AWS EC2 instance stopped record logged in AWS cloudtrail

Question

Hi Team,

Someone or any other way EC2 instance stopped in our production account. I have checked in cloud trail with event name "StopInstances" but i am not seeing this the specific stopped event in cloud trail.

So could you please suggest and let me know any other way to track the stopped event.

Regards,
Rajesh B

Answer

Did you execute the EC2 shutdown from the API?  
CloudTrail is a service that records API calls to AWS.  
Therefore, shutdown from the OS (shutdown -h now), etc., will probably not be recorded in CloudTrail.  
To be notified when the EC2 status changes, you may want to use the following SNS settings or other methods.  
When notified that the EC2 status has changed, check the logs and other information inside the OS and troubleshoot.  
https://repost.aws/knowledge-center/ec2-email-instance-state-change

AWS EC2 instance stopped record logged in AWS cloudtrail

Relevant content