Hello Fortinet Team!
We are encountering some issue with the fgt-asg-lambda.py so the problem we are facing are
- It is completing other life cycle hooks.
- we have fixed this by determining the managed hook and only complete the managed hook skipping other hooks.
- The fgtconf is waiting for the event
EC2 Instance Launch Successful.
def main(self, detail_type): if detail_type == "EC2 Instance Launch Successful": self.do_launch() elif detail_type == "EC2 Instance-terminate Lifecycle Action": self.do_terminate() else: self.logger.debug(f"Can not identify detail-type: {detail_type}") return
this is our main problem, we have a hook that is checking the config if properly placed, login test, threat feed check if loaded properly etc. but our hook cannot complete because the FGT is bare.
current flow:
FGT instance launch -> fgt_asg_launch_hook -> fgt_asg_lambda configures the network -> complete the life cycle action -> wait for EC2 Instance Launch Successful -> fgt_asg_lambda configures the FGT
recommended flow:
FGT instance launch -> fgt_asg_launch_hook -> fgt_asg_lambda configures the network -> fgt_asg_lambda configures the FGT -> complete the life cycle action (CONTINUE) if all are ok
This means the FortiGate is fully configured during the EC2_INSTANCE_LAUNCHING lifecycle phase (Pending), before the instance transitions to InService.
Reason for this recommendation:
Dependency with other lifecycle hooks
Our environment includes additional lifecycle hooks that perform validation (e.g., login tests, policy and feed checks). These depend on the FortiGate being fully configured.
In the current implementation (where configuration happens after "EC2 Instance Launch Successful"), our hook run before the FortiGate is ready, causing failures (we cannot login - FGT is bare).
Lack of failure control
If FortiGate configuration fails under the current flow, the instance has already transitioned to InService in Amazon EC2 Auto Scaling.
This removes the ability to fail the lifecycle (ABANDON) and prevent a misconfigured or non-functional device from entering Inservice.
Request:
Is it possible to modify the Fortinet lifecycle handling so that FortiGate configuration is executed during the launch lifecycle hook (EC2_INSTANCE_LAUNCHING) and only signals completion after successful configuration?
thank you so much!
Hello Fortinet Team!
We are encountering some issue with the fgt-asg-lambda.py so the problem we are facing are
EC2 Instance Launch Successful.def main(self, detail_type): if detail_type == "EC2 Instance Launch Successful": self.do_launch() elif detail_type == "EC2 Instance-terminate Lifecycle Action": self.do_terminate() else: self.logger.debug(f"Can not identify detail-type: {detail_type}") returnthis is our main problem, we have a hook that is checking the config if properly placed, login test, threat feed check if loaded properly etc. but our hook cannot complete because the FGT is bare.
current flow:
FGT instance launch -> fgt_asg_launch_hook -> fgt_asg_lambda configures the network -> complete the life cycle action -> wait for EC2 Instance Launch Successful -> fgt_asg_lambda configures the FGT
recommended flow:
FGT instance launch -> fgt_asg_launch_hook -> fgt_asg_lambda configures the network -> fgt_asg_lambda configures the FGT -> complete the life cycle action (CONTINUE) if all are ok
This means the FortiGate is fully configured during the EC2_INSTANCE_LAUNCHING lifecycle phase (Pending), before the instance transitions to InService.
Reason for this recommendation:
Dependency with other lifecycle hooks
Our environment includes additional lifecycle hooks that perform validation (e.g., login tests, policy and feed checks). These depend on the FortiGate being fully configured.
In the current implementation (where configuration happens after "EC2 Instance Launch Successful"), our hook run before the FortiGate is ready, causing failures (we cannot login - FGT is bare).
Lack of failure control
If FortiGate configuration fails under the current flow, the instance has already transitioned to InService in Amazon EC2 Auto Scaling.
This removes the ability to fail the lifecycle (ABANDON) and prevent a misconfigured or non-functional device from entering Inservice.
Request:
Is it possible to modify the Fortinet lifecycle handling so that FortiGate configuration is executed during the launch lifecycle hook (EC2_INSTANCE_LAUNCHING) and only signals completion after successful configuration?
thank you so much!