tab, confirm that Apache is installed and in the Active state. This confirms the ACS-ESS-LifeCycleRunCommand template ran successfully.

    FAQ

    If an Operation and Maintenance (O&M) task fails, find the cause based on the error message in the execution result. For more information, see FAQ.

    Common error messages are as follows:

    Error message

    Cause

    Solution

    Forbidden.Unauthorized message: A required authorization for the specified action is not supplied.

    Auto Scaling is not authorized to perform the specified action.

    Verify that the required permissions are granted to the OOSServiceRole RAM role.

    Forbidden.RAM message: User not authorized to operate on the specified resource, or this API doesn't support RAM.

    The RAM user or RAM role does not have the permissions to operate on the corresponding resource.

    Verify that the OOSServiceRole RAM role has the required permissions. For example, you can grant the sample permissions for the OOS service to the RAM role. You must add operation permissions to the RAM role to ensure that the OOS service can manage the resources specified in the OOS template.

    LifecycleHookIdAndLifecycleActionToken.Invalid message: The specified lifecycleActionToken and lifecycleActionId you provided does not match any in process lifecycle action.

    The ongoing lifecycle action has expired or has been aborted.

    Evaluate the timeout period of the lifecycle hook to ensure that the O&M tasks defined in the OOS template can be completed within the timeout period.

    Troubleshooting

    If an O&M task fails, check the error message in the OOS execution details page. The following table describes common errors and their solutions.

    Error message Solution
    Forbidden.Unauthorized: A required authorization for the specified action is not supplied. Verify that the ESSHookPolicyForRunCommand policy is attached to the OOSServiceRole RAM role as described in Step 1.
    Forbidden.RAM: User not authorized to operate on the specified resource, or this API doesn't support RAM. Verify that the ESSHookPolicyForRunCommand policy is attached to the OOSServiceRole RAM role as described in Step 1.
    LifecycleHookIdAndLifecycleActionToken.Invalid: The specified lifecycleActionToken and lifecycleActionId you provided does not match any in process lifecycle action. The lifecycle hook timed out before the script finished. Increase Timeout Period to allow enough time for your script to complete.

    What's next

    To run scripts on ECS instances that are already in a scaling group, use the rolling update feature: