Adam Moussa
a9bccf33d0
Read-only Tier-2 idle/anomalous-spend + idle-resource posture checker for the R720 agent-team (design D5 / §4 / §6.3 / §7 Phase 3). Mirrors the Tier-1 checker conventions verbatim (flags --canary/--dry-run/--no-api/--targets, mode-600 report under $REPORT_ROOT/aws-posture/<date>/, ALARM-only, finding.schema.json spirit, exit 0/2/3, shared substrate redact/post_slack_alarm). Detectors (complement GuardDuty/SecurityHub/Config, do not replace): - anomalous Cost Explorer deltas (ce get-anomalies, $-impact threshold) - stopped EC2 still paying for attached EBS - unattached EBS volumes - unassociated Elastic IPs - idle NAT gateways (≈0 bytes out) - idle load balancers (0 healthy targets) - idle RDS (0 connections over window) Live AWS calls are PROVISIONING-GATED: they run ONLY when Roles Anywhere creds are available (STS identity probe) AND not --no-api/--canary. With no creds or --no-api/--canary the checker SKIPS live calls and notes them — NEVER alarms on missing data (memory feedback_cloudwatch_alarms). Roles Anywhere/step-ca are not stood up (IAM cross-review PASSED 2026-06-18; see security-review/iam/). Offline canary: fixtures of mocked AWS responses (cost/describe-* JSON) under fixtures/aws-posture/ + EXPECTED_FINDING_COUNT=7, asserted fully offline (no aws, no network). Identical detector code runs online and offline. shellcheck-clean (only accepted SC1091), chmod +x.
20 lines
500 B
JSON
20 lines
500 B
JSON
{
|
|
"Volumes": [
|
|
{
|
|
"VolumeId": "vol-unattached-9001",
|
|
"Size": 500,
|
|
"VolumeType": "gp3",
|
|
"State": "available",
|
|
"CreateTime": "2025-11-02T18:00:00.000Z",
|
|
"Attachments": [],
|
|
"Tags": [ { "Key": "Name", "Value": "orphaned-data-disk" } ]
|
|
},
|
|
{
|
|
"VolumeId": "vol-running-root-002",
|
|
"Size": 8,
|
|
"VolumeType": "gp3",
|
|
"State": "in-use",
|
|
"Attachments": [ { "InstanceId": "i-0ff99ee88dd77cc66", "State": "attached" } ]
|
|
}
|
|
]
|
|
}
|