EC2 Instance State Change Alerts
Any EC2 instance that starts, stops, or terminates unexpectedly fires an EventBridge event. The agent reads it, adds context (who, why, tags), and posts to your #infra WhatsApp group.
Conversation example
EC2 instance terminated. Pulling instance tags and CloudTrail context...
EC2 Termination — us-east-1 Instance: i-0a1b2c3d4e5f67890 Type: m6i.xlarge Tags: Name=api-prod-03, Env=production, Team=backend State: running → terminated Triggered by: rivka-d@lunogen.com via AWS CLI Reason: 'replacing with larger instance' ASG: api-prod-asg (now 7 of 8 desired — will self-heal) Posted to #infra-alerts. ASG health check will spin up a replacement in ~90s.
More AWS use cases
Daily AWS Cost Tracker and Forecast
Every morning, the agent hits Cost Explorer for yesterday's spend by service, compares to the budget, forecasts end-of-month, and drops it on WhatsApp before the coffee is cold.
Lambda Function Error Notifications
CloudWatch Alarms on Lambda error metrics route through the agent. It groups related errors, pulls the latest stack trace from CloudWatch Logs, and pings on-call with the suspected cause.
S3 Bucket Public-Access Audit
The agent checks every S3 bucket policy and ACL daily. If a bucket becomes public — or if an existing policy changes — it fires an immediate WhatsApp alert with the diff.
CloudWatch Alarm Routing to On-Call
CloudWatch alarms hit an SNS topic subscribed to LunoGen. The agent checks the current on-call rotation, adds runbook links, and DMs the right engineer on WhatsApp — not just the #alerts channel.
IAM Policy and Suspicious API Call Alerts
CloudTrail streams IAM changes and sensitive API calls (root login, access key creation, policy attach) to the agent, which flags anything suspicious and pings the security channel on WhatsApp.
Deploy this in minutes
Create a LunoGen agent, connect AWS, and start running this workflow from WhatsApp today.