Amazon EventBridge: Triggering Lambda from EC2 Stop Events

Purpose of This Lesson

This hands-on lesson demonstrates an event-driven monitoring workflow in AWS:

1. An EC2 instance is stopped.
2. The resulting StopInstances API call is recorded by AWS CloudTrail.
3. Amazon EventBridge matches the CloudTrail event with an event pattern.
4. EventBridge invokes an AWS Lambda function.
5. Lambda writes the event details to Amazon CloudWatch Logs.

The exercise provides a practical example of using EventBridge to respond to AWS API activity without continuously polling for changes.

Key Concepts

• Amazon EC2: The resource whose state change initiates the workflow.
• AWS CloudTrail: Records the EC2 management API call generated when the instance is stopped. The lab requires a CloudTrail trail with management events enabled.
• Amazon EventBridge: Evaluates incoming events against a rule’s event pattern and invokes a configured target when the pattern matches.
• Event pattern: The JSON-based filter that specifies which events should trigger the rule. This lab filters for EC2 AWS API calls recorded through CloudTrail and the StopInstances operation.
• AWS Lambda: Receives the matched event and processes it. The lab’s function prints the event so it can be reviewed in CloudWatch Logs.
• Amazon CloudWatch Logs: Stores the Lambda output, providing a record of the matched event and its details.
• Default Lambda execution role: The Lambda function is created with a basic execution role that includes permissions to create log streams and put log events in CloudWatch Logs.

Event-Driven Architecture and Lab Workflow

1. Prepare CloudTrail

Before testing the rule, verify that a CloudTrail trail exists and that management events are enabled. CloudTrail is essential because EventBridge is matching the API activity recorded from the EC2 operation.

Without the required CloudTrail trail and management-event configuration, the stop operation will not produce the event expected by this lab’s rule.

2. Create the Lambda Function

Create a Lambda function named stop EC2 lab using Python and the supplied course code from the Amazon EventBridge/eventbridgeeventeC2.md file.

After creating the function:

• Replace the default source with the supplied code.
• Deploy the function.
• Confirm that its execution role supports CloudWatch Logs creation and event delivery.

The function’s purpose in this exercise is to write the received EventBridge event into CloudWatch Logs.

3. Launch an EC2 Instance

Launch an EC2 instance using the current Amazon Linux 2023 AMI ID. Record the instance ID because it is needed for the stop and cleanup operations.

4. Create the EventBridge Rule

Create an EventBridge rule named EC2 stop instances lab with an event pattern. Use the pattern form with the following selections:

• Event source: AWS events or EventBridge partner events
• Source type: AWS services
• AWS service: EC2
• Event type: AWS API call via CloudTrail
• API operation: StopInstances

The important detail is the exact operation name and capitalization. The pattern must match the API operation represented in the event, not an informal description such as “stop instance.”

Configure the Lambda function as the rule’s target. EventBridge can update or create the target execution permissions required for the rule to invoke the selected function.

5. Generate and Verify the Event

Stop the EC2 instance using the lab’s EC2 stop operation. The expected processing sequence is:

EC2 StopInstances API call
        ↓
AWS CloudTrail management event
        ↓
Amazon EventBridge event pattern match
        ↓
AWS Lambda invocation
        ↓
Amazon CloudWatch Logs entry

Open the Lambda function’s monitoring view and select View CloudWatch Logs. The resulting log stream should contain the event data, including information showing that the instance was stopped.

6. Clean Up

After verification, terminate the test EC2 instance using the TerminateInstances operation. If the resources are no longer needed, remove the EventBridge rule and optionally delete the CloudTrail trail, taking care not to remove a trail used for other monitoring or governance requirements.

