All Products
Search
Document Center

Auto Scaling:Automatically mount an NAS file system to an ECS instance

Last Updated:Apr 16, 2026

Auto Scaling does not natively support NAS file system integration in scaling configurations. To automate NAS mounting when new ECS instances join a scaling group, combine a lifecycle hook with the ACS-ESS-LifeCycleAttachNASFileSystemToInstance public template in CloudOps Orchestration Service (OOS).

How it works

When a scale-out event occurs, the lifecycle hook intercepts the new ECS instance before it enters service, holding it in the Pending Add state. During this window, OOS runs the ACS-ESS-LifeCycleAttachNASFileSystemToInstance template, which mounts the NAS file system to the instance. After the mount completes, OOS signals Auto Scaling to continue, and the instance enters service.

Scale-out event → Lifecycle hook (Pending Add) → OOS template runs → NAS mounted → CompleteLifecycleAction → Instance in service

This approach applies to Linux ECS instances only.

Prerequisites

Before you begin, ensure that you have:

  • A scaling group in the Enabled state

  • A File Storage NAS file system with a mount target configured. The mount target must meet the following requirements:

    • Network type: matches the scaling group's network type. If the scaling group uses a virtual private cloud (VPC), the mount target must use VPC and reside in the same VPC. If the scaling group uses classic network, the mount target must also use classic network.

    • Protocol: Network File System (NFS)

  • A RAM role for OOS with the following settings:

    • Trusted entity: Alibaba Cloud Service

    • Trusted service: CloudOps Orchestration Service

This guide uses OOSServiceRole as the example RAM role name. You can use a different role.

Step 1: Grant the RAM role permissions on OOS

The ACS-ESS-LifeCycleAttachNASFileSystemToInstance template needs permissions to call ECS, Auto Scaling, and NAS APIs on your behalf. Create a custom policy and attach it to your OOS RAM role.

Create the policy

  1. Log on to the RAM console.

  2. In the left-side navigation pane, choose Permissions > Policies.

  3. Click Create Policy.

  4. On the Create Policy page, click the JSON tab and enter the following policy document:

    {
        "Version": "1",
        "Statement": [
            {
                "Action": [
                    "ecs:DescribeInvocations",
                    "ecs:RunCommand",
                    "ecs:DescribeInvocationResults",
                    "ecs:DescribeInstances"
                ],
                "Resource": "*",
                "Effect": "Allow"
            },
            {
                "Action": [
                    "ess:CompleteLifecycleAction"
                ],
                "Resource": "*",
                "Effect": "Allow"
            }
        ]
    }
  5. Set Name to ESSHookPolicyForAttachNAS, then click OK.

Attach the policy to the RAM role

  1. In the left-side navigation pane, choose Identities > Roles.

  2. Find OOSServiceRole and click Grant Permission in the Actions column.

  3. In the Grant Permission panel, configure the following settings and click Grant permissions:

    Parameter Value
    Resource Scope Account
    Policies ESSHookPolicyForAttachNAS (custom policy)

Step 2: Create a lifecycle hook and trigger a scale-out

Create the lifecycle hook

  1. Log on to the Auto Scaling console.

  2. In the left-side navigation pane, click Scaling Groups.

  3. In the top navigation bar, select your region.

  4. Find your scaling group and click its ID or click Details in the Actions column.

  5. On the details page, click the Lifecycle Hook tab, then click Create Lifecycle Hook.

  6. Configure the following parameters and click OK: For Send Notification When Lifecycle Hook Takes Effect, configure the OOS template parameters:

    Set Timeout Period long enough for the mount operation to complete. If the timeout expires before the operation finishes, the lifecycle hook action fails. Estimate the time needed and add a buffer.
    Parameter Value
    Name ESSHookForAttachNAS
    Scaling Activity Scale-out Event
    Timeout Period 300 (seconds)
    Default Execution Policy Continue
    Send Notification When Lifecycle Hook Takes Effect OOS Template > Public Templates > ACS-ESS-LifeCycleAttachNASFileSystemToInstance
    Parameter Description Example
    mountTargetDomain Domain name of the NAS mount target <your-mount-target-domain>
    MountDir Directory on the ECS instance where the NAS file system is mounted /mnt (default)
    FileSystemVersion NFS protocol version: 0 for NFSv4, 1 for NFSv3 0
    RateControl Execution rate: Batch-based Control or Concurrency-based Control Concurrency-based Control
    OOSAssumeRole The RAM role OOS assumes to run the template OOSServiceRole

Trigger a scale-out event

Lifecycle hooks take effect only when scaling activities are triggered by executing scaling rules — not when you manually add or remove instances.

