nuclei-templates/cloud/aws/rds/rds-ri-payment-fail.yaml

56 lines
1.7 KiB
YAML

id: rds-ri-payment-fail
info:
name: RDS RI Payment Failure
author: princechaddha
severity: high
description: |
Identifies failed RDS Reserved Instance purchases due to payment failures, affecting potential cost savings.
impact: |
Prevents utilization of reserved instance discounts, potentially leading to higher operational costs.
remediation: |
Review the payment methods on file and retry the reservation purchase for RDS instances to secure discounted rates.
reference:
- https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_WorkingWithReservedDBInstances.html
tags: cloud,devops,aws,amazon,rds,aws-cloud-config
variables:
region: "ap-northeast-1"
flow: |
code(1)
for(let DBInstances of iterate(template.instances)){
set("db", DBInstances)
code(2)
}
self-contained: true
code:
- engine:
- sh
- bash
source: |
aws rds describe-reserved-db-instances --region $region --output json --query 'ReservedDBInstances[*].ReservedDBInstanceId'
extractors:
- type: json
name: snapshots
internal: true
json:
- '.[]'
- engine:
- sh
- bash
source: |
aws rds describe-reserved-db-instances --region $region --reserved-db-instance-id $db --query 'ReservedDBInstances[*].State'
matchers:
- type: word
words:
- 'payment-failed'
extractors:
- type: dsl
dsl:
- '"RDS Reserved Instance purchase has failed for " + db'
# digest: 4a0a00473045022040705df585fbeec117d8605a7eb385b6fb0ae5cca87f948b79aef51f4a4b5b19022100a62f52ca4c10ab087a8d672d8288e120540531595b354c0663a7b5c7426ee198:922c64590222798bb761d5b6d8e72950