Organization-Wide EC2 DNS Automation with EventBridge and AWS Config Aggregator: One Rule Per Account

说明与用途

使用 EventBridge 和 AWS Config Aggregator 在 AWS 组织中自动化 EC2 DNS 注册。每个账户仅需一个 EventBridge 规则，将事件转发到中心集线器，Lambda 通过 Config Aggregator 丰富数据并更新 DDI 系统。

问题

Detect every EC2 launch and termination across an AWS Organization and register or deregister DNS records in near real‑time without deploying duplicated infrastructure in each account.

结果

Implemented a scalable, near real‑time EC2 DNS registration system across an entire AWS Organization with a single hub Lambda and one EventBridge rule per spoke account, eliminating duplicated infrastructure and ensuring reliable IP enrichment via the Config Aggregator.

工作流

• Deploy a single EventBridge rule in every spoke account that forwards EC2 state‑change events to the hub’s custom bus.
• Create a minimal IAM role in each spoke that allows EventBridge to PutEvents to the hub bus.
• Deploy the hub’s custom event bus with an org‑scoped resource policy that permits any account to publish.
• Deploy a single Lambda in the hub that receives events, queries the AWS Config Aggregator for IP, tags, and state, and calls the DDI system to register or deregister DNS records.
• Add a second hub rule to listen on the custom bus so hub‑owned instances are also processed.

证据

Each spoke account gets exactly one EventBridge rule. That is the whole footprint.

来源

The Lambda fills in the missing details by querying the AWS Config Aggregator, which, and this is the part I almost missed, already has every instance's IP, tags, and state for the entire org.

来源