Remediate AWS CIS v3.0 and v4.0 with Flowpipe's interactive wizard →
Flowpipe Hub 
Hub
standard
turbot/aws_thrifty
Overview
94
Pipelines
31
Triggers
139
VariablesGitHub

Overview

EC2 instances can be quite costly to retain, it is also likely that after a certain point in time they're no longer required and should be cleaned up to prevent further costs. Large EC2 instances are unusual, expensive and should be reviewed.

This query trigger detects large EC2 instances and then either sends a notification or attempts to perform a predefined corrective action.

Getting Started

By default, this trigger is disabled, however it can be configured by setting the below variables

  • ec2_instances_large_trigger_enabled should be set to true as the default is false.
  • ec2_instances_large_trigger_schedule should be set to your desired running schedule
  • ec2_instances_large_default_action should be set to your desired action (i.e. "notify" for notifications or "terminate_instance" to delete the instance).

Then starting the server:

flowpipe server

or if you've set the variables in a .fpvars file:

flowpipe server --var-file=/path/to/your.fpvars

Query

select
  concat(instance_id, ' [', region, '/', account_id, ']') as title,
  instance_id,
  region,
  sp_connection_name as conn
from
  aws_ec2_instance
where
  instance_state in ('running', 'pending', 'rebooting')
  and instance_type not like any (
    array [ '%.nano',
    '%.micro',
    '%.small',
    '%.medium',
    '%.large',
    '%.xlarge',
    '%._xlarge' ]
  )

Schedule

15m

Tags

category = Cost
class = unused
plugin = aws
service = AWS/EC2