Trigger the Lambda function via a CloudWatch alarm; the Runbook isolates the EC2 instance by detaching its security group.

Manually invoke the Lambda function; the Runbook stops the EC2 instance and creates an EBS snapshot.

Use EventBridge to trigger the Lambda function; the Runbook terminates the EC2 instance and audits its logs.

Schedule the Lambda function with CloudWatch Events; the Runbook reboots the EC2 instance and audits its network traffic.