Way One: Notify Via Email

create_vpc_rule.yaml

AWSTemplateFormatVersion: '2010-09-09'

Description: Creates an event rule that detects CreateVpc and emails an administrator.

Resources:
  CreateVPCRule:
    Type: AWS::Events::Rule
    Properties:
      Description: 'Cloudwatch event required to implement this rule.'
      Name: 'DetectCreateVpc'
      EventPattern:
        source:
          - aws.ec2
        detail-type:
          - "AWS API Call via CloudTrail"
        detail:
          eventSource:
          - ec2.amazonaws.com
          eventName:
          - CreateVpc
      State: 'ENABLED'
      Targets:
        -
          Arn: !Ref VpcCreatedTopic
          Id: 'VpcCreatedTarget'

  VpcCreatedTopic:
    Type: AWS::SNS::Topic
    Properties:
      Subscription:
        -
          Endpoint: 'administrator@example.com'
          Protocol: 'email'
      DisplayName: 'VpcCreatedTopic'
      TopicName: 'VpcCreatedTopic'

  TopicPolicy:
    Type: AWS::SNS::TopicPolicy
    Properties:
      PolicyDocument:
        Id: TopicPolicy
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service: events.amazonaws.com
          Action: sns:Publish
          Resource: !Ref VpcCreatedTopic
      Topics:
      - !Ref VpcCreatedTopic