Question

A company runs a critical VPC that hosts a public-facing application. Recently, an operator accidentally detached the Internet Gateway (IGW) during a maintenance window, causing a 20-minute outage. The DevOps team wants an automated response that immediately re-attaches the IGW to the VPC whenever it is detached, and notifies the on-call engineer. All API activity is already captured in a multi-region CloudTrail trail. Which approach meets these requirements with the LEAST operational overhead?

Accepted Answer

Create an EventBridge rule that matches the CloudTrail 'DetachInternetGateway' management event, targeting a Lambda function that calls AttachInternetGateway with the affected IGW and VPC IDs from the event detail, and publishes to an SNS topic subscribed by the on-call engineer.

Answer

Enable AWS Config with a custom rule that evaluates IGW attachment status every 24 hours and triggers an SSM Automation runbook to re-attach the IGW when found non-compliant.

Answer

Create a CloudWatch metric filter on the CloudTrail log group for 'DetachInternetGateway', set an alarm, and email the on-call engineer so they can manually re-attach the gateway.

Answer

Schedule an EventBridge rule to run every 5 minutes invoking a Lambda function that describes all IGWs, compares attachment state to a stored baseline in DynamoDB, and re-attaches any detached gateway.