Review and ensure that you have setup your development environment before going through the steps below.

1. Go to the AWS Config console.
2. Click the Add Rule button.
3. Type eip in the textbox and select eip-attached from the managed Config Rules.
4. Click Save.
5. Once saved, click the rule and copy the Config rule ARN for later.

1. Go to AWS IAM.
2. Click on Roles.
3. Click Create role.
4. Select EC2 and click Next: Permissions.
5. Type SSM and choose the checkbox next to AmazonSSMAutomationRole and click Next: Tags.
6. Click Next: Review.
7. Type ccoa-5-ssm-role for the Role name and click Create role.

1. From the AWS IAM console, select Roles.
2. Select the ccoa-5-ssm-role IAM Role you just created.
3. Click the Trust relationships tab.
4. Click the Edit Trust Relationship button
5. Paste the contents from below into the text area to add events and ssm as trusted entities.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": [
          "ssm.amazonaws.com",
          "ec2.amazonaws.com",
          "events.amazonaws.com"
        ]
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

6. Click the Update Trust Policy button.
7. Click on the Permissions tab.
8. Click on the Add inline policy link.
9. Click on the JSON tab and replace the text area with the contents below (replacing ACCOUNTID with your AWS Account Id).

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "iam:PassRole"
            ],
            "Resource": "arn:aws:iam::ACCOUNTID:role/ccoa-5-ssm-role",
            "Effect": "Allow"
        }
    ]
}

10. Click the Review Policy button.
11. Enter the name passAutomationRole and click the Create policy button.
12. Click on the Permissions tab again.
13. Click on the Add inline policy link.
14. Click on the JSON tab and replace the text area with the contents below (replacing ACCOUNTID with your AWS Account Id).

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": "ec2:ReleaseAddress",
            "Resource": "*",
            "Effect": "Allow",
            "Sid": "ReleaseElasticIPPermissions"
        }
    ]
}

15. Click the Review Policy button.
16. Enter the name ReleaseElasticIPPermissions and click the Create policy button.
17. Select the role and copy the Role ARN to use later.

1. Go to Amazon CloudWatch.
2. Click on Rules.
3. Click the Create Rule button.
4. With the Event Pattern radio button selected, click on the Edit link.
5. Paste the contents below replacing the value of configRuleARN with the Config Rule ARN you saved when creating your Config Rule. If you do not recall the name, go back to AWS Config, select Rules, select the rule you created, and copy the value for Config rule ARN.

{
  "detail-type": [
    "Config Rules Compliance Change"
  ],
  "source": [
    "aws.config"
  ],
  "detail": {
    "configRuleARN": [
      "arn:aws:config:us-east-1:ACCOUNTID:config-rule/config-rule-abcdef"
    ],
    "newEvaluationResult": {
      "complianceType": [
        "NON_COMPLIANT"
      ]
    }
  }
}

1. In the Targets area, choose SSM Automation.
2. For the Document, choose AWS-ReleaseElasticIP.
3. Choose Input Transformer and paste the following in the first text field:

{"eipalloc":"$.detail.resourceId"}

4. Then, paste the following in the next text field (replacing with your ACCOUNTID):

{"AllocationId":[<eipalloc>],"AutomationAssumeRole":["arn:aws:iam::ACCOUNTID:role/ccoa-5-ssm-role"]}

5. Select the Use existing role radio button and type ccoa-5-ssm-role and click the Configure details button.
6. In the Name field, enter ccoa-6-cwe-eip-rule and click the Create rule button.

1. Go to the Elastic IPs within the EC2 console.
2. Click Allocate new address (and create a few of these).
3. Choose from the Amazon pool and click Allocate.
4. Go back to the AWS Config console.
5. Choose Rules.
6. Choose the eip-attached rule and click the Re-evaluate button.
7. Go to the EC2 console and click on Elastic IPs to verify the unattached Elastic IPs have been removed.

aws ssm describe-document --name "AWS-ReleaseElasticIP"

Go to Cleanup to remove any resources you created in this sublesson.