> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# RDS RIs Should Have A Corresponding DB Instances

### More Info:

All your AWS RDS Reserved Instances (RI) should have corresponding database instances running within the same account or within any AWS accounts members of an AWS Organization

### Risk Level

Low

### Address

Cost Optimisation

### Compliance Standards

* Cloudanix Best Practice

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration of RDS Reserved Instances (RIs) not having corresponding DB instances in AWS, you can follow these steps using the AWS Management Console:

        1. **Identify the Unused RDS Reserved Instances:**
           * Go to the AWS Management Console and navigate to the RDS service.
           * Click on "Reserved Instances" in the left-hand menu to view all the reserved instances.
           * Look for RDS Reserved Instances that do not have corresponding active DB instances.

        2. **Verify the Status of the DB Instances:**
           * Check the status of the DB instances associated with the RDS Reserved Instances. Ensure that they are active and running.

        3. **Associate RDS RIs with DB Instances:**
           * If you find any RDS Reserved Instances that are not associated with any active DB instances, you can associate them by following these steps:
             * Select the unused RDS Reserved Instance.
             * Click on the "Actions" dropdown menu and select "Modify Reserved Instances".
             * In the "Modify Reserved Instances" wizard, choose the active DB instance that you want to associate with the RI.
             * Click on "Add DB Instance" and select the appropriate DB instance.
             * Review the changes and click on "Modify Reserved Instances" to associate the RI with the DB instance.

        4. **Verify the Association:**
           * After associating the RDS Reserved Instances with the corresponding DB instances, verify that the association is successful.
           * Check the Reserved Instances dashboard to ensure that all RIs now have corresponding active DB instances.

        By following these steps, you can remediate the misconfiguration of RDS Reserved Instances not having corresponding DB instances in AWS.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration where RDS Reserved Instances (RIs) do not have corresponding DB instances in AWS RDS using AWS CLI, follow these steps:

        1. Identify the unassociated RDS Reserved Instances:

           Run the following AWS CLI command to list all the RDS Reserved Instances:

           ```
           aws rds describe-reserved-db-instances
           ```

        2. Identify the DB instances associated with each RDS Reserved Instance:

           Run the following AWS CLI command to list all the DB instances in your AWS account:

           ```
           aws rds describe-db-instances
           ```

        3. Compare the RDS Reserved Instances with the DB instances to identify any unassociated RIs.

        4. Associate the unassociated RDS Reserved Instances with the corresponding DB instances:

           Run the following AWS CLI command to modify the RDS Reserved Instance to associate it with a specific DB instance:

           ```
           aws rds modify-reserved-db-instances --reserved-db-instance-id <RI_ID> --db-instance-id <DB_INSTANCE_ID>
           ```

           Replace `<RI_ID>` with the ID of the unassociated RDS Reserved Instance and `<DB_INSTANCE_ID>` with the ID of the corresponding DB instance.

        5. Verify the association:

           Run the following AWS CLI command to describe the RDS Reserved Instance and verify that it is now associated with the correct DB instance:

           ```
           aws rds describe-reserved-db-instances --reserved-db-instance-id <RI_ID>
           ```

           Replace `<RI_ID>` with the ID of the RDS Reserved Instance.

        By following these steps, you can remediate the misconfiguration where RDS Reserved Instances do not have corresponding DB instances in AWS RDS using AWS CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration of RDS Reserved Instances (RIs) not having corresponding DB instances in AWS using Python, you can follow these steps:

        1. List all the RDS Reserved Instances and DB Instances using the AWS SDK for Python (Boto3):

        ```python theme={null}
        import boto3

        client = boto3.client('rds')

        # List all RDS Reserved Instances
        response_ris = client.describe_reserved_db_instances()
        reserved_instances = response_ris['ReservedDBInstances']

        # List all RDS DB Instances
        response_db_instances = client.describe_db_instances()
        db_instances = response_db_instances['DBInstances']
        ```