Assessment-Relevant Takeaways

• Recognize that an EC2 stop action is an API operation that can be captured through CloudTrail and consumed by EventBridge.
• For this workflow, the CloudTrail trail must have management events enabled.
• Select AWS API call via CloudTrail when building the EventBridge event pattern for this use case.
• Use the exact EC2 operation name StopInstances; capitalization and spelling matter in the event pattern.
• EventBridge rules evaluate events and invoke targets; Lambda performs the processing logic.
• CloudWatch Logs is the destination used in this lab to verify what Lambda received.
• The EventBridge rule does not itself provide the event details in a log; the configured Lambda function writes those details to CloudWatch Logs.
• Distinguish the triggering action, the event source, the rule, the target, and the final log destination when troubleshooting the workflow.
• A missing CloudTrail management-event configuration prevents the expected event from reaching the rule.
• The lab demonstrates a narrow logging use case, but the same event-driven pattern can support many response workflows.

Tool / Feature Decision Guide

Requirement	Appropriate component	Reason
Record the EC2 API activity	CloudTrail management events	The EC2 stop is an API call whose activity must be captured.
Filter for a specific AWS API action	EventBridge event pattern	The rule can match EC2 events and the StopInstances operation.
Execute code after a match	AWS Lambda target	Lambda receives and processes the matched event.
Review the event received by Lambda	CloudWatch Logs	The lab function writes the event details to a log stream.
Stop the test instance	EC2 stop operation / StopInstances	This generates the event used to test the rule.
Remove the test resource	EC2 terminate operation / TerminateInstances	This cleans up the instance after validation.

Use EventBridge when the response should be driven by an event match. Do not treat CloudWatch Logs as the trigger in this workflow; it is the verification and recording destination after Lambda runs.

Common Traps / Misconceptions

• Assuming EventBridge can match the event without CloudTrail: This lab depends on a CloudTrail trail with management events enabled.
• Using an informal operation name: The event pattern must use the API operation represented by the event, StopInstances, with the expected capitalization.
• Confusing stopping with terminating: Stopping the instance generates the test event. Termination is the later cleanup action and is a different EC2 operation.
• Expecting the rule to write directly to CloudWatch Logs: In this design, Lambda is the target and Lambda writes the received event to CloudWatch Logs.
• Forgetting to deploy the Lambda code: Replacing the code without deploying it leaves the function running its previous version.
• Failing to record the instance ID: The instance ID is required to target the correct instance for the stop and termination operations.
• Deleting shared infrastructure during cleanup: Delete the trail only if it is not needed for other account monitoring or governance activities.
• Treating a successful rule creation as proof of operation: The end-to-end test is not complete until the event appears in the Lambda CloudWatch Logs stream.

Real-World Engineer / Analyst Notes

• Debug the workflow from left to right: confirm the EC2 API call, verify CloudTrail captured it, inspect the EventBridge rule pattern and target, then check Lambda execution and CloudWatch Logs.
• When an event-driven workflow fails, determine whether the problem is event generation, event recording, pattern matching, target invocation, function execution, or logging.
• Exact event structure matters. A rule that is too broad may trigger on unwanted activity, while a rule that specifies the wrong operation will not match.
• The basic Lambda execution role is sufficient for the lab’s logging behavior because it includes CloudWatch Logs permissions. More complex processing would require additional permissions appropriate to the target services.
• Keep test resources and monitoring resources separate in your cleanup plan. Terminating the EC2 test instance is expected; deleting a CloudTrail trail may affect unrelated auditing.
• EventBridge plus Lambda can turn API activity into automated notification, remediation, or evidence-collection workflows. This lesson uses CloudWatch Logs only to make the event visible.

Quick Reference Summary

• Triggering action: EC2 StopInstances API call.
• Event recorder: AWS CloudTrail management events.
• Matching service: Amazon EventBridge.
• Critical event pattern choice: EC2 → AWS API call via CloudTrail → StopInstances.
• Target: AWS Lambda function.
• Verification destination: Amazon CloudWatch Logs.
• Required prerequisite: A CloudTrail trail with management events enabled.
• Cleanup operation: EC2 TerminateInstances, followed by optional deletion of the EventBridge rule and unused CloudTrail trail.

Flashcards

Q: What prerequisite must exist before the EventBridge rule in this lab can detect an EC2 stop?

A: A CloudTrail trail with management events enabled must be configured so the EC2 API call is recorded.

Q: Which EventBridge event type should be selected for matching the EC2 stop API activity?

