如何用Terraform配置EventBridge定时启停AWS EC2实例

完全可以不用Lambda，直接通过Terraform配置EventBridge规则调用EC2的StopInstances/StartInstances API，核心是配置EventBridge的AWS API调用目标，并给EventBridge授予对应的IAM权限。

1. 创建EventBridge所需的IAM角色及权限 #

EventBridge需要一个具备EC2启停权限的IAM角色，才能调用对应的API：

# IAM角色：允许EventBridge扮演该角色
resource "aws_iam_role" "eventbridge_ec2_control" {
  name = "eventbridge-ec2-control-role"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Principal = {
          Service = "events.amazonaws.com"
        }
      }
    ]
  })
}

# IAM权限策略：允许启停指定EC2实例
resource "aws_iam_role_policy" "ec2_stop_start_permissions" {
  name = "ec2-stop-start-permissions"
  role = aws_iam_role.eventbridge_ec2_control.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = [
          "ec2:StopInstances",
          "ec2:StartInstances"
        ]
        Effect = "Allow"
        Resource = "arn:aws:ec2:${var.aws_region}::instance/i-0123456789abcdef0" # 替换为你的实例ID，或用"*"允许所有
      }
    ]
  })
}

2. 配置停止EC2实例的EventBridge规则 #

以下示例创建每天22:00（UTC时间）停止指定实例的规则：

# EventBridge规则：触发时间
resource "aws_cloudwatch_event_rule" "stop_ec2_daily" {
  name        = "stop-ec2-daily"
  description = "Daily stop EC2 instance at 22:00 UTC"
  schedule_expression = "cron(0 22 * * ? *)" # UTC时间，按需调整
}

# EventBridge目标：调用EC2 StopInstances API
resource "aws_cloudwatch_event_target" "stop_ec2_target" {
  rule      = aws_cloudwatch_event_rule.stop_ec2_daily.name
  target_id = "StopEC2Instance"

  # 指定调用的AWS API
  arn = "arn:aws:ec2:${var.aws_region}::api/StopInstances"

  # 传递给API的参数：实例ID
  input = jsonencode({
    InstanceIds = ["i-0123456789abcdef0"] # 替换为你的实例ID
  })

  # 指定EventBridge使用的IAM角色
  role_arn = aws_iam_role.eventbridge_ec2_control.arn
}

3. 配置启动EC2实例的EventBridge规则 #

类似地，创建每天08:00（UTC时间）启动实例的规则：

# EventBridge规则：触发时间
resource "aws_cloudwatch_event_rule" "start_ec2_daily" {
  name        = "start-ec2-daily"
  description = "Daily start EC2 instance at 08:00 UTC"
  schedule_expression = "cron(0 8 * * ? *)" # UTC时间，按需调整
}

# EventBridge目标：调用EC2 StartInstances API
resource "aws_cloudwatch_event_target" "start_ec2_target" {
  rule      = aws_cloudwatch_event_rule.start_ec2_daily.name
  target_id = "StartEC2Instance"

  arn = "arn:aws:ec2:${var.aws_region}::api/StartInstances"

  input = jsonencode({
    InstanceIds = ["i-0123456789abcdef0"] # 替换为你的实例ID
  })

  role_arn = aws_iam_role.eventbridge_ec2_control.arn
}

关键注意事项 #

• 替换代码中的var.aws_region为你的AWS区域，i-0123456789abcdef0为实际的EC2实例ID
• 若需要批量启停多个实例，在InstanceIds数组中添加多个实例ID即可
• Cron表达式使用UTC时间，需根据本地时区换算调整
• IAM权限策略中的Resource可以限制为特定实例，避免过度授权

内容的提问来源于stack exchange，提问作者rzlvmp