Purpose of This Lesson

This hands-on lesson demonstrates how to use an Amazon EC2 Auto Scaling lifecycle hook to pause instance termination long enough for an AWS Lambda function to create snapshots of the instances’ root Amazon EBS volumes.

The workflow uses the AWS CLI, Amazon SNS, AWS Lambda, IAM, and CloudWatch Logs. The scenario is useful for business continuity: preserve a volume snapshot before an Auto Scaling instance is permanently terminated.

Key Concepts

• Auto Scaling lifecycle hook: Allows custom actions during an EC2 instance transition, such as launch or termination.
• Termination lifecycle hook: Pauses an instance while an external process performs required work.
• Lifecycle action notification: The hook sends event information, including the instance ID, to a notification target.
• Amazon SNS topic: Receives the lifecycle notification and forwards it to subscribed consumers.
• AWS Lambda: Processes the SNS message, identifies the relevant EC2 instance and root EBS volume, and creates a snapshot.
• IAM service role: Allows the Auto Scaling service to publish lifecycle notifications to the SNS topic.
• Lambda execution role: Allows Lambda to publish to SNS, inspect EC2 instances and volumes, create snapshots, and write CloudWatch Logs.
• Heartbeat and default result: Lifecycle hook settings determine how long the action can wait and what happens if the lifecycle action is not completed.
• CloudWatch Logs: Provides evidence that Lambda received the event and helps troubleshoot execution errors.

Technical Workflow: Preserving EBS Data Before Termination

The lab assumes an Auto Scaling group with two running instances. The load balancer from the preceding lab is not required for the lifecycle-hook exercise.

End-to-end sequence

1. Create an Amazon SNS topic.
2. Create an Auto Scaling lifecycle hook for the autoscaling:EC2_INSTANCE_TERMINATING transition.
3. Configure the hook with the SNS topic ARN and the Auto Scaling service role ARN.
4. Create an IAM role that AWS Lambda can assume.
5. Attach an inline policy to the Lambda role with the permissions required by the function.
6. Create a Lambda function using Python and the Lambda execution role.
7. Deploy the supplied Python function code.
8. Subscribe the Lambda function to the SNS topic.
9. Reduce the Auto Scaling group’s desired and minimum capacity to zero to trigger termination.
10. Confirm that the instances enter a terminating lifecycle state rather than immediately disappearing.
11. Review Lambda’s CloudWatch Logs and verify that snapshots are created.
12. After the lifecycle action completes, confirm that the instances terminate normally.

IAM permissions used by the Lambda function

The policy supplied for the lab grants capabilities for:

• Publishing to the configured SNS topic
• Describing EC2 instances
• Describing EBS volumes
• Creating EBS snapshots
• Writing logs to CloudWatch Logs

The SNS topic ARN and AWS account ID must be updated in the policy where indicated. The Auto Scaling service role and Lambda execution role serve different purposes: the former enables Auto Scaling to send the lifecycle notification, while the latter enables Lambda to process it and create the snapshot.

What the Lambda function does

The Python function reads the lifecycle event from the SNS message payload and extracts the instance ID. It then locates the instance, identifies its root EBS volume, and calls the EC2 API to create a snapshot. Execution details and errors are written to CloudWatch Logs.

The lifecycle hook is what holds the instance in the terminating state while this work occurs. The snapshot operation is therefore part of the termination process rather than an unrelated scheduled backup.

CLI and console roles

The lab creates most resources through the AWS CLI in CloudShell, while IAM and Lambda configuration are performed through the console. Lifecycle hooks can also be viewed and managed in the Auto Scaling group’s Instance management area. The same lifecycle hook can be inspected there to verify its transition, heartbeat configuration, and default result.

Exam- or Assessment-Relevant Takeaways

• Recognize a lifecycle hook as the correct feature when an Auto Scaling instance needs custom processing during launch or termination.
• A termination hook can prevent an instance from completing termination while a backup or cleanup workflow runs.
• SNS is used as the notification intermediary between the lifecycle hook and Lambda in this design.
• The lifecycle hook needs an Auto Scaling service role, while Lambda needs a separate execution role with permissions for the actions it performs.
• The Lambda function must be subscribed to the SNS topic; creating the topic alone does not invoke the function.
• Instance termination can take several minutes because of the lifecycle action and its wait period.
• CloudWatch Logs are a key troubleshooting point for determining whether Lambda received the event and whether its API calls succeeded.
• When testing by scaling in, set both the desired capacity and minimum capacity appropriately. Leaving the minimum above zero can cause the group to launch replacement instances.
• EBS snapshots persist after the instances are terminated and therefore require separate cleanup if they are only lab resources.

