[Security and Compliance] A company has a policy that requires all Amazon EC2 instances to have a specific set of tags. If an EC2 instance does not…

https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-managerautomation.html

To ensure all EC2 instances have the required tags and terminate any noncompliant instances, AWS

Config can be used to check the compliance, and AWS Systems Manager Automation can be invoked

to take action on noncompliant instances.

Create AWS Config Rule:

Open the AWS Config console at AWS Config Console.

Create a new rule to check for the required tags on EC2 instances. Use the managed rule required-

tags.

Create AWS Systems Manager Automation Document:

Open the AWS Systems Manager console at AWS Systems Manager Console.

Create an Automation document to terminate noncompliant instances.

Link AWS Config Rule to Automation:

In the AWS Config console, configure the rule to invoke the Systems Manager Automation document

if an instance is found to be noncompliant.

AWS Config Rules

AWS Systems Manager Automation

AWS Config Managed Rules