Tair (Redis® OSS-Compatible):Automatically add ECS instances to and remove them from the whitelist of a Redis instance

How it works

When a lifecycle hook fires, Auto Scaling holds the new (or terminating) ECS instance in a Pending Add state and triggers OOS to run the ACS-ESS-LifeCycleModifyRedisIPWhitelist template. The template retrieves the instance's private IP address and adds it to (or removes it from) the Tair instance whitelist. After the template finishes, OOS completes the lifecycle action.

Scale-out event
  Auto Scaling adds ECS instance
        |
        v
  Lifecycle hook fires -> instance enters Pending Add state
        |
        v
  OOS runs ACS-ESS-LifeCycleModifyRedisIPWhitelist
        |
        v
  Private IP added to Tair whitelist
        |
        v
  Lifecycle action completed -> instance enters InService state

The Default Execution Policy of a lifecycle hook determines what happens if the OOS template fails or the timeout expires. If set to Continue, the instance continues even if the whitelist update fails — the instance will not be able to connect to Tair. If set to Reject, the lifecycle action is rejected. Choose Reject for stricter access control, or Continue if you prefer availability over strict whitelist enforcement.

Prerequisites

Before you begin, make sure that you have:

• A scaling group in the Enabled state

• A Tair (Redis OSS-compatible) instance

• A Resource Access Management (RAM) role for OOS, with Alibaba Cloud Service as the trusted entity and CloudOps Orchestration Service as the trusted service, and with the permissions to perform operations on the OOS template. For details, see Use RAM to grant permissions to OOS.

This tutorial uses OOSServiceRole as the example RAM role name. You can use any role that meets the requirements above.

Step 1: Grant the OOS RAM role the required permissions

The ACS-ESS-LifeCycleModifyRedisIPWhitelist template needs to describe ECS instances, modify Tair security IPs, and complete lifecycle actions. Create a permission policy that grants exactly these three actions, then attach it to the OOS RAM role.

1. Log on to the RAM console.

2. Create a permission policy.

   1. In the left-side navigation pane, choose Permissions > Policies.

   2. Click Create Policy.

   3. On the Create Policy page, click the JSON tab and enter the following policy document, then click OK.

      Parameter	Value
      Name	ESSHookPolicyForRedisWhitelist
      Policy document	See JSON below

      {
          "Version": "1",
          "Statement": [
              {
                  "Action": [
                      "ecs:DescribeInstances"
                  ],
                  "Resource": "*",
                  "Effect": "Allow"
              },
              {
                  "Action": [
                      "kvstore:ModifySecurityIps"
                  ],
                  "Resource": "*",
                  "Effect": "Allow"
              },
              {
                  "Action": [
                      "ess:CompleteLifecycleAction"
                  ],
                  "Resource": "*",
                  "Effect": "Allow"
              }
          ]
      }

3. Attach the policy to the OOS RAM role.

   1. In the left-side navigation pane, choose Identities > Roles.

   2. Find the OOSServiceRole RAM role and click Grant Permission in the Actions column.

   3. In the Grant Permission panel, configure the following settings and click Grant permissions.

      Parameter	Value
      Resource scope	Account
      Policy	ESSHookPolicyForRedisWhitelist (custom policy)

Step 2: Create a lifecycle hook

Create a lifecycle hook that triggers OOS when a scale-out event occurs.

1. Log on to the Auto Scaling console.

2. Log on to the Auto Scaling console.

3. In the left-side navigation pane, click Scaling Groups.

4. In the top navigation bar, select a region.

5. Find the scaling group and click its ID (or click Details in the Actions column) to open the details page.

6. On the Lifecycle Hook tab, click Create Lifecycle Hook.

7. Configure the following parameters and click OK. In the template configuration, also set:

   Parameter	Value
   Name	ESSHookForAddRedisWhitelist
   Scaling Activity	Scale-out Event
   Timeout Period	300 (seconds). Set this to longer than the time required for OOS to complete the whitelist update. If the timeout expires before OOS finishes, the default execution policy takes effect.
   Default Execution Policy	Continue (or Reject — see the note in How it works)
   Send Notification When Lifecycle Hook Takes Effect	Select OOS Template > Public Templates > ACS-ESS-LifeCycleModifyRedisIPWhitelist

   Template parameter	Value
   dbInstanceId	The ID of your Tair instance
   modifyMode	Append (adds the IP on scale-out)
   OOSAssumeRole	OOSServiceRole

Lifecycle hooks fire only when scaling events are triggered by scaling rules (manual execution, scheduled tasks, or event-triggered tasks). They do not fire when you manually add or remove ECS instances in the console.

Step 3: Trigger a scale-out event and verify the result

Trigger a scale-out to confirm that the lifecycle hook and OOS template work end-to-end.

Set up scale-in (remove IPs on termination)

To automatically remove private IP addresses from the whitelist when instances terminate, create a separate lifecycle hook for scale-in events.

Follow Step 2: Create a lifecycle hook, with these changes:

The scale-in lifecycle hook works the same way: when Auto Scaling terminates an instance, OOS retrieves the instance's private IP and removes it from the Tair whitelist before the instance is fully terminated.

Check the OOS execution (optional)

If the whitelist was not updated after a scaling event, inspect the OOS execution to diagnose the issue.

1. Log on to the OOS console.

2. Log on to the OOS console.

3. In the left-side navigation pane, choose Automated Task > Task Execution Management.

4. Find the execution by time and click Details in the Actions column.

5. In the Basic Information section, check the execution status. In the Execution Steps and Results section, click a task node to view its output. For details on reading execution results, see View the details of an execution.

FAQ

Troubleshooting

For more OOS troubleshooting information, see FAQ.