L'action ACS::Approve permet d'approuver des tâches.
Description
Lors des opérations de maintenance automatisées, certaines actions requièrent une vigilance particulière, comme la suppression de ressources critiques ou l'achat d'instances coûteuses. Une automatisation totale de ces opérations pourrait entraîner une perte de contrôle sur vos ressources ou un dépassement du seuil budgétaire. À l'inverse, renoncer à l'automatisation vous obligerait à les exécuter manuellement ou via d'autres processus non automatisés. L'action ACS::Approve offre un compromis entre l'exécution automatique et les opérations nécessitant une validation humaine.
Lorsqu'un modèle intègre une action ACS::Approve, le moteur d'exécution du service CloudOps Orchestration Service (OOS) suspend l'exécution des opérations suivantes, définit l'état de l'exécution sur Waiting (En attente), puis envoie une notification aux administrateurs. En tant qu'administrateur, vous recevez cette notification et pouvez décider d'approuver ou de rejeter l'opération selon vos besoins métier. Si l'opération est approuvée, le moteur d'exécution OOS poursuit les opérations suivantes. Si elle est rejetée, le moteur arrête l'exécution et définit son état sur Canceled (Annulé).
Syntaxe Webhook
Configurez des webhooks pour envoyer des notifications à des clients tels que DingTalk.
Format YAML
Tasks:
- Name: approvalTask
Action: ACS::Approve
Properties:
AppendExecutionLink: 'true' # Specifies whether to append execution links. Valid values: true and false. Default value: true.
Approvers: ["user1", "user2", "user3"] # The names of the Resource Access Management (RAM) users that act as approvers.
MinRequiredApprovals: 2 # The minimum number of approvers that are required to approve the task.
NotifyType: WebHook
WebHook:
URI: url # Required. The webhook URL. Example: https://oapi.dingtalk.com/robot/send?access_token=xxxxxx.
Headers: # Optional. The headers of the HTTP request. Example: Content-Type.
Content-Type: 'application/json; charset=utf-8'
Content: # Required. The content of the webhook notification. Set the value based on the requirements for the webhook. For information about the content of the DingTalk webhook, visit https://open-doc.dingtalk.com/docs/doc.htm?treeId=257&articleId=105735&docType=1.
msgtype: text
text:
content: 'the approve notify to user' # Required. The content of the approval notification.
at: # The users that are @ in the DingTalk group.
atMobiles: # Optional. The users that are @ in the DingTalk group. Specify the users by using the mobile numbers that they use to create their DingTalk accounts.
- 138albb1234
- 130albb1234
isAtAll: 'false' # Optional. Specifies whether to @ all users in the DingTalk group. Valid values: true and false. Default value: false.Format JSON (pour plus d'informations, consultez les descriptions des attributs du format YAML.)
{
"Tasks": [
{
"Name": "approvalTask",
"Action": "ACS::Approve",
"Properties": {
"AppendExecutionLink": "true",
"Approvers": [
"user1",
"user2",
"user3"
],
"MinRequiredApprovals": 2,
"NotifyType": "WebHook",
"WebHook": {
"URI": "url",
"Headers": {
"Content-Type": "application/json; charset=utf-8"
},
"Content": {
"msgtype": "text",
"text": {
"content": "the approve notify to user"
},
"at": {
"atMobiles": [
"138albb1234",
"130albb1234"
],
"isAtAll": "false"
}
}
}
}
}
]
}Exemples de Webhook
Les modèles suivants permettent de supprimer une instance Elastic Compute Service (ECS) après approbation.
Format YAML
---
FormatVersion: OOS-2019-06-01
Description:
en: Bulky restarts the ECS instances with Approval.
name-en: BulkyRebootInstancesWithApproval
Parameters:
targets:
Type: Json
AssociationProperty: Targets
AssociationPropertyMetadata:
ResourceType: 'ALIYUN::ECS::Instance'
rateControl:
Description:
en: Concurrency ratio of task execution.
Type: Json
AssociationProperty: RateControl
Default:
Mode: Concurrency
MaxErrors: 0
Concurrency: 100%
webHookUrl:
Description:
en: >-
The webHook url of dingtalk group assistant,
e.g.https://oapi.dingtalk.com/robot/send?access_token=1234zxcvaksdq31414.
Type: String
atMobiles:
Description:
en: >-
The telephone numbers of member in dingtalk group assistant @, when
notify comes.
Type: List
Default:
- '1390000****'
atAll:
Description:
en: 'assistant @ all members in dingtalk group or not, when notify comes.'
Type: String
Default: 'false'
OOSAssumeRole:
Description:
en: The RAM role to be assumed by OOS.
Type: String
Default: OOSServiceRole
RamRole: '{{ OOSAssumeRole }}'
Tasks:
- Name: getInstance
Description:
en: Views the ECS instances.
Action: 'ACS::SelectTargets'
Properties:
ResourceType: 'ALIYUN::ECS::Instance'
Filters:
- '{{ targets }}'
Outputs:
instanceIds:
Type: List
ValueSelector: 'Instances.Instance[].InstanceId'
instanceNames:
Type: List
ValueSelector: 'Instances.Instance[].InstanceName'
- Name: approveRestart
Action: 'ACS::Approve'
Properties:
NotifyType: WebHook
WebHook:
URI: '{{webhookUrl}}'
Headers:
Content-Type: application/json
Content:
msgtype: text
text:
content: >-
Notify: please approve instances restart, instance names to
approve are {{getInstance.instanceNames}}, sent by
{{ACS::RegionId}} oos {{ACS::ExecutionId}}.
at:
atMobiles: '{{atMobiles}}'
isAtAll: '{{atAll}}'
- Name: rebootInstance
Action: 'ACS::ECS::RebootInstance'
Description:
en: Restarts the ECS instances.
