Cross-Account EC2 Lifecycle Events to One SQS Queue

DVA-C02 By islever Editorial Last updated

Implement authentication and/or authorization for applications and AWS services. Develop code for applications hosted on AWS.

Short answer

D Forward each account's EC2 lifecycle events to the main account's central EventBridge event bus, then have a rule on that bus deliver them to the SQS queue.

Question

A company is running Amazon EC2 instances in multiple AWS accounts. A developer needs to implement an application that collects all the lifecycle events of the EC2 instances. The application needs to store the lifecycle events in a single Amazon Simple Queue Service (Amazon SQS) queue in the company's main AWS account for further processing.
Which solution will meet these requirements?
  1. Configure Amazon EC2 to deliver the EC2 instance lifecycle events from all accounts to the Amazon EventBridge event bus of the main account. Add an EventBridge rule to the event bus of the main account that matches all EC2 instance lifecycle events. Add the SQS queue as a target of the rule.
  2. Use the resource policies of the SQS queue in the main account to give each account permissions to write to that SQS queue. Add to the Amazon EventBridge event bus of each account an EventBridge rule that matches all EC2 instance lifecycle events. Add the SQS queue in the main account as a target of the rule.
  3. Write an AWS Lambda function that scans through all EC2 instances in the company accounts to detect EC2 instance lifecycle changes. Configure the Lambda function to write a notification message to the SQS queue in the main account if the function detects an EC2 instance lifecycle change. Add an Amazon EventBridge scheduled rule that invokes the Lambda function every minute.
  4. Configure the permissions on the main account event bus to receive events from all accounts. Create an Amazon EventBridge rule in each account to send all the EC2 instance lifecycle events to the main account event bus. Add an EventBridge rule to the main account event bus that matches all EC2 instance lifecycle events. Set the SQS queue as a target for the rule. Correct Answer

Key Takeaways

The question tests whether you know how EC2 state-change events reach EventBridge and how EventBridge shares events cross-account; the trap is assuming EC2 itself can be pointed at another account's bus, or that a Lambda polling sweep is an acceptable substitute for real-time events.

This DVA-C02 scenario asks how to aggregate EC2 instance lifecycle events from multiple AWS accounts into a single Amazon SQS queue in a main account. The correct pattern is cross-account Amazon EventBridge event buses: each workload account forwards its EC2 lifecycle events to the central account's event bus, where one rule matches them and targets the SQS queue.

Common mistake: Option B is the most tempting wrong-leaning choice: giving the SQS queue a resource policy so each account's EventBridge rule targets the queue directly does technically work, but it skips the centralized, permission-governed cross-account event bus pattern AWS recommends, spreading per-account targets and queue-policy exposure instead of one controlled ingress point.

Expert Analysis

Why the Answer Is Correct

Option D follows the documented AWS cross-account EventBridge pattern: you add a resource-based policy on the main account's event bus that permits the source accounts to put events, create a rule in each account that matches EC2 instance lifecycle (state-change) events and forwards them to that central bus, then place one rule on the main bus whose target is the SQS queue. EC2 automatically emits state-change events to the default event bus of the account where the instance runs, so the only cross-account work is the bus-to-bus forwarding, which is exactly what D describes. This yields a single, auditable aggregation point where lifecycle events from every account land in one queue for downstream processing.

Why the Other Options Are Wrong

Option A is invalid because Amazon EC2 has no configuration to deliver its lifecycle events to a different account's event bus; state-change notifications always go to the local account's default bus, so the stated EC2 step cannot be performed. Option C replaces a real-time event stream with a Lambda function scheduled every minute that scans all EC2 instances across accounts, which introduces detection latency, extra cross-account polling permissions, and needless cost when EventBridge already delivers these events natively. Option B can technically function because an SQS queue policy can allow another account to send messages and EventBridge can target it, but it bypasses the centralized event bus, forcing every account's rule to point directly at a shared queue and scattering ingestion control; between the two working designs, the AWS-recommended and more governable answer is D.

