Reserved Instance Payment Pending Purchases

Risk Level: High (not acceptable risk)

Rule ID: ES-019

Identify any pending Amazon OpenSearch Reserved Instance purchases available within your AWS account and follow Trend Micro Cloud One™ – Conformity guidelines for remediation in order to receive a significant discount on the hourly charges. A payment-pending Reserved Instance purchase is a reservation purchase that can't be fully processed due to issues with the payment method used by the AWS user, that maintains the "payment-pending" status long after the initial purchase attempt – not to be confused with the pending state temporarily installed during a successfully processed RI purchase (i.e. where the reservation status changes from "payment-pending" to "active" in a timely manner).

This rule can help you work with the AWS Well-Architected Framework.

This rule resolution is part of the Conformity Security & Compliance tool for AWS.

Cost
optimisation

Amazon OpenSearch Reserved Instances represent an efficient strategy to cut down on AWS cloud costs. However, to receive the billing discount benefit promoted by AWS, you need to make sure that all your OpenSearch reservation purchases have been fully processed (i.e. successfully confirmed by AWS) and none of them remained in the "payment-pending" state.

Audit

To identify any pending Amazon OpenSearch Reserved Instance purchases available within your AWS cloud account, perform the following actions:

Using AWS Console

01 Sign in to the AWS Management Console.

02 Navigate to Amazon OpenSearch console at https://console.aws.amazon.com/esv3/.

03 In the main navigation panel, under Domains, select Reserved Instance leases.

04 Choose the Reserved Instance (RI) that you want to examine and check the value (status) listed in the Status column. If the reservation status is set to payment-pending, the purchase payment for the selected Amazon OpenSearch Reserved Instance was not fully processed, therefore you must take action and retry your pending reservation payment by contacting AWS Support Center.

05 Repeat step no. 4 to check the purchase status for other Amazon OpenSearch RIs available within the current AWS region.

06 Change the AWS cloud region from the console navigation bar and repeat the Audit process for other regions.

Using AWS CLI

01 Run describe-reserved-elasticsearch-instances command (OSX/Linux/UNIX) with custom query filters to list the identifier (ID) of each Amazon OpenSearch Reserved Instance available in the selected AWS region:

aws es describe-reserved-elasticsearch-instances
  --region us-east-1
  --output table
  --query 'ReservedOpenSearchInstances[*].ReservedOpenSearchInstanceId'

02 The command output should return a table with the requested Reserved Instance IDs:

----------------------------------------
|    ReservedOpenSearchInstanceIds     |
+--------------------------------------+
| aabbccdd-aabb-ccdd-1234-aabbccdd1234 |
| abcdabcd-abcd-abcd-abcd-abcdabcdabcd |
+--------------------------------------+

03 Run describe-reserved-elasticsearch-instances command (OSX/Linux/UNIX) using the ID of the OpenSearch Reserved Instance (RI) that you want to examine as the identifier parameter and custom query filters to describe the purchase status for the selected RI:

aws es describe-reserved-elasticsearch-instances
  --region us-east-1
  --reserved-elasticsearch-instance-id aabbccdd-aabb-ccdd-1234-aabbccdd1234
  --query 'ReservedOpenSearchInstances[*].State'

04 The command output should return the current purchase status for the selected reservation:

[
	"payment-pending"
]

If the describe-reserved-elasticsearch-instances command output returns "payment-pending", as shown in the output example above, the purchase payment for the selected Amazon OpenSearch Reserved Instance was not fully processed, therefore you must take action and retry your pending reservation payment by contacting AWS Support Center.

05 Repeat steps no. 3 and 4 to verify the purchase status for other Amazon OpenSearch RIs available in the selected AWS region.

06 Change the AWS cloud region by updating the --region command parameter value and repeat steps no. 1 – 5 to perform the Audit process for other AWS regions.

Remediation / Resolution

Partial Upfront and All Upfront Reserved Node types require an upfront payment. When the issuing institution of your payment method is rejecting the upfront payment required for Partial Upfront or All Upfront reservation types, your Reserved Instance purchases can't be confirmed and AWS set their status to "payment-pending". To mitigate incomplete Amazon OpenSearch reservations, you must retry the pending reservation payments by contacting Amazon Web Services (AWS). To create a support case for pending reservation payments, perform the following actions:

Note: Creating a support case to request to retry your incomplete Amazon OpenSearch Reserved Instance payments using the AWS Command Line Interface (AWS CLI) is not currently supported.

Using AWS Console

01 Sign in to the AWS Management Console.

02 Navigate to Amazon OpenSearch console at https://console.aws.amazon.com/esv3/.

03 In the main navigation panel, under Domains, select Reserved Instance leases.

05 Repeat step no. 4 to check the purchase status for other Amazon OpenSearch RIs available within the current AWS region.

06 Change the AWS cloud region from the console navigation bar and repeat the Audit process for other regions.

References

AWS Documentation
Amazon OpenSearch Service Pricing
Reserved Instances in Amazon OpenSearch Service
Amazon OpenSearch Service

AWS Command Line Interface (CLI) Documentation
es
describe-reserved-elasticsearch-instances

Publication date Oct 29, 2018

Unlock the Remediation Steps

Free 30-day Trial

Automatically audit your configurations with Conformity
and gain access to our cloud security platform.

No thanks, back to article

You are auditing:

Reserved Instance Payment Pending Purchases

Risk Level: High

Audit

Using AWS Console

Using AWS CLI

Remediation / Resolution

Using AWS Console

References

Related Elasticsearch rules