Skip to main content

Elasticsearch Reserved Instance Should Not Have Status -

More Info:​

Your AWS Account should not have any failed Amazon Elasticsearch (ES) Reserved Instances.

Risk Level​

Low

Address​

Cost Optimisation

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • ISO/IEC 27017
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

To remediate the Elasticsearch Reserved Instance Payment Failed status in AWS, you can follow these steps:

  1. Log in to your AWS Console and navigate to the Elasticsearch service.

  2. Click on the "Reserved Instances" tab on the left-hand side of the screen.

  3. Identify the Reserved Instance that has the Payment Failed status.

  4. Click on the Reserved Instance ID to view the details.

  5. On the "Details" tab, scroll down to the "Payment Information" section.

  6. Click on the "Modify Payment Method" button.

  7. Update the payment method with valid payment information.

  8. Click on the "Save Changes" button.

  9. Wait for a few minutes for the payment status to update.

  10. Refresh the page to confirm that the status has been updated to "Active".

Once the status has been updated to "Active", the Elasticsearch Reserved Instance will be available for use.

Using CLI

To remediate the Elasticsearch Reserved Instance with the status "Payment Failed" in AWS using AWS CLI, follow these steps:

  1. Open the AWS CLI on your local machine.

  2. Run the following command to get the ID of the Elasticsearch Reserved Instance:

aws es describe-reserved-elasticsearch-instances

  1. Identify the ID of the Elasticsearch Reserved Instance with the status "Payment Failed".

  2. Run the following command to modify the Elasticsearch Reserved Instance:

aws es modify-reserved-elasticsearch-instance --reserved-elasticsearch-instance-id <ID> --payment-option AllUpfront

Replace <ID> with the ID of the Elasticsearch Reserved Instance identified in step 3.

  1. Verify that the Elasticsearch Reserved Instance status has changed to "Active" by running the following command:
aws es describe-reserved-elasticsearch-instances --reserved-elasticsearch-instance-id <ID>

The Elasticsearch Reserved Instance should now be remediated and have a status of "Active".

Using Python

To remediate the Elasticsearch Reserved Instance Payment Failed status in AWS using Python, you can follow these steps:

  1. Import the necessary AWS SDK libraries for Python. You can use the boto3 library for this.
import boto3
  1. Create an instance of the boto3 client for Elasticsearch.
es_client = boto3.client('es')
  1. Use the describe_reserved_elasticsearch_instance_offerings method of the Elasticsearch client to get a list of available Elasticsearch reserved instance offerings.
reserved_instance_offerings = es_client.describe_reserved_elasticsearch_instance_offerings()
  1. Loop through the reserved instance offerings and check if there are any with a PaymentFailure status.
for offering in reserved_instance_offerings['ReservedElasticsearchInstanceOfferings']:
    if offering['PaymentOption'] == 'Reserved' and offering['PaymentPlan'] == 'AllUpfront' and offering['State'] == 'payment-failed':
        # do something to remediate the payment failure
  1. To remediate the payment failure, you can use the purchase_reserved_elasticsearch_instance_offering method of the Elasticsearch client to purchase a new reserved instance offering with the same specifications as the failed one. You can then cancel the failed reserved instance offering using the cancel_reserved_elasticsearch_instance method.
# purchase a new reserved instance offering
new_offering = es_client.purchase_reserved_elasticsearch_instance_offering(
    ReservedElasticsearchInstanceOfferingId=offering['ReservedElasticsearchInstanceOfferingId'],
    InstanceCount=offering['InstanceCount']
)

# cancel the failed reserved instance offering
es_client.cancel_reserved_elasticsearch_instance(
    ReservedElasticsearchInstanceId=offering['ReservedElasticsearchInstanceId']
)
  1. You can also set up a CloudWatch event to monitor for Elasticsearch reserved instance payment failures and trigger a Lambda function to automatically remediate them.
Using Terraform
# Not configurable via Terraform

# There is currently no Terraform resource in the AWS provider that
# manages Amazon Elasticsearch / OpenSearch *Reserved Instances* or
# their payment/billing status. The status "payment-failed" is a
# billing/state issue on an already-purchased RI, not a setting that
# can be expressed in Terraform.

# To remediate:
# 1. In the AWS Console, go to:
#    AWS Billing & Cost Management → Bills / Payments, and resolve any
#    failed payment methods or outstanding charges.
# 2. Then go to:
#    Amazon OpenSearch Service (or legacy Amazon Elasticsearch Service)
#    → Reserved instances, and confirm that the affected RI is no longer
#    in a "payment-failed" or similar status.

# Because the AWS Terraform provider does not expose Elasticsearch /
# OpenSearch Reserved Instances as a resource, `terraform plan` will
# show no changes related to this finding; verification must be done
# through the AWS Console or CLI (e.g. `aws es describe-reserved-instances`).

Additional Reading:​