问题
I have created cloudwatch alarms for cloudtrail events. I am getting the email notification whenever there is a state change. But It is tough for me to search for the instance which is deleted among hundreds of instances. It will be easier if I get the instance name in the notification Email. Have anyone tried this?
回答1:
The best method is:
- Create an Amazon SNS topic to receive the notification
 - Subscribe to the topic to receive notifications (eg via Email)
 - Create a rule in Amazon CloudWatch Events to trigger when an instance is terminated:
 
The result will be a message like this sent via email (or however you subscribed to the topic):
{
    "version": "0",
    "id": "0c921724-d932-9cc2-b620-4053a0ad3f73",
    "detail-type": "EC2 Instance State-change Notification",
    "source": "aws.ec2",
    "account": "123456789012",
    "time": "2018-01-09T07:04:42Z",
    "region": "ap-southeast-2",
    "resources": [
        "arn:aws:ec2:ap-southeast-2:123456789012:instance/i-0a32beef35b8da342"
    ],
    "detail": {
        "instance-id": "i-0a32beef35b8da342",
        "state": "terminated"
    }
}
    来源:https://stackoverflow.com/questions/48162519/create-email-notification-when-an-ec2-instance-is-terminated-the-email-should-c