💾 EC2終了前ログ退避設計

# CloudWatch Logs Agentのインストール
sudo yum install -y amazon-cloudwatch-agent

# 設定ファイル作成 (/opt/aws/amazon-cloudwatch-agent/etc/config.json)
{
  "logs": {
    "logs_collected": {
      "files": {
        "collect_list": [
          {
            "file_path": "/var/log/application.log",
            "log_group_name": "/aws/ec2/myapp",
            "log_stream_name": "{instance_id}"
          }
        ]
      }
    }
  }
}

# エージェント起動
sudo /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl \
  -a fetch-config \
  -m ec2 \
  -s \
  -c file:/opt/aws/amazon-cloudwatch-agent/etc/config.json

# ライフサイクルフックの作成
aws autoscaling put-lifecycle-hook \
  --lifecycle-hook-name log-backup-hook \
  --auto-scaling-group-name my-asg \
  --lifecycle-transition autoscaling:EC2_INSTANCE_TERMINATING \
  --default-result CONTINUE \
  --heartbeat-timeout 3600 \
  --notification-target-arn arn:aws:sns:region:account:topic

# Lambda関数（Python）でログをS3へアップロード
import boto3
import json

def lambda_handler(event, context):
    ssm = boto3.client('ssm')
    asg = boto3.client('autoscaling')
    
    instance_id = event['detail']['EC2InstanceId']
    
    # Run Commandでログ退避スクリプト実行
    response = ssm.send_command(
        InstanceIds=[instance_id],
        DocumentName='AWS-RunShellScript',
        Parameters={
            'commands': [
                'tar -czf /tmp/logs-$(date +%Y%m%d-%H%M%S).tar.gz /var/log/',
                'aws s3 cp /tmp/logs-*.tar.gz s3://my-bucket/logs/'
            ]
        }
    )
    
    # ライフサイクルフックを完了
    asg.complete_lifecycle_action(
        LifecycleHookName='log-backup-hook',
        AutoScalingGroupName='my-asg',
        LifecycleActionResult='CONTINUE',
        InstanceId=instance_id
    )

# EventBridge ルール（イベントパターン）
{
  "source": ["aws.ec2"],
  "detail-type": ["EC2 Instance State-change Notification"],
  "detail": {
    "state": ["shutting-down", "stopping"]
  }
}

# Lambda関数（Python）
def lambda_handler(event, context):
    ec2 = boto3.client('ec2')
    ssm = boto3.client('ssm')
    
    instance_id = event['detail']['instance-id']
    state = event['detail']['state']
    
    if state == 'shutting-down':
        # 緊急: EBSスナップショット作成
        volumes = ec2.describe_volumes(
            Filters=[{'Name': 'attachment.instance-id', 'Values': [instance_id]}]
        )
        for volume in volumes['Volumes']:
            ec2.create_snapshot(
                VolumeId=volume['VolumeId'],
                Description=f'Emergency backup before termination'
            )

# /etc/systemd/system/log-backup.service
[Unit]
Description=Backup logs to S3 before shutdown
DefaultDependencies=no
Before=shutdown.target

[Service]
Type=oneshot
ExecStart=/usr/local/bin/backup-logs.sh
TimeoutStartSec=90
RemainAfterExit=yes

[Install]
WantedBy=halt.target reboot.target shutdown.target

# /usr/local/bin/backup-logs.sh
#!/bin/bash
TIMESTAMP=$(date +%Y%m%d-%H%M%S)
INSTANCE_ID=$(ec2-metadata --instance-id | cut -d " " -f 2)
LOG_FILE="/tmp/logs-${INSTANCE_ID}-${TIMESTAMP}.tar.gz"

# ログファイルを圧縮
tar -czf ${LOG_FILE} /var/log/application/ 2>/dev/null

# S3にアップロード
aws s3 cp ${LOG_FILE} s3://my-bucket/logs/ --region ap-northeast-1

# 一時ファイル削除
rm -f ${LOG_FILE}

# サービス有効化
sudo systemctl enable log-backup.service

# /etc/cron.d/log-backup
# 1時間ごとにログをS3へバックアップ
0 * * * * root /usr/local/bin/hourly-log-backup.sh

# /usr/local/bin/hourly-log-backup.sh
#!/bin/bash
TIMESTAMP=$(date +%Y%m%d-%H%M)
INSTANCE_ID=$(ec2-metadata --instance-id | cut -d " " -f 2)

# 差分のみを同期（効率的）
aws s3 sync /var/log/application/ \
  s3://my-bucket/logs/${INSTANCE_ID}/ \
  --exclude "*" \
  --include "*.log" \
  --region ap-northeast-1

# または、圧縮してアップロード
tar -czf /tmp/logs-${TIMESTAMP}.tar.gz \
  /var/log/application/*.log

aws s3 cp /tmp/logs-${TIMESTAMP}.tar.gz \
  s3://my-bucket/logs/${INSTANCE_ID}/ \
  --region ap-northeast-1

rm -f /tmp/logs-${TIMESTAMP}.tar.gz