Architecture
Flow Chart

☁️ AutoRoot: AWS EC2 Volume Scaler - (Lambda-Powered EC2 Self-Healing Storage Tool)

A serverless, scalable AWS architecture to automatically expand EC2 root volume when disk usage exceeds a defined threshold eliminating manual intervention, reducing risk, and ensuring high availability.

Inspiration

With the explosive growth of data in the cloud era, managing infrastructure manually is error-prone and inefficient. Particularly in EC2 environments, the inability to dynamically scale storage often results in deployment delays, application crashes, or costly downtime.

This project was driven by the challenge of automating Elastic Block Store (EBS) root volume expansion on EC2 instances in real-time. By leveraging AWS-native services such as CloudWatch, Lambda, EventBridge, and Step Functions, our goal was to create a self-monitoring, self-healing architecture that could perform without human oversight.

What It Does

This project automates the detection and expansion of root EBS volume in an EC2 instance when storage reaches a critical threshold (default: 90%). Here's how the system works:

CloudWatch Agent continuously monitors disk usage on the EC2 instance.
When usage exceeds the threshold, a CloudWatch Alarm is triggered.
Amazon EventBridge receives the event and routes it to a trigger Lambda function.
This initiates an AWS Step Function, which:
- Retrieves the root volume ID (via Lambda #1)
- Increases the EBS volume size (via Lambda #2)
- Grows the internal file system (via Lambda #3)

The system supports error handling, automatic retries, and future integration of snapshot backups for data safety.

How We Built It

The architecture was developed using AWS-native serverless services to ensure reliability, scalability, and minimal maintenance:

Python (Boto3 SDK) – for all Lambda logic
AWS Lambda – split into 4 specialized functions
Amazon CloudWatch – for real-time disk monitoring and alarm creation
Amazon EventBridge – to manage event-driven triggers
AWS Step Functions – for orchestration and error-handling
AWS SSM & YAML – for secure and reusable configuration

Deployment was tested on Amazon Linux EC2 (XFS file system). Snapshots were generated prior to expansion to ensure safe rollback and continuity.

Challenges We Ran Into

Lambda chaining complexity: Step Functions don’t accept alarms directly, so an intermediary Lambda was required.
Filesystem compatibility: The EC2 instance used xfs, which requires unique expansion steps versus ext4.
EBS throttling: AWS limits volume modifications to once per 24 hours, forcing careful timing and testing.
IAM roles: Debugging permission chains between CloudWatch, EventBridge, Lambda, and Step Functions was time-consuming but critical.

Accomplishments That We're Proud Of

Built a production-ready AWS automation system with zero manual dependencies.
Achieved fully event-driven orchestration across EC2, EBS, and monitoring services.
Designed error-tolerant Step Functions with modular, testable Lambda functions.
Successfully deployed and tested real-time root volume expansion with EC2 under load.

What We Learned

Event-driven design with CloudWatch + EventBridge + Lambda can elegantly replace manual workflows.
AWS Step Functions offer a powerful, visual way to manage multi-step cloud automations with state tracking and error handling.
Infrastructure-as-code principles (YAML + SSM) make automation scalable and reproducible.
Even a small automation like root volume expansion can dramatically improve production reliability when built right.

What's Next for Automation of EC2 Root Volume Expansion

This project lays the groundwork for more advanced cloud automation pipelines. Our future roadmap includes:

Full EBS Coverage: Extend beyond root volumes to include attached data volumes across distributed EC2 instances.
Snapshot Automation: Automatically create and manage snapshots before any volume change to support rollback.
AI-Powered Forecasting: Integrate with AWS Bedrock or SageMaker to predict disk usage and schedule proactive scaling.
Slack/Email Alerts: Notify DevOps teams when scaling events occur or thresholds are about to be breached.
Cross-Cloud Portability: Replicate this architecture using equivalents in Azure and GCP.