Skip to main content

More Info:

AWS EC2 Reserved Instances should be fully utilized.

Risk Level

Low

Address

Cost Optimisation

Compliance Standards

  • APRA CPS 234 (Australia)
  • AWS Well Architected Framework
  • BSI C5 (Germany)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Digital Operational Resilience Act (EU)
  • ISO/IEC 27017
  • ISO/IEC 27701
  • MAS Technology Risk Management (Singapore)
  • NIS2 Directive
  • NIST SP 800-171
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Using Console

To remediate the misconfiguration of unused reserved instances in AWS, you can follow the below steps:
  1. Log in to the AWS Management Console.
  2. Navigate to the EC2 Dashboard.
  3. Click on the “Reserved Instances” option from the left-hand menu.
  4. Identify the unused reserved instances that need to be remediated.
  5. Select the unused reserved instances that you want to modify.
  6. Click on the “Actions” button and select “Modify Reserved Instances”.
  7. In the “Modify Reserved Instances” window, select the “Apply to” option and choose the instances that you want to apply the reserved instances to.
  8. Click on the “Add to queue” button to add the modification to the queue.
  9. Review the changes and click on the “Modify Reserved Instances” button to apply the changes.
Once the changes are applied, the unused reserved instances will be applied to the selected instances, and the misconfiguration of unused reserved instances will be remediated.

To remediate the issue of unused reserved instances in AWS using AWS CLI, follow these steps:
  1. Identify the unused reserved instances by running the following command:
    This command will list all the reserved instances that are in active state but not being used.
  2. Once you have identified the unused reserved instances, you can either modify or delete them. To modify the unused reserved instances, you can change the instance type or the availability zone to match your current usage. To modify a reserved instance, run the following command:
    Replace <reservation-id> with the ID of the unused reserved instance, <new-count> with the number of instances you want to reserve, <new-type> with the instance type you want to reserve, and <new-zone> with the availability zone you want to reserve the instance in. To delete the unused reserved instances, run the following command:
    Replace <reservation-id> with the ID of the unused reserved instance you want to delete.
  3. Verify that the unused reserved instances have been modified or deleted by running the command in step 1 again.
To remediate the misconfiguration “Reserved Instances Should Not Be Unused” in AWS using python, follow these steps:
  1. Identify the unused reserved instances in your AWS account. You can do this by using the AWS SDK for Python (boto3) to list all your reserved instances and their utilization status.
  1. Once you have identified the unused reserved instances, you can either sell them on the AWS Reserved Instance Marketplace or exchange them for other instances that you need. To sell the unused reserved instances, you can use the AWS SDK for Python (boto3) to create a listing on the AWS Reserved Instance Marketplace.
  1. If you want to exchange the unused reserved instances for other instances, you can use the AWS SDK for Python (boto3) to modify the reserved instances.
By following these steps, you can remediate the misconfiguration “Reserved Instances Should Not Be Unused” in AWS using python.
Terraform cannot remediate “unused Reserved Instances” on aws_instance resources, because Reserved Instances are an account‑level billing construct that Terraform/AWS providers do not manage or attach to individual instances.To fix this finding you must align running instances (types, platforms, AZs, tenancy) with your existing Reserved Instances or modify/sell the RIs themselves via the AWS Console/CLI (EC2 → Reserved Instances → Modify/Sell, or start/resize/relocate instances to match the RI attributes). There is no Terraform argument on aws_instance (or any other AWS provider resource) that can change RI utilization.

Additional Reading: