Monitor for Launched EC2 Instances Not Within Free Tier and Receive Customized Email Notifications

AWS offers a Free Tier to provide new users the ability to explore and try out AWS services free of charge up to specified limits for each service.

Amazon EC2 is one of the services available to use in the AWS Free Tier, which includes up to 750 hours of Linux and Windows t2.micro instances, (t3.micro for the regions in which t2.micro is unavailable) each month for one year for new AWS customers. This is extremely helpful to those who are just getting started with AWS.

In this post, I will share how to monitor EC2 instances launched that is not within the free tier (t2.micro) and receive customized notifications in your email.

Hopefully, this will help you avoid unnecessary costs in your account, especially when you are just starting to learn AWS.

Solution Overview

The following diagram illustrates the solution architecture:

For this, you will perform the following steps:

1. Setup Amazon SNS
2. Create an Amazon EventBridge Rule
3. Test the Solution

Prerequisites

You should have the following prerequisites:

• CloudTrail logging turned on for your AWS account. This is needed to be able to receive AWS API action events

Steps

Step 1: Setup Amazon SNS

1. Open the Amazon SNS console, and then choose Topics from the navigation pane

2. Select Create topic

3. In the Details section, use the following details:
   Type: Standard
   Name: Enter a name for your topic
   

4. Select Create topic

5. On the Subscriptions tab of the newly created topic, choose Create subscription

6. In the Details section of Create subscription page, use the following details:
   Protocol: Email
   Endpoint: Enter the email address where you want to receive the notifications

7. Select Create subscription

8. After your subscription is created, a subscription confirmation email is sent to the address you entered. Click on the Confirm subscription link in the email

Step 2: Create an Amazon EventBridge Rule

1. Open the Amazon EventBridge console, and then choose Rules from the navigation pane
2. Select Create rule
3. Enter a Name for your rule
4. In Define pattern section, select Event pattern
5. In Event matching pattern, choose Custom pattern

6. In Event pattern text box, enter the following:
   

   {
   "source": ["aws.ec2"],
   "detail-type": ["AWS API Call via CloudTrail"],
   "detail": {
   "eventSource": ["ec2.amazonaws.com"],
   "eventName": ["RunInstances"],
   "requestParameters": {
     "instanceType": [{
       "anything-but": "t2.micro"
     }]
   }
   }
   }
   

7. Click on Save

8. In Select targets section, choose SNS topic from the Target dropdown list

9. For Topic, choose the topic name that you created earlier

10. Expand Configure input

11. Choose Input Transformer

12. For Input Path text box, enter the following:
    

    {"account":"$.account","eventid":"$.detail.eventID","eventsource":"$.source","instance-type":"$.detail.requestParameters.instanceType","region":"$.region","time":"$.time","user":"$.detail.userIdentity.userName"}
    

13. For Input Template text box, enter the following:
    

    "An EC2 instance with a non-t2.micro instance type was launched with the following details:"
    "Instance Type: <instance-type>"
    "Event Time: <time> (UTC)"
    "AWS Account: <account>"
    "AWS Region: <region>"
    "User: <user>"
    "Event Source: <eventsource>"
    "Event ID: <eventid>"
    

14. Click on Create

Step 3: Test the Solution

1. Open the Amazon EC2 console, and then choose Launch instances
2. Select an Amazon Machine Image (AMI)
3. In the Instance Type, choose t2.small
4. Click on Review and Launch
5. Click on Launch
6. Select a key pair
7. Click on Launch Instances
8. After a few seconds, you should receive an email about the created EC2: Please don’t forget to terminate the EC2 instance after testing is completed.

Congratulations! You are now able to monitor your EC2 instances with non-free tier instance types and receive a customized email notification about it as well.