Query to alert when EBS data volume is de-attached from and EC2 instance

[bmurali]

Looking for help with the right RQL to

alert when any EBS data volume is de-attached from an EC2 instance

[ebeuerlein · Accepted solution]

This should get you started: 

event where operation = 'DetachVolume'

If you are looking for a specific user doing the action, you can add subject or role using the AND function.

[jrieger]

This is a built-in policy:

"AWS EBS Volume is unattached"

RQL:

config where cloud.type = 'aws' AND api.name = 'aws-ec2-describe-volumes' AND json.rule = attachments[*] all empty or attachments[*].state does not contain "attached"

[bmurali]

Thanks for the query.

However, Question was about the detection event, if there was any volume de-attached. Later on, maybe that was left in the de-attached state or may be attached to another machine or attached to the same machine.

This query provided simply returns the de-attached volume list.

We might have to look at audit events.

[ebeuerlein · Accepted solution]

This should get you started: 

event where operation = 'DetachVolume'

If you are looking for a specific user doing the action, you can add subject or role using the AND function.