How to Terminate EC2 Instances Missing Required Tags Efficiently?
A company has a policy that requires all Amazon EC2 instances to have a specific set of tags. If an EC2 instance does not have the required tags, the noncompliant instance should be terminated. What is the MOST operationally efficient solution that meets these requirements?
Community Insight
It tests managed compliance evaluation plus automated remediation versus custom scripts; the trap is assuming EventBridge/Lambda or an IAM policy can enforce tags directly.
This SOA-C03 question tests the most operationally efficient way to enforce required EC2 tags and terminate noncompliant instances. The answer is an AWS Config rule with an AWS Systems Manager Automation runbook remediation, not custom Lambda or IAM logic.
A common wrong answer is C or A — building custom Lambda logic to scan or react to EC2 state changes, which adds code, scheduling, and maintenance overhead when AWS Config's required-tags rule and SSM Automation remediation already do the job.
Community Discussion (1 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option D uses the AWS Config managed required-tags rule to continuously evaluate whether EC2 instances have the required tags. When an instance is noncompliant, AWS Config remediation invokes an AWS Systems Manager Automation runbook to terminate it, with no custom code to write or maintain. This directly satisfies the company policy while being the most operationally efficient native AWS compliance-and-remediation pattern. The evaluation and termination steps are both managed services, so ongoing overhead is minimal.Why the Other Options Are Wrong
Option A relies on EventBridge state-change events and a custom Lambda function to determine compliance, which adds code, retries, permissions, and edge-case handling. Option B is invalid because an IAM policy controls API authorization; it cannot evaluate tag compliance and terminate an instance by itself. Option C schedules a custom Lambda every five minutes, requiring custom compliance logic, duplicate handling, and delayed detection, so it is less efficient than AWS Config remediation. Option D is the only choice that pairs a managed compliance rule with an automated remediation action.Community Comment Notes
Bad_Mat explicitly selects D, stating "The MOST operationally efficient solution is D." and describing the AWS Config rule plus Systems Manager Automation runbook approach. That comment aligns with the native compliance-and-remediation design and highlights why custom Lambda polling or IAM enforcement is not the best fit. No other community commentary challenges this choice.Official Reference
Exam Strategy
When SOA-C03 asks for the MOST operationally efficient compliance enforcement on AWS resources, prefer native AWS Config rules and remediation over custom Lambda. Match the remediation action to Systems Manager Automation runbooks rather than trying to enforce resource state with IAM policies.
Frequently Asked Questions
Why can't an IAM policy terminate a noncompliant EC2 instance?
IAM policies only authorize or deny API actions; they do not monitor resource tags or run remediation, so an IAM policy cannot terminate instances on its own.
Does an AWS Config required-tags rule support automatic termination?
Yes. AWS Config can evaluate required tags and trigger remediation through an SSM Automation runbook such as AWS-TerminateInstance when an EC2 instance is noncompliant.
Related Analysis
Practice All SOA-C03 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SOA-C03 Practice Test →