        2. Create a dictionary mapping the DB Instance IDs to their corresponding RIs:

        ```python theme={null}
        db_instance_ids = [db_instance['DBInstanceIdentifier'] for db_instance in db_instances]
        ri_mapping = {}

        for ri in reserved_instances:
            if ri['DBInstanceIdentifier'] in db_instance_ids:
                ri_mapping[ri['DBInstanceIdentifier']] = ri['ReservedDBInstanceId']
        ```

        3. Identify the RIs without corresponding DB Instances and release them:

        ```python theme={null}
        for ri in reserved_instances:
            if ri['ReservedDBInstanceId'] not in ri_mapping.values():
                client.modify_reserved_db_instances(
                    ReservedDBInstanceId=ri['ReservedDBInstanceId'],
                    ApplyImmediately=True,
                    ReservedDBInstanceOfferingId=ri['ReservedDBInstanceOfferingId']
                )
        ```

        4. Optionally, you can also create new RIs for the DB Instances that do not have corresponding RIs:

        ```python theme={null}
        for db_instance in db_instances:
            if db_instance['DBInstanceIdentifier'] not in ri_mapping.keys():
                client.purchase_reserved_db_instances_offering(
                    ReservedDBInstancesOfferingId='your_offering_id',
                    DBInstanceIdentifier=db_instance['DBInstanceIdentifier'],
                    DBInstanceClass=db_instance['DBInstanceClass'],
                    Duration=1,  # Duration in years
                    MultiAZ=db_instance['MultiAZ'],
                    OfferingType='AllUpfront'  # Payment type
                )
        ```

        5. Run the Python script to remediate the misconfiguration of RDS RIs not having corresponding DB instances in AWS.

        Please ensure that you have the necessary permissions and credentials set up to interact with AWS services using Boto3.
      </Accordion>

      <Accordion title="Using Terraform">
        Terraform cannot modify or list AWS RDS Reserved Instances or create RI Marketplace listings; those operations are not exposed in the `hashicorp/aws` provider, so this check cannot be remediated via Terraform.

        You must use the AWS CLI or Console as in the verified fix:

        * To modify the Reserved Instance to match an existing DB instance class (permanent for remainder of term):

        ```bash theme={null}
        aws rds describe-reserved-db-instances --reserved-db-instance-id {{UPSTREAM_RESERVED_DB_INSTANCE_ID}} --region {{AWS_REGION}}

        aws rds describe-db-instances --region {{AWS_REGION}}

        aws rds modify-reserved-db-instance \
          --reserved-db-instance-id {{UPSTREAM_RESERVED_DB_INSTANCE_ID}} \
          --target-db-instance-class <NEW_INSTANCE_CLASS> \
          --region {{AWS_REGION}}
        ```

        * Or to sell the unused RI on the Reserved Instance Marketplace (irreversible listing):

        ```bash theme={null}
        aws rds create-reserved-db-instances-listing \
          --reserved-db-instance-id {{UPSTREAM_RESERVED_DB_INSTANCE_ID}} \
          --instance-count {{DB_INSTANCE_COUNT}} \
          --price-schedules '[{"Term":<MONTHS_REMAINING>,"Price":<PRICE_IN_USD>}]]' \
          --region {{AWS_REGION}}
        ```

        Substitute:

        * `{{UPSTREAM_RESERVED_DB_INSTANCE_ID}}` with the RI ID from the finding.
        * `{{AWS_REGION}}` with the region of the RI.
        * `<NEW_INSTANCE_CLASS>` with a valid RDS class in the same instance family/region as the RI.
        * `{{DB_INSTANCE_COUNT}}` with the number of instances covered by the RI you want to sell.
        * `<MONTHS_REMAINING>` and `<PRICE_IN_USD>` per your desired listing.

        Verification: because this is not Terraform-managed, `terraform plan` will show no changes related to RDS Reserved Instances. You must verify via `aws rds describe-reserved-db-instances` or the RDS Console that the RI is now matched to a running DB instance or listed on the RI Marketplace.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER\_WorkingWithReservedDBInstances.html](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_WorkingWithReservedDBInstances.html)