Question

A DevOps team must automatically enforce cost-allocation tagging on all newly launched EC2 instances across a single account. Whenever an instance transitions to the 'running' state, a Lambda function should verify required tags and apply defaults if any are missing. The solution must be event-driven with minimal latency and require no polling. Which approach best meets these requirements?

Accepted Answer

Create an EventBridge rule matching the 'EC2 Instance State-change Notification' event pattern for the 'running' state and set the tagging Lambda function as the target.

Answer

Configure a CloudWatch alarm on the EC2 StatusCheckFailed metric that triggers the tagging Lambda function via an SNS topic.

Answer

Schedule an EventBridge rule to invoke the tagging Lambda function every 5 minutes to scan for untagged running instances.

Answer

Enable AWS CloudTrail and create a CloudWatch Logs metric filter on the RunInstances API call that triggers the Lambda function.