FENCE_AGENT(8)

💖 fence_agent — the fence_aws_vpc_net page, bestie edition 💖

okay so this is from the System Manager's Manual section, manual page FENCE_AGENT(8), and today's main character is fence_aws_vpc_net. Buckle up. 🎀

---

✨ NAME ✨

fence_aws_vpc_net — the fence agent for AWS (Amazon Web Services) Net. that's it, that's the name. 🦋

---

🌸 DESCRIPTION 🌸

fence_aws_vpc is a Network and Power Fencing agent for AWS VPC, and the way it does its thing is by manipulating security groups. iconic behaviour honestly. it uses the boto3 library to connect to AWS. 💅

boto3 can be configured with the AWS CLI, or by creating ~/.aws/credentials. for the actual instructions, go look here:

https://boto3.readthedocs.io/en/latest/guide/quickstart.html#configuration

NOTE: if onfence-poweroff is set, the agent won't be able to power on the node again. it will have to be powered on manually, or with other automation. so like… be aware. 😭

the fence agent accepts options on the command line and from stdin. fenced sends parameters through stdin when it execs the agent. and you can absolutely run the agent by itself with command line options — that's lowkey so useful for testing, and for turning outlets on or off from scripts. 🫶

Vendor URL: http://www.amazon.com

---

⭐ PARAMETERS ⭐

• -o, --action=[action] — the fencing action you want. (Default Value: reboot)
• -n, --plug=[id] — the AWS Instance ID to perform the action on. this parameter is always required, no skipsies. 👑
• -r, --region=[region] — AWS Region.
• -a, --access-key=[key] — AWS Access Key.
• -s, --secret-key=[key] — AWS Secret Key.
• --secg=[sg1,sg2,...] — security groups to remove.
• --skip-race-check — skip the race condition check.
• --invert-sg-removal — remove all security groups except the specified ones.
• --unfence-ignore-restore — remove all security groups except specified..
• --filter=[key=value] — filter for list-action.
• -b, --boto3_debug=[option] — Boto Lib debug. (Default Value: False)
• --onfence-poweroff — power off the machine async..
• --ignore-tag-write-failure — keep going with fencing even if the backup tag fails..
• --ignore-instance-state — fence regardless of AWS state.
• --interface0-sg=[sg1,sg2,...] — security groups to restore for interface 0 (bypasses tag logic).
• --interface1-sg=[sg1,sg2,...] — security groups to restore for interface 1 (bypasses tag logic).
• --interface2-sg=[sg1,sg2,...] — security groups to restore for interface 2 (bypasses tag logic).
• --interface3-sg=[sg1,sg2,...] — security groups to restore for interface 3 (bypasses tag logic).
• --interface4-sg=[sg1,sg2,...] — security groups to restore for interface 4 (bypasses tag logic).
• --interface5-sg=[sg1,sg2,...] — security groups to restore for interface 5 (bypasses tag logic).
• --interface6-sg=[sg1,sg2,...] — security groups to restore for interface 6 (bypasses tag logic).
• --interface7-sg=[sg1,sg2,...] — security groups to restore for interface 7 (bypasses tag logic).
• --interface8-sg=[sg1,sg2,...] — security groups to restore for interface 8 (bypasses tag logic).
• --interface9-sg=[sg1,sg2,...] — security groups to restore for interface 9 (bypasses tag logic).
• --interface10-sg=[sg1,sg2,...] — security groups to restore for interface 10 (bypasses tag logic).
• --interface11-sg=[sg1,sg2,...] — security groups to restore for interface 11 (bypasses tag logic).
• --interface12-sg=[sg1,sg2,...] — security groups to restore for interface 12 (bypasses tag logic).
• --interface13-sg=[sg1,sg2,...] — security groups to restore for interface 13 (bypasses tag logic).
• --interface14-sg=[sg1,sg2,...] — security groups to restore for interface 14 (bypasses tag logic).
• --interface15-sg=[sg1,sg2,...] — security groups to restore for interface 15 (bypasses tag logic).
• -q, --quiet — disable logging to stderr. does not affect --verbose, or --debug-file, or logging to syslog. 💀
• -v, --verbose — verbose mode. you can stack multiple -v flags on the command line (like, e.g., -vvv) to crank up the verbosity.
• --verbose-level — level of debugging detail in the output. defaults to however many --verbose flags you put on the command line, or to 1 if verbose=1 in a stonith device configuration (i.e., on stdin).
• -D, --debug-file=[debugfile] — write debug information to the given file.
• -V, --version — display version information and exit.
• -h, --help — display help and exit.
• --plug-separator=[char] — separator for the plug parameter when you're specifying more than 1 plug. (Default Value: ,)
• -C, --separator=[char] — separator for the CSV created by the list operation. (Default Value: ,)
• --delay=[seconds] — wait X seconds before fencing is started. (Default Value: 0)
• --disable-timeout=[true/false] — disable timeout (true/false). (default: true when run from Pacemaker 2.0+)
• --login-timeout=[seconds] — wait X seconds for the cmd prompt after login. (Default Value: 5)
• --power-timeout=[seconds] — test X seconds for a status change after ON/OFF. (Default Value: 20)
• --power-wait=[seconds] — wait X seconds after issuing ON/OFF. (Default Value: 0)
• --shell-timeout=[seconds] — wait X seconds for the cmd prompt after issuing a command. (Default Value: 3)
• --stonith-status-sleep=[seconds] — sleep X seconds between status calls during a STONITH action. (Default Value: 1)
• --retry-on=[attempts] — count of attempts to retry power on. (Default Value: 1)

---

🦋 ACTIONS 🦋

• on — power on machine. ⚡
• off — power off machine.
• reboot — reboot machine.
• status — this returns the status of the plug/virtual machine.
• list — list available plugs with aliases/virtual machines, if there's support for more than one device. returns N/A otherwise.
• list-status — list available plugs with aliases/virtual machines and their power state, if it can be obtained without additional commands.
• monitor — check the health of the fence device.
• metadata — display the XML metadata describing this resource.
• manpage — the operational behavior of this is not known. 🙈
• validate-all — validate if all required parameters are entered.

