Skip to main content

More Info:

All Amazon RDS Reserved Instance (RI) purchases are reviewed every 7 days in order to confirm that no unwanted reservation purchase has been placed recently.

Risk Level

Low

Address

Cost Optimisation

Compliance Standards

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • ISO/IEC 27017
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Using Console

To remediate the misconfiguration of not reviewing RDS Reserved Instances purchases every 7 days in AWS using the AWS Management Console, follow these steps:
  1. Sign in to the AWS Management Console: Go to https://aws.amazon.com/ and sign in to your AWS account.
  2. Navigate to the RDS Service: Click on the “Services” dropdown menu at the top of the page, then select “RDS” under the Database category.
  3. Review Reserved Instances: In the RDS dashboard, locate the “Reserved Instances” option in the left-hand menu and click on it.
  4. Check Purchase History: Review the list of your Reserved Instances to ensure they have been purchased and are being utilized effectively. Look for any instances that may not be optimized or are not in use.
  5. Set Up a Reminder: To ensure that you review your Reserved Instances every 7 days, you can set up a reminder in the AWS Management Console. You can use AWS CloudWatch Events to create a rule that triggers a reminder notification every 7 days.
  6. Create a CloudWatch Event Rule:
    • Go to the AWS CloudWatch service in the AWS Management Console.
    • Click on “Rules” in the left-hand menu and then click on “Create rule”.
    • Under “Event Source”, select “Schedule”.
    • Set the schedule to run every 7 days or as per your requirement.
    • Under “Targets”, choose the target for your reminder notification (e.g., SNS topic, Lambda function).
    • Click on “Configure details”, give your rule a name and description, and then click on “Create rule”.
  7. Monitor and Review: Ensure that you receive the reminder notifications every 7 days to review your RDS Reserved Instances purchases. Make any necessary adjustments to optimize your Reserved Instances based on your usage and requirements.
By following these steps, you can remediate the misconfiguration of not reviewing RDS Reserved Instances purchases every 7 days in AWS using the AWS Management Console.

To remediate the misconfiguration of not reviewing RDS Reserved Instances purchases every 7 days in AWS using AWS CLI, follow these steps:
  1. List all the Reserved Instances in AWS RDS: Run the following AWS CLI command to list all the Reserved Instances in your AWS account:
  2. Identify the Purchase Date of each Reserved Instance: From the output of the previous command, note down the OfferingType and StartTime values for each Reserved Instance. The StartTime field indicates when the Reserved Instance was purchased.
  3. Calculate the Age of Each Reserved Instance: Calculate the age of each Reserved Instance by comparing the StartTime with the current date. If any Reserved Instance is older than 7 days, it needs to be reviewed.
  4. Set up a Scheduled AWS Lambda Function: Create an AWS Lambda function that uses the AWS SDK to list all the Reserved Instances and their purchase dates. The Lambda function should compare the purchase date with the current date and send a notification if any Reserved Instance is older than 7 days.
  5. Create an AWS CloudWatch Event Rule: Set up a CloudWatch Event Rule that triggers the Lambda function on a schedule (e.g., every 7 days). This will automate the process of reviewing RDS Reserved Instances purchases regularly.
  6. Configure Notifications: Configure the Lambda function to send notifications (e.g., via Amazon SNS) to the appropriate stakeholders if any Reserved Instance needs to be reviewed.
By following these steps and automating the process using AWS Lambda and CloudWatch Events, you can ensure that RDS Reserved Instances purchases are reviewed every 7 days in AWS.
To remediate the misconfiguration of not reviewing RDS Reserved Instances purchases every 7 days in AWS using Python, you can create a Lambda function that will be triggered by a CloudWatch Events rule on a 7-day schedule. Below are the step-by-step instructions to remediate this misconfiguration:
  1. Create a Lambda Function:
    • Go to the AWS Management Console and navigate to the Lambda service.
    • Click on the “Create function” button.
    • Choose the “Author from scratch” option.
    • Provide a name for your function, select Python as the runtime, and choose an existing role with the necessary permissions or create a new one.
    • Click on the “Create function” button.
  2. Write Python Code:
    • In the Lambda function code editor, write Python code to list all the RDS Reserved Instances and check their purchase date.
    • You can use the AWS SDK for Python (Boto3) to interact with AWS services.
    • Here is an example code snippet to get you started:
  3. Set up CloudWatch Events Rule:
    • Go to the AWS Management Console and navigate to the CloudWatch service.
    • Click on “Rules” in the left-hand menu and then click on “Create rule”.
    • Set the schedule expression to run every 7 days.
    • Add a target for the rule and select the Lambda function you created earlier.
  4. Test the Remediation:
    • Manually trigger the Lambda function to ensure that it is correctly listing RDS Reserved Instances that need review.
    • Verify that the CloudWatch Events rule triggers the Lambda function as expected every 7 days.
By following these steps, you can remediate the misconfiguration of not reviewing RDS Reserved Instances purchases every 7 days in AWS using a Python Lambda function triggered by a CloudWatch Events rule.
This finding cannot be remediated via Terraform, because it requires a periodic human review of billing/purchase data and potentially opening a support case; no Terraform resource or argument exists to list or review RDS Reserved Instances.Use the AWS CLI or console as in the verified fix:
Then, if you discover an unwanted purchase, contact AWS Support; RI purchases are generally final. You can optionally schedule these commands via CI or an external scheduler, but that orchestration occurs outside Terraform and will not appear in terraform plan.

Additional Reading: