How do I use EventBridge Scheduler to stop and start Amazon EC2 instances at regular intervals?

Short description

To automatically stop and start EC2 instances, use the EventBridge Scheduler to directly call the StartInstances and StopInstances Amazon EC2 APIs. Or, you can use the scheduler to invoke an AWS Lambda function to stop and start instance. It's a best practice to use Amazon EC2 APIs as the scheduler target to avoid the need to create additional Lambda functions.

For a more advanced solution, use the Instance Scheduler on AWS.

Resolution

Prerequisite: Get the IDs of the instances that you want to stop and start.

Use the scheduler to directly call the Amazon EC2 APIs

Create an IAM policy and role for EventBridge Scheduler

Complete the following steps:

1. Use the JSON policy editor to create an AWS Identity and Access Management (IAM) policy that allows EventBridge Scheduler to stop and start your instance.
   Example policy:

   {    
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Action": [
                   "ec2:Start*",
                   "ec2:Stop*"
               ],
               "Resource": "*"
           }
       ]
   }

   Note: If you encrypted your Amazon Elastic Block Store (Amazon EBS) volume with a customer managed AWS Key Management Service (AWS KMS) key, then add kms:CreateGrant to the policy. If the Lambda function doesn't have access to the encryption key, then it can only stop but not restart the instance. For more information, see Required AWS KMS key policy for use with encrypted volumes.
2. Open the IAM console.
3. Choose Roles, and then choose Create role.
4. For Trusted entity type, choose Custom trust policy.
5. Enter the following IAM policy:

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Principal": {
                   "Service": "scheduler.amazonaws.com"
               },
               "Action": "sts:AssumeRole",
               "Condition": {
                   "StringEquals": {
                       "aws:SourceAccount": "AWS_ACCOUNT_ID"
                   }
               }
           }
       ]
   }

   Note: Replace AWS_ACCOUNT_ID with your AWS account ID.
6. Choose Next.
7. For Permissions policies, select the IAM policy that you created in step 1.
8. For Role name, enter a name such as EventBridge_Scheduler_Role.
9. Choose Create role.

Create the EventBridge Scheduler schedule

Create a schedule for the StopInstances API and another for the StartInstances API. Configure the following settings when you create the schedule:

• For Target API, select All APIs, and then search for Amazon EC2.
• Select StopInstances or StartInstances, and then enter the instance IDs.
• For Settings - optional, under Permissions, choose Select an existing role, and then choose the IAM role that you created.

Use the scheduler to invoke Lambda functions

Create an IAM policy and role for your Lambda function

Complete the following steps:

1. Use the JSON policy editor to create an IAM policy that allows Lambda to stop and start your instance.
   Example policy:

   {    "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Action": [
                   "logs:CreateLogGroup",
                   "logs:CreateLogStream",
                   "logs:PutLogEvents"
               ],
               "Resource": "arn:aws:logs:*:*:*"
           },
           {
               "Effect": "Allow",
               "Action": [
                   "ec2:Start*",
                   "ec2:Stop*"
               ],
               "Resource": "*"
           }
       ]
   }

   Note: If you use an Amazon EBS volume that's encrypted with a customer-managed AWS KMS key, then add kms:CreateGrant to the policy. If the Lambda function doesn't have access to the encryption key, then it can only stop but not restart the instance. For more information, see Required AWS KMS key policy for use with encrypted volumes.
2. Create an IAM role for Lambda.
3. Attach the IAM policy to the IAM role.

Create Lambda functions to stop and start your instances

Complete the following steps:

1. Open the Lambda console.
2. Choose Create function, and then choose Author from scratch.
3. Under Basic information, configure the following settings:
   For Function name, enter a name that describes the function, such as StopEC2Instances or StartEC2Instances.
   For Runtime, choose Python 3.14.
   Under Permissions, expand Change default execution role.
   Under Execution role, choose Use an existing role.
   Under Existing role, choose the IAM role that you created.
4. Choose Create function.
5. Choose the Code tab, and then choose the lambda_funciton.py tab.
6. For Code source, enter the following code into the code editor to configure the instance stop:

   import boto3  
   region = 'us-west-1'
   instances = ['i-12345acdb12345abcd', 'i-12345acdb12345abcd']
   ec2 = boto3.client('ec2', region_name=region)
   
   def lambda_handler(event, context):
       ec2.stop_instances(InstanceIds=instances)
       print('stopped your instances: ' + str(instances))

   To configure the instance start, enter the following code into the code editor:

   import boto3  
   region = 'us-west-1'
   instances = ['i-12345acdb12345abcd', 'i-12345acdb12345abcd']
   ec2 = boto3.client('ec2', region_name=region)
   
   def lambda_handler(event, context):
       ec2.start_instances(InstanceIds=instances)
       print('started your instances: ' + str(instances))

   Note: Replace us-west-1 with the AWS Region of your instances and i-12345acdb12345abcd with the IDs of your instances.
7. Choose Deploy.
8. Choose the Configuration tab, and then choose General configuration.
9. Choose Edit.
10. For Timeout, select 10 seconds, and then choose Save.

Note: If you associated the function with Amazon Virtual Private Cloud (Amazon VPC), then validate that the function can reach the Amazon EC2 endpoint through the internet. Or, configure a virtual private cloud (VPC) endpoint for Amazon EC2.

Test your Lambda functions

Test the Lambda functions for instance stop and for instance start.

Before and after you run your test, check the status of your instances to confirm that your functions work.

To use AWS CloudTrail to confirm that the Lambda function stopped or started the instance, complete the following steps:

1. Open the CloudTrail console.
2. In the navigation pane, choose Event history.
3. In the Lookup attributes dropdown list, choose Event name.
4. In the search bar, enter StopInstances to review the results. Then, enter StartInstances.
   Note: If there are no results, then the Lambda function didn't stop or start the instances.

Create a EventBridge Scheduler schedule to run your Lambda functions

Create a schedule to run your Lambda functions. For Select target, select Templated targets, and then choose AWS Lambda Invoke. Use the Lambda functions that you created.