Cloudwatch rule that trigger SNS in case pattern do NOT match completely - amazon-web-services

Question

Is it possible to create CloudWatch Rule that triggers SNS, when pattern do NOT match completely?
With following example I hope that question will be more clear:
{
"source": [
"aws.ec2"
],
"detail": {
"eventSource": [
"ec2.amazonaws.com"
],
"eventName": [
"RunInstances"
]
}
}
Additionally I want to specify region: "awsRegion": "eu-central-1" but (here is tricky part) want SNS to be triggered when awsRegion is NOT eu-central-1.
Idea is to receive a notification when someone makes a mistake and runs an instance in the wrong region.
Also will add more rules once I know how to do, so the question is not exactly for the region, but general.
Thanks in advance!
TeoVal

Answer 1

It's currently not possible to trigger when a pattern does NOT match.
You will have to receive notifications for all regions on your SNS topic and implement your own logic with a Lambda function subscribed to your topic (or directly with Lambda as a target).
Also note that it's possible to restrict users from making API calls in specific region using a policy similar to the following (restricts call to us-east-1 and eu-central-1 regions):
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "RegionsRestriction",
"Effect": "Deny",
"Action": "*",
"Resource": "*",
"Condition": {
"StringNotEquals": {
"aws:RequestedRegion": [
"us-east-1",
"eu-central-1"
]
}
}
}
]
}