How to Terminate EC2 Instances Missing Required Tags Efficiently?
Short answer
D Create an AWS Config rule to check required EC2 tags and use an AWS Systems Manager Automation runbook to terminate noncompliant instances.
Question
What is the MOST operationally efficient solution that meets these requirements?
Key Takeaways
It tests managed compliance evaluation plus automated remediation versus custom scripts; the trap is assuming EventBridge/Lambda or an IAM policy can enforce tags directly.
This SOA-C03 question tests the most operationally efficient way to enforce required EC2 tags and terminate noncompliant instances. The answer is an AWS Config rule with an AWS Systems Manager Automation runbook remediation, not custom Lambda or IAM logic.
Common mistake: A common wrong answer is C or A — building custom Lambda logic to scan or react to EC2 state changes, which adds code, scheduling, and maintenance overhead when AWS Config's required-tags rule and SSM Automation remediation already do the job.
Expert Analysis
Why the Answer Is Correct
Option D uses the AWS Config managed required-tags rule to continuously evaluate whether EC2 instances have the required tags. When an instance is noncompliant, AWS Config remediation invokes an AWS Systems Manager Automation runbook to terminate it, with no custom code to write or maintain. This directly satisfies the company policy while being the most operationally efficient native AWS compliance-and-remediation pattern. The evaluation and termination steps are both managed services, so ongoing overhead is minimal.
Why the Other Options Are Wrong
Option A relies on EventBridge state-change events and a custom Lambda function to determine compliance, which adds code, retries, permissions, and edge-case handling. Option B is invalid because an IAM policy controls API authorization; it cannot evaluate tag compliance and terminate an instance by itself. Option C schedules a custom Lambda every five minutes, requiring custom compliance logic, duplicate handling, and delayed detection, so it is less efficient than AWS Config remediation. Option D is the only choice that pairs a managed compliance rule with an automated remediation action.
Community Comment Notes
Bad_Mat explicitly selects D, stating "The MOST operationally efficient solution is D." and describing the AWS Config rule plus Systems Manager Automation runbook approach. That comment aligns with the native compliance-and-remediation design and highlights why custom Lambda polling or IAM enforcement is not the best fit. No other community commentary challenges this choice.
Official Reference
- https://docs.aws.amazon.com/config/latest/developerguide/required-tags.html
- https://docs.aws.amazon.com/config/latest/developerguide/remediation.html
These links open the official vendor documentation in a new tab.
Exam Strategy
When SOA-C03 asks for the MOST operationally efficient compliance enforcement on AWS resources, prefer native AWS Config rules and remediation over custom Lambda. Match the remediation action to Systems Manager Automation runbooks rather than trying to enforce resource state with IAM policies.
Frequently Asked Questions
Why can't an IAM policy terminate a noncompliant EC2 instance?
Does an AWS Config required-tags rule support automatic termination?
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 1
-
Bad_Mat 👍 1 Answered DThe MOST operationally efficient solution is D. Create an AWS Config rule to check if the required tags are present. If an EC2 instance is noncompliant, invoke an AWS Systems Manager Automation runbook to terminate the instance.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All SOA-C03 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SOA-C03 Practice Test →