Lambda for operations automation

Sign in and set up:

cd C:\aws-lab
aws login --profile saat-admin
$env:AWS_PROFILE = 'saat-admin'
$v = Get-Content C:\aws-lab\saat-vpc.json | ConvertFrom-Json
$acct = aws sts get-caller-identity --query Account --output text

1Create the execution role

Paste this whole block:

'{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "lambda.amazonaws.com" }, "Action": "sts:AssumeRole" } ] }' | Set-Content lambda-trust.json
$roleArn = aws iam create-role --role-name saat-lambda-autostop --assume-role-policy-document file://lambda-trust.json --tags Key=course,Value=saatvedha-aws --query Role.Arn --output text
aws iam attach-role-policy --role-name saat-lambda-autostop --policy-arn arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
@'
{
  "Version": "2012-10-17",
  "Statement": [
    { "Effect": "Allow", "Action": "ec2:DescribeInstances", "Resource": "*" },
    { "Effect": "Allow", "Action": "ec2:StopInstances", "Resource": "arn:aws:ec2:ap-south-1:ACCT:instance/*",
      "Condition": { "StringEquals": { "aws:ResourceTag/AutoStop": "TAG_VALUE" } } }
  ]
}
'@ -replace 'ACCT', $acct | Set-Content autostop-policy-template.json
(Get-Content autostop-policy-template.json -Raw) -replace 'TAG_VALUE', 'true' | Set-Content autostop-policy.json
aws iam put-role-policy --role-name saat-lambda-autostop --policy-name stop-tagged --policy-document file://autostop-policy.json
$roleArn

You should see something like this:

arn:aws:iam::111122223333:role/saat-lambda-autostop

AWSLambdaBasicExecutionRole lets the function write logs. The inline policy lets it list everything but stop only instances tagged AutoStop=true.

2Deploy the function

Paste this whole block:

@'
import json
import boto3

ec2 = boto3.client('ec2')


def handler(event, context):
    dry_run = bool(event.get('dry_run', False))
    pages = ec2.get_paginator('describe_instances').paginate(Filters=[
        {'Name': 'tag:AutoStop', 'Values': ['true']},
        {'Name': 'instance-state-name', 'Values': ['running']},
    ])
    ids = [i['InstanceId'] for page in pages for r in page['Reservations'] for i in r['Instances']]
    print(json.dumps({'found': ids, 'dry_run': dry_run}))
    if ids and not dry_run:
        ec2.stop_instances(InstanceIds=ids)
    return {'stopped': [] if dry_run else ids}
'@ | Set-Content lambda_function.py
Compress-Archive -Path lambda_function.py -DestinationPath autostop.zip -Force
Start-Sleep 15
aws lambda create-function --function-name saat-autostop --runtime python3.13 --handler lambda_function.handler --role $roleArn --zip-file fileb://autostop.zip --timeout 30 --tags course=saatvedha-aws --query "[FunctionName,Runtime,Timeout]" --output text
aws lambda wait function-active-v2 --function-name saat-autostop
aws lambda get-function --function-name saat-autostop --query Configuration.State --output text

You should see this:

saat-autostop   python3.13      30
Active

The 15-second pause gives IAM time to make the new role visible to Lambda. The timeout is raised from the default 3 seconds, which is too short once an account has a few hundred instances.

3Test with a dry run, then for real

Paste this whole block. It launches one server to stop and one to keep:

$base = aws ssm get-parameter --name /aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64 --query Parameter.Value --output text
$stopMe = aws ec2 run-instances --image-id $base --instance-type t3.micro --subnet-id $v.PrivateA --security-group-ids $v.AppSg --metadata-options HttpTokens=required --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=stop-me},{Key=AutoStop,Value=true},{Key=course,Value=saatvedha-aws},{Key=lesson,Value=38}]' --query "Instances[0].InstanceId" --output text
$keepMe = aws ec2 run-instances --image-id $base --instance-type t3.micro --subnet-id $v.PrivateA --security-group-ids $v.AppSg --metadata-options HttpTokens=required --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=keep-me},{Key=course,Value=saatvedha-aws},{Key=lesson,Value=38}]' --query "Instances[0].InstanceId" --output text
aws ec2 wait instance-running --instance-ids $stopMe $keepMe
'{ "dry_run": true }' | Set-Content dry.json
'{ "dry_run": false }' | Set-Content real.json
aws lambda invoke --function-name saat-autostop --payload file://dry.json --cli-binary-format raw-in-base64-out response.json | Out-Null
Get-Content response.json
aws lambda invoke --function-name saat-autostop --payload file://real.json --cli-binary-format raw-in-base64-out response.json | Out-Null
Get-Content response.json
aws ec2 wait instance-stopped --instance-ids $stopMe
aws ec2 describe-instances --instance-ids $stopMe $keepMe --query "Reservations[].Instances[].[Tags[?Key=='Name']|[0].Value,State.Name]" --output text

You should see something like this:

{"stopped": []}
{"stopped": ["i-0e1f2a3b4c5d60101"]}
stop-me         stopped
keep-me         running

The dry run found the server and changed nothing; the real run stopped only the tagged one. Now read what the function wrote:

aws logs tail /aws/lambda/saat-autostop --since 10m --format short | Select-String found

You should see something like this:

2026-10-20T22:41:07 {"found": ["i-0e1f2a3b4c5d60101"], "dry_run": true}
2026-10-20T22:41:09 {"found": ["i-0e1f2a3b4c5d60101"], "dry_run": false}

4Schedule it for 8 p.m. India time

Paste this whole block:

$funcArn = aws lambda get-function --function-name saat-autostop --query Configuration.FunctionArn --output text
'{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "scheduler.amazonaws.com" }, "Action": "sts:AssumeRole", "Condition": { "StringEquals": { "aws:SourceAccount": "ACCT" } } } ] }' -replace 'ACCT', $acct | Set-Content sched-trust.json
$schedRole = aws iam create-role --role-name saat-scheduler-autostop --assume-role-policy-document file://sched-trust.json --query Role.Arn --output text
'{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "lambda:InvokeFunction", "Resource": "FUNC_ARN" } ] }' -replace 'FUNC_ARN', $funcArn | Set-Content sched-policy.json
aws iam put-role-policy --role-name saat-scheduler-autostop --policy-name invoke-autostop --policy-document file://sched-policy.json
@'
{ "Arn": "FUNC_ARN", "RoleArn": "ROLE_ARN", "Input": "{\"dry_run\": false}" }
'@ -replace 'FUNC_ARN', $funcArn -replace 'ROLE_ARN', $schedRole | Set-Content sched-target.json
Start-Sleep 15
aws scheduler create-schedule --name saat-autostop-nightly --schedule-expression "cron(0 20 * * ? *)" --schedule-expression-timezone Asia/Kolkata --flexible-time-window Mode=OFF --target file://sched-target.json | Out-Null
aws scheduler get-schedule --name saat-autostop-nightly --query "[State,ScheduleExpression,ScheduleExpressionTimezone]" --output text

You should see this:

ENABLED cron(0 20 * * ? *)      Asia/Kolkata

Older setups use EventBridge rules, whose cron always runs in UTC; teams then schedule “14:30” and forget it means 8 p.m. in India. Scheduler’s time zone setting removes that whole class of mistake, including daylight saving in Regions that have it.

✅ Checkpoint: saat-autostop is Active, a dry run changed nothing, a real run stopped only stop-me, the logs show both runs, and saat-autostop-nightly is ENABLED for 20:00 Asia/Kolkata. Keep everything for the break lab.