Ability to snapshot an EC2 instance prior to terminating

[hiddenillusion]

It'd be useful to have the ability to snapshot an EC2 instance (for forensics purposes) prior to terminating it if the GaurdDuty conditions are met.

Since the naming convention of EC2-auto-terminate doesn't align, this might be better suited as it's own Lambda/CloudWatch group.