Tool / Feature Decision Guide

Requirement	Appropriate feature or action	Reason
Run custom logic when an Auto Scaling instance terminates	Auto Scaling termination lifecycle hook	It pauses the transition and emits an event for custom processing.
Deliver the lifecycle event to a processing function	SNS topic subscribed by Lambda	SNS provides the notification path used in the lab.
Parse the event and create an EBS snapshot	Lambda	The function can extract the instance ID and call EC2 APIs.
Determine whether the function ran or failed	CloudWatch Logs	Lambda execution streams show received event data and errors.
Allow Auto Scaling to publish lifecycle notifications	Auto Scaling service role	This role is used by the Auto Scaling service for the notification action.
Allow Lambda to inspect EC2 and create snapshots	Lambda execution role and policy	Lambda requires explicit permissions for EC2, SNS, and logging operations.
Preserve data after instance termination	EBS snapshot	A snapshot remains after the source instance is terminated and must be managed separately.

Common Traps / Misconceptions

• Confusing the Auto Scaling role with the Lambda role: They are separate roles with different trust and permission requirements.
• Assuming the load balancer is required: The lab only needs an Auto Scaling group with two instances; the load balancer is not involved in the snapshot workflow.
• Forgetting the subscription: Lambda will not process the SNS notification unless it is subscribed to the topic. If the trigger is not visible, refresh Lambda or add the SNS trigger manually.
• Using the wrong ARN: The lifecycle hook requires the SNS topic ARN, while Lambda configuration and subscription require the Lambda function ARN. The policy also needs the correct topic ARN and account ID.
• Expecting immediate termination: Instances remain in a terminating lifecycle state while the lifecycle action is pending. Several minutes may pass before logs and snapshots appear.
• Treating a successful Lambda invocation as proof of cleanup: The snapshots are retained even after the instances and Auto Scaling group are removed.
• Leaving the minimum capacity unchanged during testing: A minimum capacity greater than zero can cause the Auto Scaling group to launch new instances after scaling in.
• Ignoring CloudWatch Logs: A missing log group or absent log stream can indicate that Lambda has not run yet or that the event path is not working.

Real-World Engineer / Analyst Notes

A termination hook is useful when termination would otherwise destroy information needed for recovery, investigation, or compliance. The hook creates a controlled pause, but it does not by itself guarantee that the custom action completes successfully. Engineers should verify the event path, IAM permissions, Lambda logs, and resulting snapshots.

The lab’s function targets the root EBS volume. In a production design, determine whether additional attached volumes or application-level consistency steps are required before relying on the snapshot. Also consider the lifecycle hook’s heartbeat and default result settings carefully: a workflow that waits too long can delay scale-in, while an unsuitable default result can produce an unexpected outcome if the action does not complete.

Use resource-specific ARNs and least-privilege permissions where practical. After testing, remove the Auto Scaling group, instances, load balancer if present, and snapshots that are no longer needed. Snapshots are persistent resources and may remain after the compute resources have been deleted.

Quick Reference Summary

• Trigger: autoscaling:EC2_INSTANCE_TERMINATING
• Notification path: Auto Scaling lifecycle hook → SNS topic → Lambda subscription
• Lambda task: Extract instance ID, locate the root EBS volume, and create a snapshot
• Roles: Auto Scaling service role for notification delivery; Lambda execution role for processing and API access
• Troubleshooting: Inspect Lambda CloudWatch Logs for event receipt and errors
• Testing method: Set Auto Scaling desired and minimum capacity to zero
• Expected state: Instances remain in a terminating lifecycle state until the lifecycle action proceeds
• Cleanup: Delete the load balancer, Auto Scaling group, instances, and persistent test snapshots as appropriate

Flashcards

Q: An Auto Scaling instance must be backed up immediately before termination. Which feature should initiate the workflow, and why?

A: Use an Auto Scaling termination lifecycle hook. It pauses the termination transition so custom backup logic can run before the instance is fully terminated.

Q: What notification path connects the lifecycle hook to the Lambda function in this lab?

A: The lifecycle hook publishes to an SNS topic, and Lambda is subscribed to that topic. SNS delivers the lifecycle event to the function.

Q: Why is the instance ID extracted from the SNS message by the Lambda function?

A: The instance ID identifies which EC2 instance is undergoing termination. Lambda uses it to find the instance and its root EBS volume before creating the snapshot.

Q: When would you use a lifecycle hook instead of relying on a normal Auto Scaling termination policy alone?

