TerminateInstances / ec2:TerminateInstances

aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=TerminateInstances

Gemini example

{
   "Version": "2012-10-17",
   "Statement": [
       {
           "Effect": "Deny",
           "Action": "ec2:TerminateInstances",
           "Resource": "arn:aws:ec2:*:*:instance/*",
           "Condition": {
               "StringEquals": {"aws:ResourceTag/Environment": "Production"}
           }
       }
   ]
}

• controller.provisioning
• CloudTrail Events
• Terminated
• StopInstances

See also

• AWS CloudTrail Events: management events, data events, insights events, aws cloudtrail lookup-events, TerminateInstances, StopInstances
• Karpenter, karpenter.sh, provisioners.karpenter.sh, Karpenter releases, best practices, karpenter.sh/capacity-type, karpenter.sh/discovery, kind: Provisioner, kind: AWSNodeTemplate, kubectl provisioner, TopologyKey, FailedDraining, Evict, DisruptionBlocked, Karpenter logs, controller., ttlSecondsUntilExpired, KEDA, NodePools, Kind: NodePool, Workload Consolidation, Disruption controls
• AWS CloudTrail, AWS CloudTrail Insights, CloudTrail Events, AWS CloudTrail Lake, AWS CloudTrail Lake Dashboards, Terraform, Best practices, Datadog SIEM Content Packs for Cloudtrail