Introduction
-This architecture is a serverless automation designed to terminate any Ec2 instance that does not conform to a pre-determined instance type. For example; “t3.micro”,”m2.medium”,”t2.small”. These are Terminated during the setup phase though depending on the time the function takes to run you may still see small amounts of usage if they reach a provisioned state, but I think you can agree this will be much better than having large instance running for hours or even days. This can even help new users or students from building up unnecessary charges they are unaware of when they provision resources using services like SAM, CDK or Cloudformation being unaware of what they are provisioning due to lack of experience or the knowledge to read the code correctly.

AWS Config

-AWS config monitors for Ec2 instance changes specifically Creation events.
-The event then triggers a lambda function through a pre-configured rule, which you should define. selecting the option to monitor EC2 changes before they are provisioned will allow the function to start quicker and terminate the denied instance quickly and efficiently.
-Iam Policies are required (Lambda:Invoke and Lambda:AddPermssion) These should be added to the AWS config role you can work to least privilege by specifying the lambda function ARN rather than a * wildcard.
AWS Config Costs:-AWS Config rules incur costs based on the number of rules and the frequency of evaluations. Be mindful of this as you design your own solution.

AWS config with AWS Lambda

-Parses the Event payload for AWS::EC2::Instance changes from AWS config.
-Checks the EC2 against the list of allowed Instance types, (This can be customised to your own requirements. While also adding further functionality such as, preventing specific actions against instance types.)
-If the Ec2 is outside of the allowed range a termination request is made and the instance is terminated.
-Iam policies are required( Ec2:describeinstance and Ec2:TerminateInstance) These should be added to the lambda role along with SNS or SES policies as required.
-Function code can be found at my Github here.

AWS SNS/SES (optional)

-I have used SNS in my example architecture, though SES is another option if you wish to use it instead.
-By adding a destination to the lambda function after a prohibited Instance is terminated you can trigger an event notification via an SNS topic or a Simple email via SES to alert you of the occurrence.
-SES – The lambda function code can be updated to publish a simple email via SES. don’t forget to secure private information using parameter store or secrets manager. (additional SES setup will be required for this.)
-SNS – Create a topic and register any user who needs a notification to the topic then allow lambda to publish to the topic. additional Iam policies should be added to the lambda functions role.

There are various other uses for this architecture it can be adapted to automate thousands of other functions with a few simple changes to the AWS config rules and lambda code. Though through this project even if I help to save one person from making a mistake or becoming a victim it will be worth publishing it here.
Enjoy the project.