Tagging solutions overview<\/h2>\n
![\"aws](\"https:\/\/vticloud.io\/wp-content\/uploads\/2020\/12\/aws-tagging.png\")
<\/p>\n
- \n
- \n
User initializes resources on AWS. In this example will be the initialization of EC2 Instance with EBS Volume.<\/p>\n<\/li>\n
- \n
AWS CloudTrail<\/strong> will log the API event.<\/p>\n<\/li>\n
- \n
EventBridge<\/strong> will trigger a Lambda function, for example, event: RunInstance.<\/em><\/p>\n<\/li>\n
- \n
Lambda function<\/strong> will be responsible for tagging resources.<\/p>\n<\/li>\n<\/ol>\n
When the Lambda function is successfully triggered by the initialization resource, it will tag the resource with:<\/p>\n
- \n
- \n
IAM User v\u00e0 Assume Role:<\/p>\n
- \n
- \n
Key: Owner<\/em><\/p>\n<\/li>\n
- \n
Value: example@company.xyz<\/em><\/p>\n<\/li>\n<\/ul>\n<\/li>\n
- \n
Root User:<\/p>\n
- \n
- \n
Key: Owner<\/em><\/p>\n<\/li>\n
- \n
Value: Root<\/em><\/p>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
![\"tagging](\"https:\/\/vticloud.io\/wp-content\/uploads\/2020\/12\/tagging-1-1024x403.png\")
<\/p>\nInstallation Steps<\/strong><\/h2>\n
Let’s first go through some of the services that you need to use in this article. Most of them are the core services that AWS provides such as CloudTrail, EventBridge<\/strong> (an extremely “genuine” upgrade version of CloudWatch Events), Lambda <\/strong>or IAM policy<\/strong>, …<\/p>\n
1. CloudTrail: Trail (Multi-region)<\/span><\/strong><\/h3>\n
![\"aws](\"https:\/\/vticloud.io\/wp-content\/uploads\/2020\/12\/aws-cloudtrail.png\")
<\/p>\nAWS CloudTrail works as a supervisor. All actions on AWS accounts are logged by CloudTrail as events. Trail is a setting that helps you handle events. For example: saving to S3, encrypted with AWS KMS,…<\/p>\n
First, you need to have Trail to detect and respond to API events when creating resources. Trail can be easily created on the AWS Console, refer here<\/a><\/span>.<\/p>\n
With the successful setup, EC2 RunInstances API<\/strong> will give you a lot of information such as the time to create eventTime<\/strong> resource, the id<\/strong> of the newly created EC2 instanceID<\/strong>, the userID<\/strong> of the resource creator principalId<\/strong>.\u00a0<\/span><\/p>\n
![\"aws](\"https:\/\/vticloud.io\/wp-content\/uploads\/2020\/12\/aws-cloudtrail-event-record.png\")
<\/p>\nLearn more about AWS CloudTrail.<\/a><\/span><\/p>\n
2. Lambda function<\/strong><\/h3>\n
![\"aws](\"https:\/\/vticloud.io\/wp-content\/uploads\/2020\/12\/aws-lambda-300x99.png\")
<\/p>\nAWS Lambda referred to as Function as a Service (FaaS), is a serverless service for programmers who don’t care about infrastructure when running applications. True to the Function definition, Lambda only runs when called.<\/p>\n
To create a Lambda function, log in to AWS Console, select Lambda, and tick Create Function<\/strong>. We will create a Lambda function with a Runtime Python 3.8<\/strong>. Copy the code is available in GitHub Repo<\/a><\/span>.<\/p>\n
![\"lambda](\"https:\/\/vticloud.io\/wp-content\/uploads\/2020\/12\/lambda-function-github-repo.png\")
<\/p>\nScroll down to Basic settings<\/strong> and edit Timeout<\/strong> to 60s<\/strong> and Memory <\/strong>to\u00a0128MB.<\/strong><\/p>\n
![\"memory](\"https:\/\/vticloud.io\/wp-content\/uploads\/2020\/12\/memory-lambda.png\")
<\/p>\nRemember to click Save \ud83d\ude42<\/p>\n
Learn more about Lambda.<\/a><\/span><\/p>\n
3. Authorize the Lambda function<\/strong><\/h3>\n
![\"lambda](\"https:\/\/vticloud.io\/wp-content\/uploads\/2020\/12\/lambda-permission.png\")
<\/p>\nIn the Lambda interface click on the Permission<\/strong> tab, there will be an item Execution role.<\/em> Click on Role name that will direct you through the IAM tab. Here we will add an inline policy, select the JSON tab, and paste the following IAM policy:<\/p>\n
\r\n{\r\n \"Version\": \"2012-10-17\",\r\n \"Statement\": [\r\n {\r\n \"Sid\": \"VisualEditor0\",\r\n \"Effect\": \"Allow\",\r\n \"Action\": \"ec2:CreateTags\",\r\n \"Resource\": [\r\n \"arn:aws:ec2:*:*:instance\/*\",\r\n \"arn:aws:ec2:*:*:volume\/*\"\r\n ]\r\n },\r\n {\r\n \"Sid\": \"VisualEditor1\",\r\n \"Effect\": \"Allow\",\r\n \"Action\": [\r\n \"ec2:DescribeInstances\",\r\n \"ec2:DescribeVolumes\"\r\n ],\r\n \"Resource\": \"*\"\r\n }\r\n ]\r\n}\r\n<\/code><\/pre>\nThe above policy will allow the Lambda function to find the instance volume and tagging both the EC2 instance<\/strong> and the instance volume.<\/strong> Click Review policy<\/strong>, enter a name, and Create policy<\/strong>.<\/p>\n
Learn more about IAM Policy. <\/a><\/span><\/p>\n
4. Trigger Lambda function from AWS EventBridge<\/strong><\/h3>\n
![\"aws](\"https:\/\/vticloud.io\/wp-content\/uploads\/2020\/12\/aws-eventbridge-1024x450.png\")
<\/p>\nAWS EventBridge<\/strong> provides real-time data flow (events, …) from your own applications, and routes that data to targets like AWS Lambda.<\/strong><\/p>\n
In this section, we will use EventBridge<\/strong> to trigger the Lambda function<\/em>.<\/p>\n
Select Create rule. <\/strong>In this section, you need to define a pattern according to the steps below:<\/p>\n
- \n
- \n
Select Event pattern.<\/strong><\/p>\n<\/li>\n
- \n
In Event matching pattern, <\/strong>select\u00a0Pre-defined pattern.<\/strong><\/p>\n<\/li>\n
- \n
Next, in Service provider<\/strong> and Service name,<\/strong> select AWS<\/strong> and EC2.<\/strong><\/p>\n<\/li>\n
- \n
In event type, select AWS API Call via CloudTrail.<\/strong><\/p>\n<\/li>\n
- \n
Finally, select Specific operation<\/strong>, here you enter RunInstance.<\/strong><\/p>\n<\/li>\n<\/ul>\n
![\"define](\"https:\/\/vticloud.io\/wp-content\/uploads\/2020\/12\/define-patern.png\")
<\/p>\n - \n
- \n
- \n
- \n
- \n
![\"tagging](\"https:\/\/vticloud.io\/wp-content\/uploads\/2020\/12\/results-1024x262.png\")
<\/p>\n