Template name
ACS-ECS-BulkyEncryptSystemDisk Bulk-encrypt system disks
Template description
Encrypts the system disks of multiple Elastic Compute Service (ECS) instances at a time.
Template type
Automated
Owner
Alibaba Cloud
Input parameters
Parameter | Description | Type | Required | Default value | Limit |
targets | Target instance | Json | Yes | ||
KMSKeyId | The ID of the Key Management Service (KMS) key that you want to use to encrypt the system disks. | String | Yes | ||
regionId | The region ID. | String | No | {{ ACS::RegionId }} | |
rateControl | Task execution concurrency ratio | Json | No | {'Mode': 'Concurrency', 'MaxErrors': 0, 'Concurrency': 10} | |
OOSAssumeRole | The Resource Access Management (RAM) role that is assumed by CloudOps Orchestration Service (OOS). | String | No | "" |
Output parameters
Parameter | Description | Type |
systemDiskEncryptedInstances | Json |
Permission policy that is required to execute the template
{
"Version": "1",
"Statement": [
{
"Action": [
"ecs:CopyImage",
"ecs:CreateImage",
"ecs:CreateSnapshot",
"ecs:DeleteImage",
"ecs:DeleteSnapshot",
"ecs:DescribeDisks",
"ecs:DescribeImages",
"ecs:DescribeInstances",
"ecs:DescribeSnapshots",
"ecs:ReplaceSystemDisk",
"ecs:StartInstance",
"ecs:StopInstance"
],
"Resource": "*",
"Effect": "Allow"
},
{
"Action": [
"oos:GetApplicationGroup"
],
"Resource": "*",
"Effect": "Allow"
}
]
}
Details
For more information, see ACS-ECS-BulkyEncryptSystemDisk.yml at GitHub.
Template content
FormatVersion: OOS-2019-06-01
Description:
en: Bulky encrypt the system disks
zh-cn: Bulky encrypt the system disks
name-en: ACS-ECS-BulkyEncryptSystemDisk
name-zh-cn: ACS-ECS-BulkyEncryptSystemDisk
categories:
- security
Parameters:
regionId:
Type: String
Label:
en: RegionId
zh-cn: Region ID
AssociationProperty: RegionId
Default: '{{ ACS::RegionId }}'
targets:
Type: Json
Label:
en: TargetInstance
zh-cn: Target Instance
AssociationProperty: Targets
AssociationPropertyMetadata:
ResourceType: 'ALIYUN::ECS::Instance'
RegionId: regionId
KMSKeyId:
Label:
en: KMSKeyId
zh-cn: The ID of the KMS key used for image encryption
AssociationProperty: ALIYUN::KMS::Key::KeyId
AssociationPropertyMetadata:
RegionId: regionId
Type: String
rateControl:
Label:
en: RateControl
zh-cn: The concurrency rate for task execution
Type: Json
AssociationProperty: RateControl
Default:
Mode: Concurrency
MaxErrors: 0
Concurrency: 10
OOSAssumeRole:
Label:
en: OOSAssumeRole
zh-cn: The RAM role that OOS assumes
Type: String
Default: ''
RamRole: '{{ OOSAssumeRole }}'
Tasks:
- Name: getInstance
Description:
en: Views the ECS instances
zh-cn: Views the ECS instances
Action: ACS::SelectTargets
Properties:
ResourceType: ALIYUN::ECS::Instance
RegionId: '{{ regionId }}'
Filters:
- '{{ targets }}'
Outputs:
instanceIds:
Type: List
ValueSelector: Instances.Instance[].InstanceId
- Name: encryptSystemDisk
Action: ACS::ECS::EncryptSystemDisk
Description:
en: Bulky encrypt the system disks
zh-cn: Bulky encrypt the system disks
Properties:
regionId: '{{ regionId }}'
instanceId: '{{ ACS::TaskLoopItem }}'
KMSKeyId: '{{ KMSKeyId }}'
Outputs:
systemDiskEncryptedInstance:
Type: String
ValueSelector: .systemDiskEncryptedInstance
Loop:
RateControl: '{{ rateControl }}'
Items: '{{ getInstance.instanceIds }}'
Outputs:
systemDiskEncryptedInstances:
AggregateType: Fn::ListJoin
AggregateField: systemDiskEncryptedInstance
Outputs:
systemDiskEncryptedInstances:
Type: Json
Value:
Fn::Jq:
- First
- '[.[][]]|.|= map(select(.))'
- '{{ encryptSystemDisk.systemDiskEncryptedInstances }}'
Metadata:
ALIYUN::OOS::Interface:
ParameterGroups:
- Parameters:
- regionId
- targets
- instancePassword
Label:
default:
zh-cn: Select ECS Instances
en: Select Ecs Instances
- Parameters:
- KMSKeyId
Label:
default:
zh-cn: Configure KMS Key
en: Configure KMSKey
- Parameters:
- rateControl
- OOSAssumeRole
Label:
default:
zh-cn: Advanced Options
en: Control Options