Match the UPDATE_COMPLETE stack status in an EventBridge rule and invoke the tagging Lambda function

Why the Answer Is Correct

The tagging must occur only after a successful update, and CloudFormation publishes an event when a stack instance reaches the UPDATE_COMPLETE status. An Amazon EventBridge rule whose event pattern matches that instance status can target the existing Lambda function directly, so the moment the update completes successfully the function runs and applies the tag to the specified stack instance (C). This is the most direct mechanism available: it consumes the service event, filters on the exact status, invokes the function, and leaves the stack's existing SNS notification configuration untouched.

Why the Other Options Are Wrong

A runs the AWS-UpdateCloudFormationStack Systems Manager Automation document when Systems Manager detects an UPDATE_COMPLETE event. CloudFormation stack instance statuses are reported through CloudFormation's own event channel, not detected by Systems Manager, and invoking a document that updates a stack after the update has already succeeded is both circular and unnecessary. WhyIronMan cited the EventBridge documentation as the correct mechanism. B creates a custom AWS Config rule that produces a compliance change event if the stack has an UPDATE_COMPLETE status and then configures AWS Config to invoke the Lambda function. AWS Config does not invoke Lambda functions directly in response to compliance change events, so the described integration does not function, and it also introduces a custom rule. D adjusts the stack's notification configuration so that only UPDATE_COMPLETE is sent to the SNS topic and subscribes the Lambda function to that topic. The stack is already configured to send event notifications to the topic, and narrowing it to a single status would suppress the other stack events the team depends on, making it a regression rather than a solution. C is the correct answer.

Community Comment Notes

Community voted C unanimously. GripZA explained that EventBridge is designed to detect specific AWS service events and can be configured to match CloudFormation UPDATE_COMPLETE, which automates the tagging. dkp noted that C is more direct than D because it requires no additional SNS configuration. WhyIronMan cited the EventBridge documentation for invoking Lambda, and ogerber confirmed C.