Detect & correct EBS volumes attached to stopped instances

Overview

EBS volumes attached to stopped instances still incur costs even though they may not be used; these should be reviewed and either detached from the stopped instance or deleted.

This query trigger detects EBS volumes attached to stopped instances and then either sends a notification or attempts to perform a predefined corrective action.

Getting Started

By default, this trigger is disabled, however it can be configured by setting the below variables

ebs_volumes_attached_to_stopped_instances_trigger_enabled should be set to true as the default is false.
ebs_volumes_attached_to_stopped_instances_trigger_schedule should be set to your desired running schedule
ebs_volumes_attached_to_stopped_instances_default_action should be set to your desired action (i.e. "notify" for notifications or "detach_volume" to detach the volume from the instance).

Then starting the server:

flowpipe server

or if you've set the variables in a .fpvars file:

flowpipe server --var-file=/path/to/your.fpvars

Pipeline

Correct EBS volumes attached to stopped instances

Query

with vols_and_instances as (
  select
    v.volume_id,
    i.instance_id,
    v.region,
    v.account_id,
    v._ctx,
    bool_or(i.instance_state = 'stopped') as has_stopped_instances
  from
    aws_ebs_volume as v
    left join jsonb_array_elements(v.attachments) as va on true
    left join aws_ec2_instance as i on va ->> 'InstanceId' = i.instance_id
  group by
    v.volume_id,
    i.instance_id,
    v.region,
    v.account_id,
    v._ctx
)
select
  concat(
    volume_id,
    ' [',
    volume_type,
    '/',
    region,
    '/',
    account_id,
    ']'
  ) as title,
  volume_id,
  region,
  _ctx ->> 'connection_name' as cred
from
  vols_and_instances
where
  has_stopped_instances = true;

Schedule

15m