A: Use a lifecycle hook when termination requires custom external work, such as creating a snapshot or performing cleanup. A termination policy by itself does not implement that custom workflow.

Q: What is the difference between the Auto Scaling service role and the Lambda execution role in this architecture?

A: The Auto Scaling service role allows Auto Scaling to publish the lifecycle notification to SNS. The Lambda execution role grants the function permissions to process the event, call EC2 and SNS APIs, and write logs.

Q: Which permissions does the Lambda policy need for the snapshot workflow?

A: It needs permissions to describe instances and volumes, create snapshots, publish to the configured SNS topic, and write CloudWatch Logs. The resource ARNs and account ID must match the lab resources.

Q: The Lambda function exists, but no snapshots are created when an instance terminates. What notification configuration should you check first?

A: Verify that the Lambda function is subscribed to the SNS topic used by the lifecycle hook. Also confirm that the topic ARN is correct and that Lambda shows the SNS trigger.

Q: Why can an instance remain visible in a terminating state for several minutes?

A: The lifecycle hook holds the instance while the lifecycle action is pending. The notification, Lambda invocation, snapshot API calls, and configured wait period can all contribute to the delay.

Q: What happens to the EBS snapshots after the source instances and Auto Scaling group are deleted?

A: The snapshots remain as persistent resources. They must be deleted separately if they were created only for the lab.

Q: During testing, why should both desired capacity and minimum capacity be changed to zero?

A: Setting both prevents the Auto Scaling group from immediately maintaining a nonzero minimum and launching replacement instances after scale-in.

Q: Which service should you inspect to determine whether Lambda received the lifecycle event and encountered an error?

A: Inspect the Lambda function’s CloudWatch Logs. The log streams show received event data and the function’s execution results or errors.

Q: What is the consequence of placing the wrong ARN in the lifecycle hook configuration?

A: The hook may fail to deliver its notification to the intended SNS topic. Distinguish the SNS topic ARN used by the hook and policy from the Lambda function ARN used for the subscription or trigger.

Practice Questions

Question 1

An Auto Scaling group is scaling in. Before an instance disappears, the operations team wants to run a Lambda function that creates an EBS snapshot. Which design best matches the lab workflow?

A. Configure an EC2 user-data script to create a snapshot after termination
B. Configure a termination lifecycle hook that publishes to SNS, with Lambda subscribed to the topic
C. Configure an SNS topic to poll the Auto Scaling group every minute
D. Attach the Lambda function directly to the EBS volume without a lifecycle event

Correct answer: B

The decisive clue is that custom work must occur during termination. The lifecycle hook pauses termination and sends the event through SNS to Lambda.

Question 2

A test run shows that instances are terminating, but no Lambda log stream or snapshots appear. The SNS topic exists and the lifecycle hook references its ARN. What is the most likely configuration issue to investigate first?

A. The load balancer has no healthy targets
B. The Lambda function is not subscribed to the SNS topic
C. The Auto Scaling group has two instances
D. The EBS volumes are attached to EC2 instances

Correct answer: B

Creating the topic and configuring the hook does not invoke Lambda by itself. Lambda must be subscribed to the SNS topic, and the SNS trigger should be visible in the function configuration.

Question 3

An engineer reduces an Auto Scaling group’s desired capacity to zero, but replacement instances continue to launch during the test. Which change is most appropriate?

A. Increase the lifecycle hook heartbeat
B. Delete the SNS topic
C. Set the group’s minimum capacity to zero as well
D. Remove the Lambda execution role

Correct answer: C

A minimum capacity above zero can cause Auto Scaling to launch replacement instances even after desired capacity is reduced.

Question 4

The lifecycle hook is configured correctly, and Lambda logs show that it received the event. Lambda then fails when attempting to create the snapshot. Which permission is directly relevant to this failure?

A. ec2:CreateSnapshot
B. elasticloadbalancing:DescribeLoadBalancers
C. autoscaling:DeleteAutoScalingGroup
D. iam:CreateUser

Correct answer: A

The Lambda execution policy must allow ec2:CreateSnapshot, along with the permissions needed to describe the instance and volume and write logs.

WordPress Metadata

Suggested Slug:
aws-auto-scaling-lifecycle-hook-sns-lambda-ebs-snapshots

Meta Description:
Learn how to use an EC2 Auto Scaling lifecycle hook with Amazon SNS and AWS Lambda to snapshot EBS root volumes before instances terminate.

Tags:
AWS, AWS Certified CloudOps Engineer, EC2 Auto Scaling, Lifecycle Hooks, Amazon SNS, AWS Lambda, Amazon EBS, CloudWatch Logs, Business Continuity