[HarmonicTons]

AI;DR

Ajoute un workflow pour controller que nos DB + Elasticache tournent bien sur des instances réservées et pas on-demand. Pour éviter de payer pour rien, comme en ce moment depuis début septembre. Poste une message sur #ops quand une instance problématique est détectée.

What

New reusable workflow reserved-instances-check-v1 and composite action reserved-instances-check: compare the RDS and ElastiCache capacity in service with the active reservations, in size-flexible units per pool (reservation product + instance family, Multi-AZ counts double, the way AWS applies reservations), and post to Slack #ops when some capacity is not covered or when a reservation ends within expiry_warning_days. Nothing is posted when everything is covered, unless always_notify is set.

Resources created less than grace_days ago are ignored, and a resource meant to run without reservation for a while carries the tag reservation-exempt-until=YYYY-MM-DD: it is listed as exempted until that date, then reported again. The threshold min_uncovered_units applies to the pool, not to the instance, so a fleet of small instances is reported as a whole.

Context: the MySQL and PostgreSQL reservations expired on 2026-09-29 and nobody was told. Run offline against a copy of the account's current state (check.py --fixture-dir), the check reports exactly that: mysql / db.m6g 16 units uncovered, mysql / db.t4g 1 unit, postgresql / db.t4g 21.5 units, while Aurora and ElastiCache (renewed on 2026-10-08) are covered. The plan is to merge this, run the check from infra-ci to see the alert, then buy the reservations and see it clear.

The script only needs Python 3 and the AWS CLI, both present on the GitHub runners. The CI role needs the common_reservations_read_only policy, added in sencrop/infra-ci together with the scheduled caller.

yamllint and actionlint pass.

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

Unresolved coverage-accounting and inventory-handling errors can suppress alerts or abort monitoring, while notification logic can generate false alarms.

8 open issues

• Add missing RDS instance size normalization weights · New
• Skip Aurora Serverless instances before size normalization · New
• Use product-aware units for ElastiCache coverage · New
• Include billable RDS rebooting and upgrading states · New
• Include rebooting ElastiCache clusters in inventory · New
• Require a positive uncovered gap before alerting · New
• Suppress expired-exemption alerts when capacity is covered · New
• Grant caller job OIDC and contents permissions · New

What changed in this PR

Adds a reusable reservation-monitoring workflow to detect uncovered RDS and ElastiCache capacity and warn about upcoming reservation expirations.

Changes:

• Adds a Python checker with pooled capacity accounting, grace periods, dated exemptions, and offline fixture support.
• Adds a composite action and reusable workflow for AWS access and conditional Slack notifications.
• Documents the required IAM policy and a scheduled caller example.

File	Description
README.md	Documents reservation monitoring and caller configuration.
actions/​reserved-instances-check/​check.py	Collects inventory, evaluates coverage, and generates reports.
actions/​reserved-instances-check/​action.yml	Exposes checker inputs and report outputs.
.github/​workflows/​reserved-instances-check-v1.yml	Configures AWS credentials and conditional Slack notifications.

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Product-specific reservation accounting can incorrectly report full coverage and suppress alerts for on-demand charges.

2 open issues

• Match SQL Server reservations by exact instance class and deployment · New
• Apply Aurora I/O-Optimized capacity normalization · New

8 resolved since last review

• Use product-aware units for ElastiCache coverage
• Skip Aurora Serverless instances before size normalization
• Add missing RDS instance size normalization weights
• Suppress expired-exemption alerts when capacity is covered
• Require a positive uncovered gap before alerting
• Include rebooting ElastiCache clusters in inventory
• Include billable RDS rebooting and upgrading states
• Grant caller job OIDC and contents permissions

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Oracle License Included pooling can incorrectly treat differently sized reservations as coverage and suppress alerts.

1 open issue

• Match Oracle License Included capacity by exact class and deployment · New

2 resolved since last review

• Apply Aurora I/O-Optimized capacity normalization
• Match SQL Server reservations by exact instance class and deployment

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Billing-sensitive reservation matching and cross-repository IAM and Slack integration require human validation against the target AWS account.

No open issues 🎉

1 resolved since last review

• Match Oracle License Included capacity by exact class and deployment

_{Review effort: Balanced}