Community Comment Notes

Untamables, the top-voted comment, backs D and cites the EC2 state-change monitoring guide plus the EventBridge cross-account event-bus documentation, which matches this analysis. KillThemWithKindness concedes that "Both B and D works, but D is more centralized," which is the deciding factor here. TeeTheMan argues for B on step count and questions "why would you want to pollute the event bus of the main account," but centralizing inbound events on one bus is precisely the intended, permission-controlled design. haaris786 and good_ favor A, which rests on the false premise that EC2 can be configured to deliver to another account's bus, and trieudo correctly discards A and C for the same maintenance and latency reasons.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

On multi-account aggregation questions, look for the pattern that centralizes ingress with a resource-based policy on the receiving event bus, since cross-account EventBridge buses are the AWS-recommended design. Be skeptical of any option that claims EC2 can be reconfigured to emit to another account, or that proposes scheduled Lambda scanning of live resources.

Frequently Asked Questions

Can Amazon EC2 lifecycle events be configured to go straight to the main account's event bus?

No. EC2 state-change events are emitted to the default event bus of the account where the instance runs; cross-account delivery requires an EventBridge rule forwarding them to another account's bus.

Why not give the SQS queue a resource policy and target it directly from each account?

A cross-account rule can target a foreign SQS queue when the queue policy permits it, but that scatters ingestion control across accounts. Centralizing on one event bus gives a single governed entry point, which AWS recommends.

