//
// This file made available under CC0 1.0 Universal (https://creativecommons.org/publicdomain/zero/1.0/legalcode)
//
var aws = require('aws-sdk');
var config = new aws.ConfigService();
// This is where it's determined whether the resource is compliant or not.
// In this example, we simply decide that the resource is compliant if it is an instance and its type matches the type specified as the desired type.
// If the resource is not an instance, then we deem this resource to be not applicable. (If the scope of the rule is specified to include only
// instances, this rule would never have been invoked.)
function evaluateCompliance(configurationItem, ruleParameters, context) {
    checkDefined(configurationItem, "configurationItem");
    checkDefined(configurationItem.configuration, "configurationItem.configuration");
    checkDefined(ruleParameters, "ruleParameters");
    if ('AWS::EC2::Instance' !== configurationItem.resourceType) {
        return 'NOT_APPLICABLE';
    } if (ruleParameters.DesiredTenancy === configurationItem.configuration.placement.tenancy) {
        return 'COMPLIANT';
    } else {
        return 'NON_COMPLIANT';
    }
}
// Helper function used to validate input
function checkDefined(reference, referenceName) {
    if (!reference) {
        console.log("Error: " + referenceName + " is not defined");
        throw referenceName;
    }
    return reference;
}
// Check whether the the resource has been deleted. If it has, then the evaluation is unnecessary.
function isApplicable(configurationItem, event) {
    checkDefined(configurationItem, "configurationItem");
    checkDefined(event, "event");
    var status = configurationItem.configurationItemStatus;
    var eventLeftScope = event.eventLeftScope;
    return ('OK' === status || 'ResourceDiscovered' === status) && false === eventLeftScope;
}
// This is the handler that's invoked by Lambda
// Most of this code is boilerplate; use as is
exports.handler = function(event, context) {
    event = checkDefined(event, "event");
    var invokingEvent = JSON.parse(event.invokingEvent);
    var ruleParameters = JSON.parse(event.ruleParameters);
    var configurationItem = checkDefined(invokingEvent.configurationItem, "invokingEvent.configurationItem");
    var compliance = 'NOT_APPLICABLE';
    var putEvaluationsRequest = {};
    if (isApplicable(invokingEvent.configurationItem, event)) {
        // Invoke the compliance checking function.
        compliance = evaluateCompliance(invokingEvent.configurationItem, ruleParameters, context);
    }
    // Put together the request that reports the evaluation status
    // Note that we're choosing to report this evaluation against the resource that was passed in.
    // You can choose to report this against any other resource type, as long as it is supported by Config rules
   
    putEvaluationsRequest.Evaluations = [
        {
            ComplianceResourceType: configurationItem.resourceType,
            ComplianceResourceId: configurationItem.resourceId,
            ComplianceType: compliance,
            OrderingTimestamp: configurationItem.configurationItemCaptureTime
        }
    ];
    putEvaluationsRequest.ResultToken = event.resultToken;
    // Invoke the Config API to report the result of the evaluation
    config.putEvaluations(putEvaluationsRequest, function (err, data) {
        if (err) {
            context.fail(err);
        } else {
            context.succeed(data);
        }
    });
};

@@ -283,333 +283,272 @@
  we 
-simply decide that the resource is compliant if it is an instance and its type matches the type specified as the desired type.
+look at the tenancy of the EC2 instance and determine whether it matches 
 %0A//
- If
  the 
-resource is not an instance, then we deem this resource to be not applicab
+%22DesiredTenancy%22 parameter that is passed to the ru
 le. 
-(
 If the 
-scope of the rule is specified to include only%0A// instances, this rule would never have been invoked.)
+tenancy is not of the DesiredTenancy type, the %0A// instance is marked non-compliant. Otherwise, it is marked complaint. %0A
 %0Afun

Update instance_desired_tenancy-triggered.js