Properties:
instanceId: '{{ ACS::TaskLoopItem }}'
Loop:
RateControl: '{{ rateControl }}'
Items: '{{ getInstance.instanceIds }}'
Outputs:
instanceIds:
Type: List
Value: '{{ getInstance.instanceIds }}'Format JSON
{
"FormatVersion": "OOS-2019-06-01",
"Description": {
"en": "Bulky restarts the ECS instances with Approval.",
"name-en": "BulkyRebootInstancesWithApproval"
},
"Parameters": {
"targets": {
"Type": "Json",
"AssociationProperty": "Targets",
"AssociationPropertyMetadata": {
"ResourceType": "ALIYUN::ECS::Instance"
}
},
"rateControl": {
"Description": {
"en": "Concurrency ratio of task execution."
},
"Type": "Json",
"AssociationProperty": "RateControl",
"Default": {
"Mode": "Concurrency",
"MaxErrors": 0,
"Concurrency": "100%"
}
},
"webHookUrl": {
"Description": {
"en": "The webHook url of dingtalk group assistant, e.g.https://oapi.dingtalk.com/robot/send?access_token=1234zxcvaksdq31414."
},
"Type": "String"
},
"atMobiles": {
"Description": {
"en": "The telephone numbers of member in dingtalk group assistant @, when notify comes."
},
"Type": "List",
"Default": [
"1390000****"
]
},
"atAll": {
"Description": {
"en": "assistant @ all members in dingtalk group or not, when notify comes."
},
"Type": "String",
"Default": "false"
},
"OOSAssumeRole": {
"Description": {
"en": "The RAM role to be assumed by OOS."
},
"Type": "String",
"Default": "OOSServiceRole"
}
},
"RamRole": "{{ OOSAssumeRole }}",
"Tasks": [
{
"Name": "getInstance",
"Description": {
"en": "Views the ECS instances."
},
"Action": "ACS::SelectTargets",
"Properties": {
"ResourceType": "ALIYUN::ECS::Instance",
"Filters": [
"{{ targets }}"
]
},
"Outputs": {
"instanceIds": {
"Type": "List",
"ValueSelector": "Instances.Instance[].InstanceId"
},
"instanceNames": {
"Type": "List",
"ValueSelector": "Instances.Instance[].InstanceName"
}
}
},
{
"Name": "approveRestart",
"Action": "ACS::Approve",
"Properties": {
"NotifyType": "WebHook",
"WebHook": {
"URI": "{{webhookUrl}}",
"Headers": {
"Content-Type": "application/json"
},
"Content": {
"msgtype": "text",
"text": {
"content": "Notify: please approve instances restart, instance names to approve are {{getInstance.instanceNames}}, sent by {{ACS::RegionId}} oos {{ACS::ExecutionId}}."
},
"at": {
"atMobiles": "{{atMobiles}}",
"isAtAll": "{{atAll}}"
}
}
}
}
},
{
"Name": "rebootInstance",
"Action": "ACS::ECS::RebootInstance",
"Description": {
"en": "Restarts the ECS instances."
},
"Properties": {
"instanceId": "{{ ACS::TaskLoopItem }}"
},
"Loop": {
"RateControl": "{{ rateControl }}",
"Items": "{{ getInstance.instanceIds }}"
}
}
],
"Outputs": {
"instanceIds": {
"Type": "List",
"Value": "{{ getInstance.instanceIds }}"
}
}
}Syntaxe Mail
Format YAML
Tasks:
- Action: ACS::Approve
Name: ApproveByMail
Properties:
NotifyType: Mail
Mail:
Host: SMTPHostAddress # The Simple Mail Transfer Protocol (SMTP) server address. Example: smtp.example1.com.
Port: SMTPPort # The port number of the SMTP server. Example: 465.
Username: sender # The email account that is used to send the notification. Example: usr001@example1.com.
Password: senderPassword # The authorization code of the Internet Message Access Protocol (IMAP) or SMTP service, instead of the password of the email account.
Subject: mailSubject # The subject of the email notification. Example: hello world.
Body: mailBody # The body of the email notification. Example: hello world ! ! !.
From: senderAddress # The email address of the sender. Example: usr001@example1.com.
To: # The email addresses of the recipients. Example: usr1234@example2.com,usr123@example2.com.
- usr123@example2.com
- usr1234@example2.comFormat JSON (pour plus d'informations, consultez les descriptions des attributs du format YAML.)
{
"Tasks": [
{
"Action": "ACS::Approve",
"Name": "ApproveByMail",
"Properties": {
"NotifyType": "Mail",
"Mail": {
"Host": "SMTPHostAddress",
"Port": "SMTPPort",
"Username": "sender",
"Password": "senderPassword",
"Subject": "mailSubject",
"Body": "mailBody",
"From": "senderAddress",
"To": [
"usr123@example2.com,usr1234@example2.com"
]
}
}
}
]
}