How to minimize your cloud spending on AWS resources using Systems Manager Automation documents
Tags: systemsmanager, iam, ec2
Published: 2024-03-08 23:50:10

An easy way to accomplish unneccessary spending and to minimize infrastructure when it’s not under heavy use, is - by turning off Amazon Elastic Compute Cloud (Amazon EC2) and Amazon Relational Database Service (Amazon RDS) instances for workloads outside of business hours. For workloads that cannot be turned off (due to dependencies on other systems), downsizing instance types is a good alternative.

Applying these measures you can save companies up to 70% in infrastructure costs. 

In this post, I will show you how to use **AWS Systems Manager Automation documents to turn off** your Amazon EC2 and Amazon RDS instances. These Automation documents can then be scheduled for known low usage periods such as nights, holidays, and weekends.

You can use pre-defined Automation documents (prefixed with AWS) or define your own. These can be invoked on a schedule or via a trigger. For more information, check [Systems Manager automation](https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-automation.html).

_**Let’s get started!**_

Please visit my **[GitHub Repository for EC2 articles](https://github.com/awsmine/EC2_projects)** on various topics being updated on constant basis.
Please visit my **[GitHub Repository for RDS articles](https://github.com/awsmine/RDS_projects)** on various topics being updated on constant basis.

For my article, I am going to use pre-defined Automation documents:

**[AWS-StartEC2Instance](https://docs.aws.amazon.com/systems-manager-automation-runbooks/latest/userguide/automation-aws-startec2instance.html)**
**[AWS-StopEC2Instance](https://docs.aws.amazon.com/systems-manager-automation-runbooks/latest/userguide/automation-aws-stopec2instance.html)**
**[AWS-StartRdsInstance](https://docs.aws.amazon.com/systems-manager-automation-runbooks/latest/userguide/automation-aws-startrdsinstance.html)**
# Objectives:

**1.** Create an RDS database

**2.** Create EC2 Instance

**3.** Create an IAM Role

**4.** Add an Inline Policy to the IAM Role to allow Systems Manager to manage RDS Instance

**5.** Create an Association - Scheduling through State Manager to stop EC2 Instance

**6.** Create an Association - Scheduling through State Manager to stop RDS database

# Pre-requisites:
- AWS user account with admin access, not a root account.
- Create an IAM role


# Resources Used:
**[AWS Systems Manager Automation](https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-automation.html)**
**[AWS Systems Manager](https://docs.aws.amazon.com/systems-manager/latest/userguide/what-is-systems-manager.html)**
**[State Manager Associations](https://docs.aws.amazon.com/systems-manager/latest/userguide/state-manager-associations.html)**
**[IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html)**
**[EC2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/concepts.html)**
**[RDS](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Welcome.html)**

# Steps for implementation to this project:

## 1. Create an RDS database
**1**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/c25wa83lkngz9jlpupmf.png)
**2**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qrpgd10p6liqw22srmqi.png)
**3**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/o8tcco5bim4q8fzvl2ma.png)
**4**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/nbrmu8wmfxkr8vm2m240.png)
**5**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/w1iy5h7j8fz7sn570enx.png)
**6**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0ht604xno4yreetkolni.png)
**7**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/fp1cgyg5q0u7hhwnre5n.png)
**8**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/lmr8azk35pnpp7qpge0f.png)
**9**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0w624ygbpc7hi0f1hgeg.png)
**10**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ifpe4dp5rrxc4rwh1ijd.png)
**11**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qynoyh6blrivnsxo05o1.png)
**12**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/297djqz1o3d3tpb5n2a6.png)


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/2b38kb8u11do3x3d09qk.png)




## 2. Create EC2 Instance
**1**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/810wlsogsltwp1izgdhv.png)
**2**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qc9sefs83hrscf1mq5ux.png)
**3**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/x3rwohsd3kxpxf9y4vg5.png)
**4**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/tsohfuxlz5npn2ay8gmi.png)
**5**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/kq3r85d5ruibq6bhvuz6.png)
**6**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/sxs30clpmze8118rac3s.png)
**7**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/pv0f3vfcpdcsnaau5khr.png)

