Auto Scaling groups

Sign in, load saat-vpc and define two helpers: one builds launch template data for a page version, one waits for healthy targets.

cd C:\aws-lab
aws login --profile saat-admin
$env:AWS_PROFILE = 'saat-admin'
$v = Get-Content C:\aws-lab\saat-vpc.json | ConvertFrom-Json
$base = aws ssm get-parameter --name /aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64 --query Parameter.Value --output text
$ud = @'
#!/bin/bash
mkdir -p /srv/www/health
TOKEN=$(curl -s -X PUT http://169.254.169.254/latest/api/token -H "X-aws-ec2-metadata-token-ttl-seconds: 300")
AZ=$(curl -s -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/placement/availability-zone)
echo "<h1>saat-web VERSION from $(hostname) in $AZ</h1>" > /srv/www/index.html
echo ok > /srv/www/health/index.html
cat > /etc/systemd/system/saat-web.service <<'UNIT'
[Unit]
Description=saat web test server
After=network-online.target
[Service]
ExecStart=/usr/bin/python3 -m http.server 8080 --directory /srv/www
Restart=always
[Install]
WantedBy=multi-user.target
UNIT
systemctl daemon-reload
systemctl enable --now saat-web
'@
$lt = @'
{
  "ImageId": "AMI_ID",
  "InstanceType": "t3.micro",
  "SecurityGroupIds": ["APP_SG"],
  "IamInstanceProfile": { "Name": "PROFILE_NAME" },
  "MetadataOptions": { "HttpTokens": "required" },
  "TagSpecifications": [ { "ResourceType": "volume", "Tags": [ { "Key": "course", "Value": "saatvedha-aws" }, { "Key": "lesson", "Value": "21" } ] } ],
  "UserData": "USER_DATA"
}
'@
function New-LtData([string]$Ver, [string]$Prof, [string]$File) {
  $u = ($ud -replace 'VERSION', $Ver) -replace "`r`n", "`n"
  $b64 = [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes($u))
  $lt -replace 'AMI_ID', $base -replace 'APP_SG', $v.AppSg -replace 'PROFILE_NAME', $Prof -replace 'USER_DATA', $b64 | Set-Content $File
}
function Wait-Healthy([int]$Count) {
  do { Start-Sleep 20; $n = [int](aws elbv2 describe-target-health --target-group-arn $tg --query 'length(TargetHealthDescriptions[?TargetHealth.State==`healthy`])' --output text) } until ($n -ge $Count)
  "$n healthy"
}

Launch template user data must be base64-encoded, which New-LtData does for you. The LF line endings matter, just as in Lesson 11.

1Rebuild the load balancer from Lesson 20

Paste this whole block (about three minutes):

$tg = aws elbv2 create-target-group --name saat-web-tg --protocol HTTP --port 8080 --vpc-id $v.VpcId --health-check-path /health/ --health-check-interval-seconds 10 --healthy-threshold-count 2 --unhealthy-threshold-count 2 --tags Key=course,Value=saatvedha-aws Key=lesson,Value=21 --query "TargetGroups[0].TargetGroupArn" --output text
aws elbv2 modify-target-group-attributes --target-group-arn $tg --attributes Key=deregistration_delay.timeout_seconds,Value=30 | Out-Null
$alb, $dns = (aws elbv2 create-load-balancer --name saat-web-alb --type application --scheme internet-facing --subnets $v.PublicA $v.PublicB --security-groups $v.WebSg --tags Key=course,Value=saatvedha-aws Key=lesson,Value=21 --query "LoadBalancers[0].[LoadBalancerArn,DNSName]" --output text) -split '\s+'
aws elbv2 wait load-balancer-available --load-balancer-arns $alb
aws elbv2 create-listener --load-balancer-arn $alb --protocol HTTP --port 80 --default-actions "Type=forward,TargetGroupArn=$tg" | Out-Null
$dns

You should see something like this:

saat-web-alb-1234567890.ap-south-1.elb.amazonaws.com

2Create the launch template and the group

Paste this whole block:

