Elasticsearch Reserved Instance Recent Purchases Should Be Reviewed

More Info:

All active Amazon Elasticsearch (ES) Reserved Instance purchases should be reviewed every 7 days to make sure that no unwanted RI purchase has been placed recently.

Risk Level

Low

Address

Cost Optimisation

Compliance Standards

CBP

Triage and Remediation

Remediation

Using Console

Using CLI

The Elasticsearch Reserved Instance Recent Purchases Should Be Reviewed misconfiguration in AWS occurs when there are recent purchases of Elasticsearch reserved instances that have not been reviewed for accuracy. To remediate this issue, follow these steps using AWS CLI:

Log in to your AWS account using the AWS CLI.
Run the following command to list all Elasticsearch reserved instances:

aws es describe-reserved-elasticsearch-instances

Review the output to identify any recent purchases that have not been reviewed.
Run the following command to modify the Elasticsearch reserved instance to match your current usage:

aws es modify-reserved-elasticsearch-instance --reserved-elasticsearch-instance-id <instance-id> --reserved-elasticsearch-instance-offering-id <offering-id> --elasticsearch-instance-count <instance-count>

Replace <instance-id> with the ID of the reserved instance that needs to be modified, <offering-id> with the ID of the offering that you want to use, and <instance-count> with the number of Elasticsearch instances that you want to reserve.

Review the output to ensure that the reserved instance has been modified correctly.
Run the following command to confirm that the reservation has been applied:

aws es describe-reserved-elasticsearch-instances --reserved-elasticsearch-instance-id <instance-id>

Replace <instance-id> with the ID of the reserved instance that you modified.

Review the output to ensure that the reservation has been applied correctly.

By following these steps, you can remediate the Elasticsearch Reserved Instance Recent Purchases Should Be Reviewed misconfiguration in AWS using AWS CLI.

Using Python

The misconfiguration “Elasticsearch Reserved Instance Recent Purchases Should Be Reviewed” means that there are unused or underutilized Elasticsearch reserved instances that were recently purchased. To remediate this issue, you can use the following steps in Python:

Get a list of all Elasticsearch reserved instances that are currently active and unused. You can use the boto3 library to interact with AWS Elasticsearch service and retrieve the list of reserved instances. The following code snippet shows how to retrieve the list of reserved instances:

import boto3

client = boto3.client('es')

response = client.describe_reserved_elasticsearch_instances(
    ReservedElasticsearchInstanceId='string',
    MaxResults=123,
    NextToken='string'
)

reserved_instances = response['ReservedElasticsearchInstances']

Determine the utilization of each reserved instance. You can use CloudWatch metrics to determine the utilization of each reserved instance. The following code snippet shows how to retrieve the average CPU utilization metric for a reserved instance:

import boto3

cloudwatch = boto3.client('cloudwatch')

response = cloudwatch.get_metric_statistics(
    Namespace='AWS/ES',
    MetricName='CPUUtilization',
    Dimensions=[
        {
            'Name': 'ReservedElasticsearchInstanceId',
            'Value': 'string'
        },
    ],
    StartTime='datetime(2015, 1, 1)',
    EndTime='datetime(2015, 1, 2)',
    Period=123,
    Statistics=[
        'Average',
    ],
    Unit='Percent'
)

utilization = response['Datapoints'][0]['Average']

Identify the reserved instances that have low utilization. You can set a threshold for the utilization and identify the reserved instances that have utilization below the threshold. For example, if you set the threshold to 20%, you can identify the reserved instances that have utilization below 20%.

low_utilization_instances = []
threshold = 20

for instance in reserved_instances:
    instance_id = instance['ReservedElasticsearchInstanceId']
    utilization = get_utilization(instance_id)
    if utilization < threshold:
        low_utilization_instances.append(instance_id)

Review the list of reserved instances with low utilization and determine if they can be released or if the instance type can be changed to better match the workload. If the reserved instances can be released, you can use the boto3 library to release the Elasticsearch reserved instances. The following code snippet shows how to release a reserved instance:

import boto3

client = boto3.client('es')

client.purchase_reserved_elasticsearch_instance_offering(
    ReservedElasticsearchInstanceId='string'
)

By following these steps, you can remediate the misconfiguration “Elasticsearch Reserved Instance Recent Purchases Should Be Reviewed” for AWS using Python.

Additional Reading:

https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/aes-ri.html

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Elasticsearch Reserved Instance Recent Purchases Should Be Reviewed

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​Additional Reading:

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading: