Okay, for what it's worth, here's what I did. I hope my feeble scripts encourage people to post better solutions!
I wrote two simple bash scripts and automated them using cron. (For now I run these on a local server, as I think (?) it's not recommended to put AWS's certificates in the instances/AMIs/EBSs themselves.)
To create a new snapshot:
# ESB volume associated with the instance we want to back up:
EBS_VOL_ID=vol-xxxxyyyy
ec2-create-snapshot --region eu-west-1 -K pk.pem -C cert.pem -d "Automated backup" $EBS_VOL_ID
To prune all except latest snapshot:
EBS_VOL_ID=vol-xxxxyyyy
ec2-describe-snapshots --region eu-west-1 -K pk.pem -C cert.pem | grep "Automated backup" | grep "$EBS_VOL_ID" | awk '{ print $5 "\t" $2 }' | sort > .snapshots
latest_id=$(tail -n1 .snapshots | awk '{ print $2 }')
cat .snapshots | awk '{ print $2 }' > .snapshot_ids
for i in $(cat .snapshot_ids)
do
if [ "$i" != "$latest_id" ]
then
echo "Deleting snapshot $i"
ec2-delete-snapshot --region eu-west-1 -K pk.pem -C cert.pem $i
fi
done
(This parses appropriate snapshot information from ec2-describe-snapshots
output and creates a temp file with [timestamp tab snapshot-id] entries (e.g.
2011-06-01T10:24:36+0000 snap-60507609
) where the newest snapshot is on the last line.)
Notes:
- Put your X509 certificate and private key in some place where the scripts can find them.
- You must explicitly specify
--region
with all commands. Otherwise e.g. ec2-create-snapshot
would fail with volume ID being unknown. (YMMV if you use the default region "us-east-1".)
- I used a snapshot description ("Automated backup") as a marker to avoid the prune script deleting other snapshots of the volume in question (e.g. snapshots related to AMIs).
Disclaimer: This became partly an exercise in Bash/Unix programming for me, especially the prune script. I readily admit you'd most likely get a much clearer result with e.g. Python, when you need logic like "do something for all but the last item in a list". And even with Bash you could probably do this more elegantly (for instance, you don't really need temp files). So, please feel free to post other solutions!