通过 lambda 访问所有 ec2 跨区域

Question

I have lambda function for auto Ami backup is possible to execute lambda across the region for take automatic backup of all my EC2 working on account.

One lambda function execution for all ec2 across region

    var aws = require('aws-sdk');  
aws.config.region = 'us-east-1','ap-south-1','eu-central-1';  
var ec2 = new aws.EC2();  
var now = new Date();  
date = now.toISOString().substring(0, 10)  
hours = now.getHours()  
minutes = now.getMinutes()  
exports.handler = function(event, context) {  
    var instanceparams = {
        Filters: [{
            Name: 'tag:Backup',
            Values: [
                'yes'
            ]
        }]
    }
    ec2.describeInstances(instanceparams, function(err, data) {
        if (err) console.log(err, err.stack);
        else {
            for (var i in data.Reservations) {
                for (var j in data.Reservations[i].Instances) {
                    instanceid = data.Reservations[i].Instances[j].InstanceId;
                    nametag = data.Reservations[i].Instances[j].Tags
                    for (var k in data.Reservations[i].Instances[j].Tags) {
                        if (data.Reservations[i].Instances[j].Tags[k].Key == 'Name') {
                            name = data.Reservations[i].Instances[j].Tags[k].Value;
                        }
                    }
                    console.log("Creating AMIs of the Instance: ", name);
                    var imageparams = {
                        InstanceId: instanceid,
                        Name: name + "_" + date + "_" + hours + "-" + minutes,
                        NoReboot: true
                    }
                    ec2.createImage(imageparams, function(err, data) {
                        if (err) console.log(err, err.stack);
                        else {
                            image = data.ImageId;
                            console.log(image);
                            var tagparams = {
                                Resources: [image],
                                Tags: [{
                                    Key: 'DeleteOn',
                                    Value: 'yes'
                                }]
                            };
                            ec2.createTags(tagparams, function(err, data) {
                                if (err) console.log(err, err.stack);
                                else console.log("Tags added to the created AMIs");
                            });
                        }
                    });
                }
            }
        }
    });
}

where aws.config.region is for region config..it's working for current(in which lambda deploy) region

Answer 1

This line:

var ec2 = new aws.EC2(); 

connects to the Amazon EC2 service in the region where the Lambda function is running.

You can modify it to connect to another region:

var ec2 = new AWS.EC2({apiVersion: '2006-03-01', region: 'us-west-2'});

Thus, your program could loop through a list of regions (from ec2.describeRegions ), creating a new EC2 client for the given region, then running the code you already have.

See: Setting the AWS Region - AWS SDK for JavaScript

Answer 2

In your Lambda Role, you need to add a policy which gives the Lambda function necessary permissions to access the EC2 on different accounts, typically you can add ARN's of EC2 instances you wan't access to or you can specify "*" which gives permissions to all instances.

Also on other accounts where EC2 instances are running you need to add IAM policy which gives access to your Lambda Role, note that you need to provide Lambda role ARN,

In this way your Lambda role will have policy to access EC2 and cross account EC2 will have policy which grant's access to Lambda role.

Without this in place you might need to do heavy lifting of configuring IP's of each EC2 in each account.

Yes and you also need to point EC2 object to a region where the instance is running,

Answer 3

任何代码（包括 Lambda 函数）都可以创建连接到不同区域的客户端。