A CloudFormation stack in a single account sends stack event notifications to an SNS topic. You must automatically tag the specific stack instance only after a successful stack update (UPDATE_COMPLETE). A Lambda function exists that applies the tag. Which solution will ensure the Lambda runs only after an UPDATE_COMPLETE for that stack?

The correct solution is to create an EventBridge rule. CloudFormation emits events to EventBridge for various stack lifecycle stages, including UPDATECOMPLETE. An EventBridge rule can be configured with an event pattern to specifically match the UPDATECOMPLETE status for the target stack and then trigger the Lambda function as a target. This ensures the Lambda runs precisely when the stack update is successful. The Systems Manager Automation runbook option is not ideal because Systems Manager Automation is typically used for operational tasks, not directly for reacting to CloudFormation lifecycle events in this specific, event-driven manner. AWS Config rules are for evaluating resource compliance and triggering remediation, not for directly reacting to CloudFormation stack status changes to apply tags. Adjusting the CloudFormation notification configuration to send only UPDATECOMPLETE events to an SNS topic would work for notification, but directly subscribing a Lambda to an SNS topic for tagging would require the Lambda to parse the SNS message to confirm it's an UPDATECOMPLETE event for the specific stack, which is less efficient and more complex than using EventBridge's direct event pattern matching.