EBS 快照、加密与 RAID

# Create a snapshot of an EBS volume with a description
aws ec2 create-snapshot \
  --volume-id vol-0abc1234def567890 \
  --description 'Production DB backup 2024-01-01' \
  --tag-specifications 'ResourceType=snapshot,Tags=[{Key=Environment,Value=Production},{Key=Backup,Value=Daily}]'

# Monitor snapshot completion
aws ec2 describe-snapshots \
  --snapshot-ids snap-0abc1234def567890 \
  --query 'Snapshots[].{State:State,Progress:Progress}'

# Create a DLM lifecycle policy for daily snapshots with 7-day retention
aws dlm create-lifecycle-policy \
  --description 'Daily DB snapshots' \
  --state ENABLED \
  --execution-role-arn arn:aws:iam::111122223333:role/AWSDataLifecycleManagerDefaultRole \
  --policy-details '{
    "PolicyType": "EBS_SNAPSHOT_MANAGEMENT",
    "ResourceTypes": ["VOLUME"],
    "TargetTags": [{"Key": "Backup", "Value": "Daily"}],
    "Schedules": [{
      "Name": "DailySnapshots",
      "CreateRule": {"Interval": 24, "IntervalUnit": "HOURS", "Times": ["03:00"]},
      "RetainRule": {"Count": 7}
    }]
  }'

# Copy a snapshot to another region with a new KMS key
aws ec2 copy-snapshot \
  --source-region us-east-1 \
  --source-snapshot-id snap-0abc1234def567890 \
  --destination-region eu-west-1 \
  --description 'DR copy' \
  --encrypted \
  --kms-key-id arn:aws:kms:eu-west-1:111122223333:key/KEY_ID \
  --region eu-west-1

# Share a snapshot with another account
aws ec2 modify-snapshot-attribute \
  --snapshot-id snap-0abc1234def567890 \
  --attribute createVolumePermission \
  --operation-type add \
  --user-ids '999888777666'

# Enable Fast Snapshot Restore for instant full-performance volumes
aws ec2 enable-fast-snapshot-restores \
  --availability-zones us-east-1a us-east-1b \
  --source-snapshot-ids snap-0abc1234def567890

# Create a volume from the snapshot (FSR enabled = full performance immediately)
aws ec2 create-volume \
  --snapshot-id snap-0abc1234def567890 \
  --volume-type gp3 \
  --availability-zone us-east-1a

# Create an encrypted gp3 volume with a customer-managed key
aws ec2 create-volume \
  --volume-type gp3 \
  --size 100 \
  --encrypted \
  --kms-key-id arn:aws:kms:us-east-1:111122223333:key/KEY_ID \
  --availability-zone us-east-1a

# Enable encryption by default for all new volumes in a region
aws ec2 enable-ebs-encryption-by-default

aws ec2 get-ebs-encryption-by-default
# { "EbsEncryptionByDefault": true }

# Step-by-step: encrypt an existing unencrypted volume

# 1. Snapshot the unencrypted volume
aws ec2 create-snapshot --volume-id vol-UNENCRYPTED --description 'Pre-encryption backup'

# 2. Copy snapshot with encryption
aws ec2 copy-snapshot \
  --source-region us-east-1 \
  --source-snapshot-id snap-UNENCRYPTED \
  --region us-east-1 \
  --encrypted \
  --kms-key-id alias/aws/ebs

# 3. Create encrypted volume from the encrypted snapshot
aws ec2 create-volume \
  --snapshot-id snap-ENCRYPTED \
  --volume-type gp3 \
  --availability-zone us-east-1a

# Set up RAID 0 across two EBS volumes on Linux
# (After creating and attaching two gp3 volumes)

# Install mdadm
sudo yum install -y mdadm

# Create a RAID 0 array across /dev/xvdf and /dev/xvdg
sudo mdadm --create /dev/md0 \
  --level=0 \
  --raid-devices=2 \
  /dev/xvdf /dev/xvdg

# Format and mount
sudo mkfs.xfs /dev/md0
sudo mkdir /mnt/raid0
sudo mount /dev/md0 /mnt/raid0

# RAID 1 example (mirroring) — rarely needed with EBS
sudo mdadm --create /dev/md1 \
  --level=1 \
  --raid-devices=2 \
  /dev/xvdh /dev/xvdi

# RAID 1 performance:
# Read: up to 2x (both disks can serve reads)
# Write: same as a single volume (data written to both)
# Fault tolerance: survives single volume failure

# Create an AMI from a running EC2 instance
aws ec2 create-image \
  --instance-id i-0abc1234def567890 \
  --name 'MyApp-v2.0-2024-01-01' \
  --description 'Application server AMI with v2.0 release' \
  --no-reboot

# List snapshots backing an AMI
aws ec2 describe-images \
  --image-ids ami-0abc1234def567890 \
  --query 'Images[].BlockDeviceMappings[].Ebs.SnapshotId'

# Deregister AMI then delete its snapshots separately
aws ec2 deregister-image --image-id ami-0abc1234def567890
aws ec2 delete-snapshot --snapshot-id snap-0abc1234def567890

# Freeze filesystem on Linux before snapshotting
# (Example for ext4 filesystem)
sudo fsfreeze -f /mnt/data  # Freeze writes
aws ec2 create-snapshot --volume-id vol-0abc1234 --description 'Consistent snapshot'
sudo fsfreeze -u /mnt/data  # Unfreeze

# AWS Backup policy for EBS volumes
aws backup create-backup-plan \
  --backup-plan '{
    "BackupPlanName": "EBSDaily",
    "Rules": [{
      "RuleName": "DailyRule",
      "TargetBackupVaultName": "Default",
      "ScheduleExpression": "cron(0 3 * * ? *)",
      "DeleteAfterDays": 30
    }]
  }'

# Create a Recycle Bin retention rule for EBS snapshots
aws rbin create-rule \
  --retention-period RetentionPeriodValue=30,RetentionPeriodUnit=DAYS \
  --resource-type EBS_SNAPSHOT \
  --description '30-day retention for all EBS snapshots'

# List snapshots currently in the Recycle Bin
aws rbin list-resources \
  --resource-type EBS_SNAPSHOT \
  --query 'Resources[].{SnapshotId:ResourceId,DeleteDate:DeleteScheduledAt}'