**8**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/vycnmbn18hjx4g2l16x2.png)





## 3. Create an IAM Role
**1**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/b0b2ockoba1bkdhgor0z.png)
**2**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4bkh5c23tuvgbr9q0yva.png)
**3**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wfrd1qwj2yj326n8e6de.png)
- Next
**4**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/l5ry4p1ydha62edzrtw1.png)
- Next

**5**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/tf7t3qoo907kogr17xo1.png)
**6**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/p6p7fct1534rhspl1436.png)
- Create role

## 4. Add an Inline Policy to the IAM Role to allow Systems Manager to manage RDS Instance

- Find out the ARN of your RDS database


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/nyn7pmpsznmbdkp9ugvn.png)


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/3jobq2mixxwcdrk0rmdy.png)

- Choose the role that you just created. 
- In the Permissions tab, choose Add inline policy, select the JSON tab, and replace the JSON content with the following code.
- Make sure you replace both resource parameters with one or more ARNs of your databases 

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "rds:StopDBInstance",
                "rds:StartDBInstance"
            ],
            "Resource": "arn:aws:rds:us-east-1:xxxxxxxxxxxx:cluster:database-1"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": "rds:DescribeDBInstances",
            "Resource": "arn:aws:rds:us-east-1:xxxxxxxxxxxx:cluster:database-1"
        }
    ]
}
```


**1**


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/nfy8jfw45xdklcc2waxw.png)

**2**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/j2nn2e7fuhf2uhd7bz1l.png)

- Next

**3**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wqa1kpuyv3wzgwy5y8x9.png)
- Create policy

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/eh1otblok4ct54wu518g.png)



## 5. Create an Association - Scheduling through State Manager to stop EC2 Instance
**1**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/bx0bsb2hisrcwkikpyg8.png)
**2**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5gyc3z5gv3tfr0rdnej1.png)
**3**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0ow8z1iswr9paxmhwjhl.png)
**4**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4o8hum5u0g9caxl3pzxt.png)

**5**
- select the SSM Automation document named `AWS-StopEC2Instance`.
- press Enter
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ib4ore2stmsgtywozqjx.png)

**6**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/z5ew9pp2atmorzw08jj7.png)
**7**
- For a single EC2, choose Simple execution.
- in the Input parameters section enter the EC2 instance id 
- In the AutomationAssumeRole box, pick the role `EC2toSystemsManager`.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/b9bixmp5gj52s4z2phhk.png)
**8**
- In the Specify schedule section, choose On Schedule and CRON schedule builder. 
- Under Association runs, choose the last option, then choose Day, enter 18 and 00. You should now have the following: “Every Day at 18:00”. (that means Stop the EC2 instance at 6:00 pm or 18:00).
- To ensure that the association doesn’t run upon creation, choose the Apply association only at the next specified cron interval check box.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/r7h2aoow4xdewh3v33sn.png)
- Create association
- you should now see your association in the list. 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/7y7uuc7cqehx9t10sza1.png)


- After waiting for 10-15 min, stops the EC2 instance

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/pf2pbwow4mbc656edgi2.png)



## 6. Create an Association - Scheduling through State Manager to stop RDS database

- Follow all the steps as you did for `AWS-StopEC2Instance`
 
**1**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/h6nv6jroz6kqtjs885kk.png)

**2**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/lbot1eh25nf8qecylbdj.png)

**3**
- Use `AWS-StopRDSInstance`

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/imb7fqyxteulabupl4n0.png)

**4**
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8aus82e0jzrvxrh7qj3n.png)

**5**
- In the Specify schedule section, choose On Schedule and CRON schedule builder. 
- Under Association runs, choose the last option, then choose Day, enter 18 and 20. You should now have the following: “Every Day at 18:20”. (that means Stop the EC2 instance at 6:20 pm or 18:20).
- To ensure that the association doesn’t run upon creation, choose the Apply association only at the next specified cron interval check box.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ig3la7r6ttsucxxya05r.png)

**6**
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/drgehx84yjdijxh529gr.png)


- After waiting for 10-15 min, stops the RDS database

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/dury3igc70i3d0f0806t.png)



# Cleanup

- delete RDS Database
- delete EC2 instance
- delete Association

# What we have done so far

I showed you how to cut off your cloud spending for stopping EC2, and Amazon RDS instances based on a schedule.