termination-protection-audit.yml

policies:
  - name: termination-protection-audit
    resource: ec2
    query:
      - instance-state-name: running
    filters:
      - not:
          - type: termination-protected
      - or:
          - "tag:Name": instance-1 
          - "tag:Name": instance-2
          - "tag:Name": etc 
    actions:
      - type: notify
        template: termination-protection-audit.html
        slack_template: slack-termination-protection-audit
        template_format: 'html'
        priority_header: '5'
        subject: 'Security Audit: White Listed Instance(s) found with Termination Protection Disabled'
        to:
          - <your-email-address-goes-here>
          - slack://#<your-slack-channel-goes-here>
        owner_absent_contact:
          - <your-email-address-goes-here>
        transport:
          type: sqs
          queue: https://sqs.us-east-1.amazonaws.com/1234567890/cloud-cloudcustodian