Reply To: AWS Config SNS Notification

[Jon-Bonso]

Hi Mao,

Thank you for your reply. It is true that you cannot directly trigger a Lambda function from AWS Config. The AWS Lambda function in AWS Config is primarily used to evaluate whether your AWS resources comply with the rule or not. The remediation action is done via the AWS Systems Manager Automation. However, take note that you can call a Lambda from your Systems Manager workflow to terminate the EC2 instance:

https://docs.aws.amazon.com/systems-manager/latest/userguide/automation-walk-patch-windows-ami-simplify.html#automation-pet4

I understand that the Systems Manager Automation document has an AWS-StopEC2Instance action that you can use to terminate the EC2 instances:

https://docs.aws.amazon.com/systems-manager/latest/userguide/automation-aws-stopec2instance.html

Same goes with Lambda:

https://aws.amazon.com/premiumsupport/knowledge-center/start-stop-lambda-cloudwatch/

I acknowledge that we can add more information on this option to avoid any misunderstanding like this in the future. I’ll revise the option to also mention Systems Manager Automation as part of the answer.

Let us know if you need further assistance. The Tutorials Dojo team is dedicated to help you pass your AWS exam on your first try!

Regards,

Jon Bonso @ Tutorials Dojo