An Auto Scaling lifecycle hook is set to send events to EventBridge, which should trigger a Lambda function to configure new EC2 instances. The Lambda then calls the complete-lifecycle-action to let instances enter service. During testing the Lambda is never invoked. What should you do to fix this?

The Lambda function is not being invoked because EventBridge (formerly CloudWatch Events) lacks the necessary permissions. For an EventBridge rule to trigger a Lambda function, you must explicitly grant the events.amazonaws.com service principal permission to invoke that specific Lambda function. This is typically done by adding a resource-based policy to the Lambda function. Changing the lifecycle hook to CONTINUE on timeout or failure doesn't address the initial invocation problem. Adding a retry policy to the EventBridge rule is for handling failures after an invocation attempt, not for enabling the initial invocation. Giving the Lambda execution role permission to call complete-lifecycle-action is necessary for the Lambda to complete the lifecycle action, but it doesn't solve the problem of the Lambda not being invoked in the first place.