---

to be continued, bestie — there's more of this page coming so don't go anywhere 💜

✨ STDIN PARAMETERS ✨

okay bestie these are the params that come in through stdin — that's how Pacemaker/stonith hands stuff to the agent, iykyk 💌 every one of them, no skipping, we go down the whole list together 🫶

• action — the fencing action we're doing. Default value: reboot 🔄
• plug — the AWS Instance ID we're performing the action on. This one is always required, no exceptions, it's the whole point. Obsoletes: port 💅
• region — the AWS Region.
• access_key — your AWS Access Key.
• secret_key — your AWS Secret Key. yes it's secret. guard it with your life 🙈
• secg — the Security Groups to remove.
• skip_race_check — skip the race condition check. 🏃♀️
• invert_sg_removal — Remove all security groups except specified.. Obsoletes: invert-sg-removal
• unfence_ignore_restore — Remove all security groups except specified.. Obsoletes: unfence-ignore-restore
• filter — Filter for list-action.
• boto3_debug — Boto Lib debug. Default value: False 🐍
• onfence_poweroff — Power off the machine async.. Obsoletes: onfence-poweroff
• ignore_tag_write_failure — Continue to fence even if the backup tag fails.. Obsoletes: ignore-tag-write-failure
• ignore_instance_state — Fence regardless of AWS state. Obsoletes: ignore-instance-state
• interface0_sg — Security Groups to restore for interface 0 (bypasses tag logic). Obsoletes: interface0-sg
• interface1_sg — Security Groups to restore for interface 1 (bypasses tag logic). Obsoletes: interface1-sg
• interface2_sg — Security Groups to restore for interface 2 (bypasses tag logic). Obsoletes: interface2-sg
• interface3_sg — Security Groups to restore for interface 3 (bypasses tag logic). Obsoletes: interface3-sg
• interface4_sg — Security Groups to restore for interface 4 (bypasses tag logic). Obsoletes: interface4-sg
• interface5_sg — Security Groups to restore for interface 5 (bypasses tag logic). Obsoletes: interface5-sg
• interface6_sg — Security Groups to restore for interface 6 (bypasses tag logic). Obsoletes: interface6-sg
• interface7_sg — Security Groups to restore for interface 7 (bypasses tag logic). Obsoletes: interface7-sg
• interface8_sg — Security Groups to restore for interface 8 (bypasses tag logic). Obsoletes: interface8-sg
• interface9_sg — Security Groups to restore for interface 9 (bypasses tag logic). Obsoletes: interface9-sg
• interface10_sg — Security Groups to restore for interface 10 (bypasses tag logic). Obsoletes: interface10-sg
• interface11_sg — Security Groups to restore for interface 11 (bypasses tag logic). Obsoletes: interface11-sg
• interface12_sg — Security Groups to restore for interface 12 (bypasses tag logic). Obsoletes: interface12-sg
• interface13_sg — Security Groups to restore for interface 13 (bypasses tag logic). Obsoletes: interface13-sg
• interface14_sg — Security Groups to restore for interface 14 (bypasses tag logic). Obsoletes: interface14-sg
• interface15_sg — Security Groups to restore for interface 15 (bypasses tag logic). Obsoletes: interface15-sg

---

and now the general / logging / timing girlies ✨

• quiet — Disable logging to stderr. Heads up: it does not affect --verbose, --debug-file, or logging to syslog. 🤫
• verbose — Verbose mode. You can stack multiple -v flags on the command line (like -vvv) to crank the verbosity up. 📢
• verbose_level — Level of debugging detail in output. Defaults to the number of --verbose flags specified on the command line, or to 1 if verbose=1 in a stonith device configuration (i.e., on stdin).
• debug_file — Write debug information to given file. Obsoletes: debug 📝
• version — Display version information and exit. 👋
• help — Display help and exit. 🆘
• plug_separator — Separator for the plug parameter when you're specifying more than 1 plug. Default value: ,
• separator — Separator for the CSV created by the list operation. Default value: ,
• delay — Wait X seconds before fencing is started. Default value: 0 ⏳
• disable_timeout — Disable timeout (true/false). Default: true when run from Pacemaker 2.0+
• login_timeout — Wait X seconds for the cmd prompt after login. Default value: 5
• power_timeout — Test X seconds for a status change after ON/OFF. Default value: 20 ⚡
• power_wait — Wait X seconds after issuing ON/OFF. Default value: 0
• shell_timeout — Wait X seconds for the cmd prompt after issuing a command. Default value: 3 🐚
• stonith_status_sleep — Sleep X seconds between status calls during a STONITH action. Default value: 1 😴
• retry_on — Count of attempts to retry power on. Default value: 1 🔁

---

and that's the whole page bestie, you made it to the end 🎀

this lil beauty is fence_aws_vpc_net, a Fence Agent, dated 2009-10-20, and it lives in section FENCE_AGENT(8) of the manual. go forth and fence responsibly, mwah 💋✨