AWS Elastic Disaster Recovery (DRS) Initializer - CloudFormation

Single CloudFormation template to automatically initialize AWS Elastic Disaster Recovery (DRS) in any AWS region using an inline Lambda function.

Overview

This template deploys a Lambda function that fully initializes DRS:

1. IAM Role Verification - Scans existing IAM roles and SLR, creates if missing, fixes policies if needed
2. DRS Initialization - Initializes the DRS service in the target region
3. Replication Template - Creates or updates replication configuration with PIT recovery policy
4. Launch Template - Creates or updates DRS launch configuration template
5. EC2 Launch Template - Creates EC2 launch template for recovery instances if not exists

Architecture

┌─────────────────┐     ┌─────────────────┐     ┌─────────────────┐
│ CloudFormation  │────▶│  Lambda Function │────▶│   DRS Service   │
│ (Custom Resource)│    │  (Initializer)   │     │   (Configured)  │
└─────────────────┘     └─────────────────┘     └─────────────────┘
                               │
                               ▼
                        ┌─────────────────┐
                        │   IAM Roles     │
                        │   (6 roles)     │
                        └─────────────────┘

Prerequisites

• AWS account with permissions to create IAM roles, Lambda functions, and CloudWatch log groups
• VPC with at least one subnet and security group

Deploy via Console

1. Go to CloudFormation Console → Create Stack → Upload a template file
2. Upload template.yaml
3. Fill in required parameters:
   • Staging Area Subnet - Select your subnet
   • Replication Server Security Groups - Select your security group(s)
   • All other parameters have defaults
4. Check "I acknowledge that AWS CloudFormation might create IAM resources with custom names"
5. Create stack

Parameters

Required

Parameter	Description
pStagingSubnetId	Subnet ID for DRS staging area
pReplicationSecurityGroupIds	Security group IDs for replication servers

Optional (with defaults)

Parameter	Default	Description
pReplicationInstanceType	t3.small	Replication server instance type
pReplicationStagingDiskType	GP3	Staging disk type (GP2, GP3, ST1)
pReplicationDataThrottling	0	Bandwidth limit in Mbps (0 = unlimited)
pReplicationServerPublicIp	No	Public IP for replication servers
pReplicationServerDataRouting	PRIVATE_IP	Data plane routing
pUseDedicatedReplicationServer	No	Dedicated replication server
pAutoReplicateNewDisks	Yes	Auto-replicate new disks
pCreateReplicationSecurityGroup	Yes	Associate default security group
pKMSKeyArn	(empty)	KMS key ARN for EBS encryption
pLaunchDisposition	STARTED	Launch state (STARTED/STOPPED)
pCopyTags	Yes	Copy tags to recovery instances
pCopyPrivateIp	No	Copy private IP
pRightSizing	BASIC	Right-sizing method (NONE/BASIC)
pPostLaunchEnabled	Yes	Enable post-launch actions

Outputs

Output	Description
oReplicationConfigurationTemplateId	Replication configuration template ID
oLaunchConfigurationTemplateId	Launch configuration template ID
oEC2LaunchTemplateId	EC2 launch template ID

Multi-Region Deployment

Deploy the same template to additional regions via the CloudFormation Console:

1. Switch to the target region in the AWS Console
2. Create Stack → Upload template.yaml
3. Provide subnet and security group IDs for the target region
4. Create stack

Lambda function name and IAM role include the region suffix to avoid conflicts.

Stack Update

To update DRS configuration, update the stack with new parameter values. The Lambda will:

• Skip IAM role creation (roles already exist)
• Skip DRS initialization (already initialized)
• Update the replication configuration template with new settings
• Update the launch configuration template with new settings

Cleanup

Delete the stack from the CloudFormation Console. This removes:

• Lambda function
• Lambda execution role

The following persist after stack deletion:

• DRS service state (initialized)
• IAM service roles (6 roles + SLR)
• Replication and launch configuration templates
• CloudWatch log group (retained for audit)

Notes

• DRS can only be initialized once per region. Subsequent runs update existing configurations.
• IAM roles are global. If roles exist from another region's deployment, the Lambda skips creation.
• The CloudWatch log group uses DeletionPolicy: Retain for audit purposes. Delete manually if needed.