New-LtData -Ver v1 -Prof saat-ec2-ssm-profile -File lt-v1.json
aws ec2 create-launch-template --launch-template-name saat-asg-lt --version-description v1 --launch-template-data file://lt-v1.json --query "LaunchTemplate.DefaultVersionNumber" --output text
aws autoscaling create-auto-scaling-group --auto-scaling-group-name saat-web-asg --launch-template 'LaunchTemplateName=saat-asg-lt,Version=$Default' --min-size 2 --max-size 4 --desired-capacity 2 --vpc-zone-identifier "$($v.PrivateA),$($v.PrivateB)" --target-group-arns $tg --health-check-type ELB --health-check-grace-period 60 --default-instance-warmup 60 --tags 'Key=Name,Value=asg-web,PropagateAtLaunch=true' 'Key=course,Value=saatvedha-aws,PropagateAtLaunch=true' 'Key=lesson,Value=21,PropagateAtLaunch=true'
Wait-Healthy 2
aws autoscaling describe-auto-scaling-groups --auto-scaling-group-names saat-web-asg --query "AutoScalingGroups[0].Instances[].[InstanceId,AvailabilityZone,LifecycleState,HealthStatus]" --output text
(Invoke-WebRequest -UseBasicParsing "http://$dns/").Content

You should see something like this:

1
2 healthy
i-0c1d2e3f4a5b60011      ap-south-1a     InService       Healthy
i-0c1d2e3f4a5b60012      ap-south-1b     InService       Healthy
<h1>saat-web v1 from ip-10-20-11-58.ap-south-1.compute.internal in ap-south-1a</h1>

You never launched an instance or registered a target. The group did both, one per zone.

3Kill a server and watch it heal

Paste this whole block (about three minutes):

$victim = aws autoscaling describe-auto-scaling-groups --auto-scaling-group-names saat-web-asg --query "AutoScalingGroups[0].Instances[0].InstanceId" --output text
aws ec2 terminate-instances --instance-ids $victim | Out-Null
Start-Sleep 60
Wait-Healthy 2
aws autoscaling describe-scaling-activities --auto-scaling-group-name saat-web-asg --max-items 2 --query "Activities[].[Description,StatusCode]" --output text

You should see something like this:

2 healthy
Launching a new EC2 instance: i-0c1d2e3f4a5b60013        Successful
Terminating EC2 instance: i-0c1d2e3f4a5b60011    Successful

This is self-healing. At 3 a.m. nobody has to notice a dead server; the group sees desired 2, running 1, and fixes it.

4Add a CPU target and roll out version 2

Paste this whole block (the refresh takes about six minutes):

'{ "PredefinedMetricSpecification": { "PredefinedMetricType": "ASGAverageCPUUtilization" }, "TargetValue": 50.0 }' | Set-Content tt.json
aws autoscaling put-scaling-policy --auto-scaling-group-name saat-web-asg --policy-name cpu50 --policy-type TargetTrackingScaling --target-tracking-configuration file://tt.json | Out-Null
aws cloudwatch describe-alarms --alarm-name-prefix TargetTracking-saat-web-asg --query "MetricAlarms[].AlarmName" --output text
New-LtData -Ver v2 -Prof saat-ec2-ssm-profile -File lt-v2.json
aws ec2 create-launch-template-version --launch-template-name saat-asg-lt --source-version 1 --version-description v2 --launch-template-data file://lt-v2.json | Out-Null
aws ec2 modify-launch-template --launch-template-name saat-asg-lt --default-version 2 | Out-Null
aws autoscaling start-instance-refresh --auto-scaling-group-name saat-web-asg --preferences MinHealthyPercentage=50,InstanceWarmup=60 | Out-Null
do { Start-Sleep 30; $r = aws autoscaling describe-instance-refreshes --auto-scaling-group-name saat-web-asg --query "InstanceRefreshes[0].[Status,PercentageComplete]" --output text; $r } until ($r -match 'Successful|Failed|Cancelled')
(Invoke-WebRequest -UseBasicParsing "http://$dns/").Content

You should see something like this:

TargetTracking-saat-web-asg-AlarmHigh-1a2b3c4d   TargetTracking-saat-web-asg-AlarmLow-5e6f7a8b
InProgress      0
InProgress      50
Successful      100
<h1>saat-web v2 from ip-10-20-12-41.ap-south-1.compute.internal in ap-south-1b</h1>

Target tracking created both alarms for you; you never edit them by hand. The refresh replaced one server at a time, so the site kept answering throughout. Load the page a few times during a refresh and you’ll see v1 and v2 side by side.

✅ Checkpoint: saat-web-asg keeps two healthy instances, replaced a terminated one by itself, has a cpu50 policy with two alarms, and serves v2 after a successful instance refresh. Keep everything for the break lab.