Get Involved

Query: EC2 Reserved Instance Purchased

Description

Detect when an EC2 Reserved Instance was purchased. Purchasing reserved instances may indicate changes in resource planning or cost management strategies, which should be reviewed for compliance and alignment with organizational policies.

Query

Tables used in this query:

aws_cloudtrail_log

Detections using this query:

EC2 Reserved Instance Purchased

SQL

select
  tp_timestamp as timestamp,
  string_split(event_source, '.') [ 1 ] || ':' || event_name as operation,
  response_elements ->> 'reservedInstancesId' as resource,
  user_identity.arn as actor,
  tp_source_ip as source_ip,
  tp_index as account_id,
  aws_region as region,
  tp_id as source_id,
  *
from
  aws_cloudtrail_log
where
  event_source = 'ec2.amazonaws.com'
  and event_name = 'PurchaseReservedInstancesOffering'
  and error_code is null
order by
  tp_timestamp desc;

Query: EC2 Reserved Instance Purchased

Description

Query

SQL

Tags