[Python] Exclude Python Lambda function from EC2s with specific tag

I have a python lambda function setup to install a security agent on EC2 instances when they are started. I had initially set this up so when a new EC2 gets spun up the agent is installed right away so that we can make sure to have the proper security monitoring on all our servers. This wasn't an issue before as we essentially kept all EC2 running. However, in an effort to save on costs, one of the other admins setup an InstanceScheduler to shutdown certain EC2's after hours and start them back up in the morning.

Unfortunately, shutting down one of the instances for an OpenVPN connector and starting it back up forced the security agent to be installed on this device and we don't have access to this device in order to install updates or anything so I would like to alter my Lambda function so that I can tag these connectors (we have one in each VPC, most all stay running but the Dev and QA ones get stopped at night) and prevent the agent from installing if they get stopped and restarted.

Here is the code, I've read a few similar articles on this same issue, but I can't seem to figure out how to tweak the code to make it work.

import json
from botocore.exceptions import ClientError

DOCUMENT_PARAMETER = '/R7Insight/Installer/DocumentName'
CLOUDWATCH_LOG_GROUP_PARAMETER = '/R7Insight/Installer/CloudWatchLogGroup'

DOCUMENT_PARAMETERS = {
'/R7Insight/Installer/Token': 'token',
'/R7Insight/Installer/Windows/Source': 'windowsSource',
'/R7Insight/Installer/Linux/Source': 'linuxSource',
'/R7Insight/Installer/Windows/WorkingDirectory': 'windowsWorkingDirectory',
'/R7Insight/Installer/Linux/WorkingDirectory': 'linuxWorkingDirectory'
}


def lambda_handler(event, context):
print("Received event: " + json.dumps(event, indent=2))
instance = event['detail']['instance-id']

print("Installing Insight Agent on Instance: {}".format(instance))

ssm_client = boto3.client('ssm')

result = install_insight_agent(instance, ssm_client)

return result


def get_parameters(client, params):
try:
response = client.get_parameters(
Names=params,
WithDecryption=True
)
except ClientError as e:
raise e
else:
print("Retrieved parameters")
parameters = response['Parameters']
return parameters


def get_parameter(client, param):
try:
response = client.get_parameter(
Name=param,
WithDecryption=False
)
except ClientError as e:
raise e
else:
print("Retrieved parameter")
parameter = response['Parameter']
return parameter


def install_insight_agent(instance, client):
print("Get parameters for the SSM document")
result = get_parameters(client, list(DOCUMENT_PARAMETERS.keys()))
parameters = {}
for parameter in result:
parameters[DOCUMENT_PARAMETERS[parameter['Name']]] = [parameter['Value']]

print("Get parameter for Document name")
result = get_parameter(client, DOCUMENT_PARAMETER)
document = result['Value']

print("Get parameter for CloudWatch Log Group name")
result = get_parameter(client, CLOUDWATCH_LOG_GROUP_PARAMETER)
cloudwatch_log_group = result['Value']

print('Run SendCommand to document: {} for instance: {}'.format(document, instance))
try:
client.send_command(InstanceIds=[instance],
DocumentName=document,
Parameters=parameters,
MaxConcurrency='1',
CloudWatchOutputConfig={
'CloudWatchLogGroupName': cloudwatch_log_group,
'CloudWatchOutputEnabled': True
},
TimeoutSeconds=900
)
except ClientError as e:
raise e
else:
print('Issued {} for instance: {}'.format(document, instance))
return True```

Continue reading...