A: Select AWS API call via CloudTrail under the EC2 service.

Q: Which EC2 API operation should the event pattern match?

A: Match StopInstances. The operation name and capitalization must correspond to the event pattern value.

Q: An engineer wants Lambda to process an EC2 API event only after EventBridge identifies it. Which service should be the rule target?

A: AWS Lambda should be the EventBridge target because it executes the processing code after the rule matches.

Q: Where does the lab verify that Lambda received the EventBridge event?

A: In the Lambda function’s CloudWatch Logs log stream, accessed through the function’s monitoring view.

Q: What is the role of CloudTrail in this architecture compared with EventBridge?

A: CloudTrail records the EC2 management API call, while EventBridge evaluates the resulting event against a rule pattern.

Q: What is the role of CloudWatch Logs compared with Lambda?

A: Lambda processes the matched event and writes its output; CloudWatch Logs stores that output for inspection.

Q: Why might a correctly configured-looking EventBridge rule never trigger in this lab?

A: The CloudTrail trail may be missing or may not have management events enabled, so the expected API event is not available for matching.

Q: When should TerminateInstances be used in this exercise?

A: Use it after testing to remove the EC2 instance. It is a cleanup action, not the API operation used to generate the rule’s test event.

Q: What must be done after replacing the default Lambda source code?

A: Deploy the function so the new code is the version invoked by EventBridge.

Q: An event appears in CloudTrail but not in the Lambda log stream. Which parts of the workflow should be investigated next?

A: Check the EventBridge event pattern, rule state and target permissions, Lambda invocation, and the function’s CloudWatch Logs output.

Q: What does this lab demonstrate about event-driven architecture?

A: A resource API action can be recorded, filtered, and routed automatically to code that performs a response or records the event without polling.

Practice Questions

Question 1

An EC2 instance is stopped, but the EventBridge rule does not invoke Lambda. The rule is configured for EC2 API calls via CloudTrail and uses the StopInstances operation. What should be checked first?

A. Whether the EC2 instance uses Amazon Linux 2023
B. Whether the CloudTrail trail has management events enabled
C. Whether the Lambda function has an HTTP endpoint
D. Whether CloudWatch Logs has a metric filter

Correct answer: B

Explanation: The lab requires a CloudTrail trail with management events enabled. Without that event source, the EventBridge rule cannot match the expected API activity.

Question 2

An engineer enters stop instances into the EventBridge operation filter and receives no matches. What is the most likely issue?

A. EventBridge rules cannot target Lambda
B. EC2 stop actions are not API calls
C. The operation must use the exact API name StopInstances
D. CloudWatch Logs must be selected as the rule target

Correct answer: C

Explanation: The pattern must match the API operation name represented in the event, including the expected spelling and capitalization: StopInstances.

Question 3

Which sequence correctly represents the lab’s event flow?

A. CloudWatch Logs → Lambda → CloudTrail → EC2
B. EC2 stop API call → CloudTrail → EventBridge → Lambda → CloudWatch Logs
C. Lambda → EventBridge → EC2 stop API call → CloudTrail
D. EC2 stop API call → CloudWatch Logs → CloudTrail → Lambda

Correct answer: B

Explanation: The EC2 API call is recorded by CloudTrail, matched by EventBridge, processed by Lambda, and written to CloudWatch Logs.

Question 4

The test has succeeded and the engineer wants to remove only the temporary compute resource. Which operation should be performed?

A. StopInstances
B. TerminateInstances
C. PutLogEvents
D. CreateTrail

Correct answer: B

Explanation: TerminateInstances removes the test EC2 instance. StopInstances is the operation used to generate the event for the exercise.

WordPress Metadata

Suggested Slug:
amazon-eventbridge-ec2-stop-events-lambda

Meta Description:
Learn how CloudTrail, Amazon EventBridge, Lambda, and CloudWatch Logs work together to detect and record EC2 StopInstances API events.

Tags:
AWS EventBridge, Amazon EC2, AWS CloudTrail, AWS Lambda, Amazon CloudWatch Logs, event-driven architecture, event patterns, AWS CLI, monitoring, remediation