public-subnet-instance-audit-whitelist.yml

policies:
  - name: whitelist
    resource: ec2
    mode:
      type: ec2-instance-state
      role: arn:aws:iam::1234567890:role/CloudCustodianRole
      events:
        - pending
    filters:
      - not:
          - type: value
            key: "tag:Name"
            value: (Instance_Name_1|Instance_Name_2)
            op: regex
      - and:
        - type: subnet 
          key: "tag:Name"
          value: "PublicSubnet" 
    actions:
      - terminate 
      - type: notify
        template: ec2-public-whitelist.html
        slack_template: slack_ec2-public-whitelist
        template_format: 'html'
        priority_header: '5'
        subject: 'Cloud Custodian: EC2 Instance Launched in Public Subnet'
        to:
          - email@address.com 
          - slack://#slack-channel-goes-here
        owner_absent_contact:
          - email@address.com
        transport:
          type: sqs
          queue: https://sqs.us-east-1.amazonaws.com/1234567890/sandbox