Get notifications for every resource change in EC2 instance

Question

I have an application which reads network information from my EC2 resources. The application needs to know about NICs (ENI), VPCs, Subnets running in AWS. Currently the application keeps polling AWS APIs ie describeNetworkInterfaces() , describeVpcs() to see if anything is up or down.

I want to remove this polling functionality and let AWS notify me someway if a new EC2 instance is launched or a new ENI is created, if a tag on ENI is changed.

Is there any way of doing it in AWS?

I had a look at SNS and CloudWatch AWS services. But to my understanding CloudWatch does not have the 'alarm' for ENI, VPC, subnet, tags etc. And SNS needs someone to push messages so that my application can read from there, EC2 by default does not push any message for a new ENI or VPC.

Answer 1

Yes you can monitor the changes to your AWS resources using AWS Config Service

Here is a developer guide for setting up AWS Config: Set Up AWS Config Using the Console

Answer 2

There are two services that are of relevant: AWS Config and AWS CloudTrail .

AWS Config captures information about EC2-related resources. This includes instances, subnets, security groups, ENI, Route Tables, VPCs, etc. Every change is recorded. The current configurations can be retrieved and the change history can be viewed.

AWS CloudTrail captures API requests made to AWS. This includes calls that change resources, such as changing tags, attaching ENIs, starting/stopping instances, etc.

CloudTrail can be used with CloudWatch Events to trigger notifications when particular API calls are made (eg AttachNetworkInterface ). CloudWatch Events can then trigger an SNS notification or push a message into an SQS queue. It can even trigger an AWS Lambda function that could, for example, inspect the event, check for a certain condition and then send a notification or perform an operation.

For example, when an EC2 instance is launched, CloudTrail will send the API information to CloudWatch Events , which could trigger a Lambda function that inspects the tags on the instance and, if a particular tag value is on the instance (eg Environment = Production), notify somebody.

Note: CloudWatch Events and Lambda are not in every region.