A fleet of 50 Linux EC2 instances in an Auto Scaling group behind an ALB sometimes fails ELB HTTP health checks and gets terminated before logs can be collected. How can log collection be automated so logs are retrieved before termination for root cause analysis?

The correct solution leverages Auto Scaling lifecycle hooks to pause instance termination, allowing time for log collection. Setting the hook to Terminating:Wait ensures the instance remains active for a specified period. An EventBridge rule, triggered by the EC2 Instance-terminate Lifecycle Action event, then invokes a Lambda function. This Lambda uses SSM Run Command to execute a script on the terminating instance, collecting logs and uploading them to S3. Finally, the Lambda completes the lifecycle action, allowing the instance to terminate. Incorrect options: The first option uses Pending:Wait, which is for instances launching, not terminating. It also incorrectly uses a CloudWatch alarm for EC2 Instance Terminate Successful to trigger log collection before termination. The second option uses an AWS Config rule, which is for evaluating resource compliance, not for triggering actions during an instance termination lifecycle event. The third option incorrectly suggests a CloudWatch subscription filter for EC2 Instance Terminate Successful to trigger the CloudWatch agent on the terminating instance. CloudWatch subscription filters are for log groups, and the CloudWatch agent would not be reliably triggered this way for a terminating instance.