This lambda function should be called by a CloudWatch event once a day. It
iterates over all instances in the configured regions and creates a snapshot
of every EBS volume of instances carrying the configured backup tag (the tag
value is irrelevant and can be empty). Every snapshot is tagged with a
DeleteOn date; snapshots whose DeleteOn date matches today are deleted.
Most of the code is taken from: https://serverlesscode.com/post/lambda-schedule-ebs-snapshot-backups/
- Create a Lambda function (with the latest Python runtime) and give it proper permissions (see next section)
- Configure the function via the environment variables described below
- Add a CloudWatch/EventBridge rule that triggers the function once a day
The function is configured through environment variables:
| Variable | Default | Description |
|---|---|---|
EC2_INSTANCE_TAG | Backup | Instances carrying this tag key are backed up |
RETENTION_DAYS | 10 | Number of days a snapshot is kept before it is deleted |
REGIONS | eu-central-1 | Comma separated list of regions to process (e.g. eu-central-1,eu-west-1) |
The Lambda function needs the following permissions to work:
ec2:DescribeInstancesandec2:DescribeSnapshotsec2:CreateSnapshotandec2:CreateTagsec2:DeleteSnapshot