This example uses a simple scaling rule to trigger a scale-out.

  1. On the scaling group details page, click the Scaling Rules and Event-triggered Tasks tab.

  2. On the Scaling Rules tab, click Create Scaling Rule.

  3. Configure the following settings and click OK:

    Parameter Value
    Rule Name Add1
    Rule Type Simple Scaling Rule
    Operation Add 1 Instances
  4. Find the Add1 scaling rule and click Execute in the Actions column.

  5. In the Execute Scaling Rule message, click OK.

Auto Scaling adds one ECS instance to the scaling group. The instance enters the Pending Add state while the ESSHookForAttachNAS lifecycle hook is active. During this window, Auto Scaling notifies OOS to run the ACS-ESS-LifeCycleAttachNASFileSystemToInstance template and mount the NAS file system.

Verify the mount

  1. On the scaling group details page, click the Instances tab.

  2. Find the newly created ECS instance and click its ID in the ECS Instance ID/Name column.

  3. In the Basic Information section, click Connect and log on to the instance.

  4. Run the following command to confirm the NAS file system is mounted:

    df -h | grep aliyun

    If the NAS mount path appears in the output, the file system is mounted successfully. To check the NFS protocol version, run:

    nfsstat -c

    Client nfs v4 in the output indicates NFSv4.

    attachnas-result

If the instance has no NAS file system attached, check the OOS execution details in Step 3.

Step 3 (optional): View the OOS execution

If mounting failed or you want to inspect what the template did, review the execution in the OOS console.

  1. Log on to the OOS console.

  2. In the left-side navigation pane, choose Automated Task > Task Execution Management.

  3. Find the execution by time and click Details in the Actions column.

  4. In the Basic Information section, check the execution ID and status. In the Execution Steps and Results section, click a task node to see the detailed output. If the execution failed, an error message is displayed on this page. For more information, see View the details of an execution.

FAQ

If an Operation and Maintenance (O&M) task fails, find the cause based on the error message in the execution result. For more information, see FAQ.

Common error messages are as follows:

Error message

Cause

Solution

Forbidden.Unauthorized message: A required authorization for the specified action is not supplied.

Auto Scaling is not authorized to perform the specified action.

Verify that the required permissions are granted to the OOSServiceRole RAM role.

Forbidden.RAM message: User not authorized to operate on the specified resource, or this API doesn't support RAM.

The RAM user or RAM role does not have the permissions to operate on the corresponding resource.

Verify that the OOSServiceRole RAM role has the required permissions. For example, you can grant the sample permissions for the OOS service to the RAM role. You must add operation permissions to the RAM role to ensure that the OOS service can manage the resources specified in the OOS template.

LifecycleHookIdAndLifecycleActionToken.Invalid message: The specified lifecycleActionToken and lifecycleActionId you provided does not match any in process lifecycle action.

The ongoing lifecycle action has expired or has been aborted.

Evaluate the timeout period of the lifecycle hook to ensure that the O&M tasks defined in the OOS template can be completed within the timeout period.

Troubleshooting

If an operations and maintenance (O&M) task fails, check the error message in the OOS execution result. For more information, see FAQ.

Error message Cause Solution
Forbidden.Unauthorized: A required authorization for the specified action is not supplied. The RAM role lacks the required permissions to perform the action. Verify that OOSServiceRole has the ESSHookPolicyForAttachNAS policy attached.
Forbidden.RAM: User not authorized to operate on the specified resource, or this API doesn't support RAM. The RAM role does not have permissions on the required resources. Check the permissions attached to OOSServiceRole. The role must have permissions on ECS, Auto Scaling, and NAS resources as defined in the policy document in Step 1.
LifecycleHookIdAndLifecycleActionToken.Invalid: The specified lifecycleActionToken and lifecycleActionId you provided does not match any in process lifecycle action. The lifecycle hook action already ended or was stopped before OOS completed. Increase the Timeout Period of the lifecycle hook so that the mount operation has enough time to complete.