More DVA-C02 FAQ →

Discussion 29 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 29

  1. Untamables 👍 21 Answered D
    The correct answer is D. Amazon EC2 instances can send the state-change notification events to Amazon EventBridge. https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/monitoring-instance-state-changes.html Amazon EventBridge can send and receive events between event buses in AWS accounts. https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-cross-account.html
  2. geekdamsel 👍 11
    This question came in exam. Correct answer is D.
  3. TeeTheMan 👍 5 Answered B
    Seems to me the correct answer is B. The current most voted answer is B, but can someone explain why it’s better than B? I think B is better because it has fewer steps. The events go straight from each account into the queue. Unlike in D which has the intermediate step of the event bus of the main account. Also, why would you want to pollute the event bus of the main account with events from other accounts when it isn’t necessary?
  4. haaris786 👍 5
    Answer A: This makes more sense and a simplified solution.
  5. KillThemWithKindness 👍 4
    Sorry Im wrong, AWS allow to send and receive Amazon EventBridge events between AWS accounts. https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-cross-account.html Both B and D works, but D is more centralized
Show 24 more comments
  1. good_ 👍 4
    I think the answer to this question is also A.
  2. aragon_saa 👍 4
    D a public discussion thread on this question
  3. KillThemWithKindness 👍 2
    B Answer A is incorrect because Amazon EventBridge events can't be sent directly from one account's event bus to another. Answer C is incorrect because it's unnecessary and inefficient to use Lambda to periodically scan all EC2 instances for lifecycle changes. Amazon EventBridge can capture these events automatically as they occur. Answer D is incorrect because it is not possible to configure the main account event bus to receive events from all accounts directly, and Amazon EventBridge events can't be sent directly from one account's event bus to another. The EventBridge rules need to be set up in the accounts where the events are generated.
  4. trieudo 👍 2 Answered D
    ==> Discard C: lamdba scans ==> it will be delay by scan all data ==> Discard A: 'matches all EC2 instance' ==> hard to maintain, when updating many times can occurs ==> Discard B: it works, but it maybe have some security problem when pushing raw data (not clean) into SQS. It also doesn't take advantage of D: By configuring the main account's event bus to accept events from other accounts and adding rules in those accounts to forward lifecycle events, this solution achieves secure and efficient centralization. EventBridge then routes the events to an SQS queue in the main account for further processing.
  5. MrTee 👍 2 Answered D
    This solution allows the collection of all the lifecycle events of the EC2 instances from multiple AWS accounts and stores them in a single Amazon SQS queue in the company’s main AWS account for further processing
  6. ezredame 👍 2 Answered D
    The correct answer is D. https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-cross-account.html
  7. dongocanh272 👍 2 Answered D
    My answer is D
  8. Bibay 👍 1 Answered A
    Option D is not the best solution because it involves configuring the permissions on the main account's EventBridge event bus to receive events from all accounts, which can lead to potential security risks. Allowing other AWS accounts to send events to the main account's EventBridge event bus can potentially open up a security vulnerability, as it increases the attack surface area for the main account. On the other hand, option A is the best solution because it involves using Amazon EventBridge, which is a serverless event bus that can be used to route events between AWS services or AWS accounts. By configuring Amazon EC2 to deliver the EC2 instance lifecycle events from all accounts to the Amazon EventBridge event bus of the main account, and adding the SQS queue as a target of the rule, the application can collect all the lifecycle events of the EC2 instances in a single queue in the main account without compromising the security posture of the AWS environment.
  9. sumanshu 👍 1
    A) Eliminated - Amazon EC2 itself does not send lifecycle events directly to EventBridge in another account. The EC2 lifecycle events would be published to EventBridge within the account where the EC2 instance resides. The key here is using EventBridge cross-account event bus access. Amazon EventBridge allows for event buses to receive events from other AWS accounts if the appropriate permissions are set.
  10. lebbar 👍 1 Answered D
    D. Configure the permissions on the main account event bus to receive events from all accounts. Create an Amazon EventBridge rule in each account to send all the EC2 instance lifecycle events to the main account event bus. Add an EventBridge rule to the main account event bus that matches all EC2 instance lifecycle events. Set the SQS queue as a target for the rule.
  11. ihebchorfi 👍 1 Answered B
    B solution meets all da requirements. By using resource policies, you can grant permissions for other accounts to write to the SQS queue in the main account. Then, you create EventBridge rules in each account dat match EC2 lifecycle events and use da main account's SQS queue as a target for these rules. It's da best choice for dis scenario.
  12. shahs10 👍 1
    For Option C using lambda does not seem to be a good solution as we would have to trigger lambda on some schedule and it will has less granularity in time. For D. Why would we be matching EC2 instance lifecycle events in Main account event bus and not in each account event bus and reducing overhead for main account
  13. sumanshu 👍 1
    B) Will work as Option B is implying a direct route from each AWS account’s EventBridge to the main account’s SQS queue, bypassing the main account's EventBridge event bus - Eliminated - as No centralized events, which is in Option D
  14. robotgeek 👍 1
    If you do this: "Add an EventBridge rule to the main account event bus that matches all EC2 instance lifecycle events" you would also be subscribing to EC2 events happening in the main account. Is the question asking for this?
  15. sumanshu 👍 1 Answered D
    https://docs.aws.amazon.com/us_en/eventbridge/latest/userguide/eb-cross-account.html#:~:text=You%20can%20configure%20EventBridge%20to%20send%20and%20receive,events%20from%20the%20event%20bus%20in%20your%20account.
  16. xdkonorek2 👍 1 Answered D
    Tried to implement both B and D It's tricky, because B could be possible but you can't select cross-account SQS as target to the rule, option D is 100% correct
  17. 7948dca 👍 1 Answered C
    Either C or D. Down side of C: Needs to trigger everyone min but very flexible. D: is completely automated but giving access to other aws account is not safe.
  18. thinei 👍 1 Answered D
    Answer is D. Amazon EC2 sends an EC2 Instance State-change Notification event to Amazon EventBridge when the state of an instance changes.
  19. Anandesh 👍 1 Answered D
    https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-cross-account.html
  20. sumanshu 👍 1
    C) Eliminated - more maintenance overhead of LAMBDA
  21. 65703c1 👍 1
    D is the correct answer.
  22. NagaoShingo 👍 1 Answered D
    D is correct answer.
  23. Digo30sp 👍 1 Answered D
    Answer C is correct
  24. jipark 👍 1
    thanks a lot

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

How to Log Every Lambda Invocation to an SQS Queue?

S-grade

How to Test Updated Lambda Functions with a Subset of Users Using API Gateway?

S-grade

How to automate S3 object tagging after delayed third-party content audit?

S-grade

How to automatically rotate encryption keys for API keys in serverless apps with no development effort?

S-grade

Practice All DVA-C02 Questions

Access 100 questions with complete answers and detailed explanations.

View Full DVA-C02 Practice Test →

← Back to DVA-C02 Study Guide