AWS compute-optimizer documentation change
Summary
Expanded supported operators for automation rules criteria and added detailed documentation about comparison operators, IfExists variants, and multiple rule examples
Security assessment
The changes enhance documentation about rule criteria operators without addressing vulnerabilities or security incidents. The additions focus on operational flexibility (e.g., opt-out tags for resource exclusion) rather than security controls. No evidence of patching vulnerabilities or responding to security incidents exists in the diff.
Diff
diff --git a/compute-optimizer/latest/ug/automation-rules.md b/compute-optimizer/latest/ug/automation-rules.md index 6c5d70a0a..5264f4b24 100644 --- a//compute-optimizer/latest/ug/automation-rules.md +++ b//compute-optimizer/latest/ug/automation-rules.md @@ -36 +36 @@ If you don't specify rule criteria, Compute Optimizer applies all the selected r -The following recommended action attributes are currently supported as criteria for automation rules: +The following recommended action attributes and comparison operators are supported for automation rules: @@ -40,8 +40,8 @@ Attribute | Operator | Field type -Current volume size (GiB) | `NumericEquals | NumericNotEquals | NumericLessThan | NumericLessThanEquals | NumericGreaterThan | NumericGreaterThanEquals` | Integer -Current volume type | `StringEquals | StringNotEquals | StringEqualsIgnoreCase | StringNotEqualsIgnoreCase | StringLike | StringNotLike` | String -Estimated savings ($) | `NumericEquals | NumericNotEquals | NumericLessThan | NumericLessThanEquals | NumericGreaterThan | NumericGreaterThanEquals` | Double -Lookback period (days) | `NumericEquals | NumericNotEquals | NumericLessThan | NumericLessThanEquals | NumericGreaterThan | NumericGreaterThanEquals` | Integer -AWS Region | `StringEquals | StringNotEquals | StringEqualsIgnoreCase | StringNotEqualsIgnoreCase | StringLike | StringNotLike` | String -Resource ARN | `StringEquals | StringNotEquals | StringEqualsIgnoreCase | StringNotEqualsIgnoreCase | StringLike | StringNotLike` | String -Resource tags | `StringEquals | StringNotEquals | StringEqualsIgnoreCase | StringNotEqualsIgnoreCase | StringLike | StringNotLike` | Resource Tag -Restart needed | `StringEquals | StringNotEquals | StringEqualsIgnoreCase | StringNotEqualsIgnoreCase | StringLike | StringNotLike` | String +Current volume size (GiB) | `NumericEquals | NumericNotEquals | NumericLessThan | NumericLessThanEquals | NumericGreaterThan | NumericGreaterThanEquals | NumericEqualsIfExists | NumericNotEqualsIfExists | NumericLessThanIfExists | NumericLessThanEqualsIfExists | NumericGreaterThanIfExists | NumericGreaterThanEqualsIfExists` | Integer +Current volume type | `StringEquals | StringNotEquals | StringEqualsIgnoreCase | StringNotEqualsIgnoreCase | StringLike | StringNotLike | StringEqualsIfExists | StringNotEqualsIfExists | StringEqualsIgnoreCaseIfExists | StringNotEqualsIgnoreCaseIfExists | StringLikeIfExists | StringNotLikeIfExists` | String +Estimated savings ($) | `NumericEquals | NumericNotEquals | NumericLessThan | NumericLessThanEquals | NumericGreaterThan | NumericGreaterThanEquals | NumericEqualsIfExists | NumericNotEqualsIfExists | NumericLessThanIfExists | NumericLessThanEqualsIfExists | NumericGreaterThanIfExists | NumericGreaterThanEqualsIfExists` | Double +Lookback period (days) | `NumericEquals | NumericNotEquals | NumericLessThan | NumericLessThanEquals | NumericGreaterThan | NumericGreaterThanEquals | NumericEqualsIfExists | NumericNotEqualsIfExists | NumericLessThanIfExists | NumericLessThanEqualsIfExists | NumericGreaterThanIfExists | NumericGreaterThanEqualsIfExists` | Integer +AWS Region | `StringEquals | StringNotEquals | StringEqualsIgnoreCase | StringNotEqualsIgnoreCase | StringLike | StringNotLike | StringEqualsIfExists | StringNotEqualsIfExists | StringEqualsIgnoreCaseIfExists | StringNotEqualsIgnoreCaseIfExists | StringLikeIfExists | StringNotLikeIfExists` | String +Resource ARN | `StringEquals | StringNotEquals | StringEqualsIgnoreCase | StringNotEqualsIgnoreCase | StringLike | StringNotLike | StringEqualsIfExists | StringNotEqualsIfExists | StringEqualsIgnoreCaseIfExists | StringNotEqualsIgnoreCaseIfExists | StringLikeIfExists | StringNotLikeIfExists` | String +Resource tags | `StringEquals | StringNotEquals | StringEqualsIgnoreCase | StringNotEqualsIgnoreCase | StringLike | StringNotLike | StringEqualsIfExists | StringNotEqualsIfExists | StringEqualsIgnoreCaseIfExists | StringNotEqualsIgnoreCaseIfExists | StringLikeIfExists | StringNotLikeIfExists` | Resource Tag +Restart needed | `StringEquals | StringNotEquals | StringEqualsIgnoreCase | StringNotEqualsIgnoreCase | StringLike | StringNotLike | StringEqualsIfExists | StringNotEqualsIfExists | StringEqualsIgnoreCaseIfExists | StringNotEqualsIgnoreCaseIfExists | StringLikeIfExists | StringNotLikeIfExists` | String @@ -50,0 +51,164 @@ You can specify up to 20 conditions per attribute and 20 values per condition. F +### Comparison operators + +Use comparison operators in rule criteria to match recommended action attributes against the values you specify. + +###### Important + +If the attribute that you specify in your rule criteria is not present on the recommended action, the values do not match, the condition is false, and the recommended action is excluded from the rule. This logic applies to all comparison operators except the `...IfExists` operators, which evaluate to true when the attribute is not present. The `...IfExists` operators test whether the attribute is present (exists) on the recommended action. + +#### String condition operators + +String condition operators let you define rule criteria that compare a recommended action attribute to a string you specify. + +Condition operator | Description +---|--- +`StringEquals` | Exact matching, case sensitive. +`StringNotEquals` | Negated exact matching, case sensitive. +`StringEqualsIgnoreCase` | Exact matching, ignoring case. +`StringNotEqualsIgnoreCase` | Negated matching, ignoring case. +`StringLike` | Case-sensitive matching. The values can include multi-character match wildcards (`*`) anywhere in the string. You must specify wildcards to achieve partial string matches. +`StringNotLike` | Negated case-sensitive matching. The values can include multi-character match wildcards (`*`) anywhere in the string. + +###### Note + +Using `*` alone as a value with `StringLike` matches any value that is present. When combined with `StringNotLike`, a value of `*` means "does not match anything" — effectively excluding all recommended actions where the attribute is present. For example, using `StringNotLike` on a tag key `Application` with value `*` excludes any recommended action that has the `Application` tag, regardless of the tag's value. + +#### Numeric condition operators + +Numeric condition operators let you define rule criteria that compare a recommended action attribute to an integer or decimal number. + +Condition operator | Description +---|--- +`NumericEquals` | Exact numeric matching. +`NumericNotEquals` | Negated numeric matching. +`NumericLessThan` | "Less than" matching. +`NumericLessThanEquals` | "Less than or equals" matching. +`NumericGreaterThan` | "Greater than" matching. +`NumericGreaterThanEquals` | "Greater than or equals" matching. + +For example, you can use `NumericGreaterThanEquals` with the **Lookback period** attribute to create a rule that only automates recommended actions where the lookback period used to generate the recommendation is at least 32 days. + +### IfExists operators + +Append `IfExists` to any comparison operator (for example, `StringLikeIfExists`) to change how a condition is evaluated when the attribute you specify is **absent** from a recommended action: + + * With a base operator, an absent attribute evaluates to **false** , and the recommended action is **excluded** from the rule. + + * With the `...IfExists` variant, an absent attribute evaluates to **true** , and the recommended action is **included**. + + + + +`IfExists` is helpful when you want to exclude a specific group of resources from a rule but still include the resources that don't carry the tag you're filtering on. For example, you might want to include everything except the resources owned by one team. A base `StringNotEquals` on `team` = `TeamA` excludes TeamA's resources, but it also excludes every resource that doesn't carry the `team` tag at all — leaving out resources you intended to include. Add `IfExists` to keep those untagged resources in scope: + + * **StringNotEquals** matches only resources that have the `team` tag set to a value other than `TeamA`. Untagged resources are excluded. + + * **StringNotEqualsIfExists** matches resources without the `team` tag _and_ resources where it is set to any value other than `TeamA`. Only resources tagged `team` = `TeamA` are excluded. + + + + +`IfExists` is also helpful when you want to let resource owners exclude their own resources from automation. You can designate a dedicated opt-out tag, such as `automation-opt-out`, that an owner applies to any resource they want to leave out. In this case, the presence of the tag matters, not its value, so use `StringNotLikeIfExists` with the value `*` on the `automation-opt-out` tag key. The `*` wildcard matches any value, so Compute Optimizer excludes every resource that carries the tag. The `IfExists` variant keeps the resources that don't carry the tag in scope; without it, every untagged resource would be excluded as well. + +### Rule criteria examples + +**Example: Include only recommended actions in specific Regions** + +The following rule criteria uses `StringEquals` on the **AWS Region** attribute to match recommended actions for resources in `us-east-1` or `us-west-2`. When you specify more than one value for a condition, the values have an OR relationship — a recommended action matches the condition if its attribute value matches any one of the values. + +Criteria configuration: + +Attribute | Operator | Values +---|---|--- +AWS Region | `StringEquals` | `us-east-1`, `us-west-2` + +Evaluation: + +Attribute value | Result +---|--- +`us-east-1` | Match +`us-west-2` | Match +`eu-west-1` | No match + +**Example: Include only recommended actions generated with a minimum lookback period** + +The following rule criteria uses `NumericGreaterThanEquals` on the **Lookback period (days)** attribute to only automate recommended actions where the lookback period used to generate the recommendation is at least 32 days. This lets you require a longer observation window before a recommended action is automated. + +Criteria configuration: + +Attribute | Operator | Values +---|---|--- +Lookback period (days) | `NumericGreaterThanEquals` | `32` + +Evaluation: + +Attribute value | Result +---|--- +`32` | Match +`14` | No match + +**Example: Include recommended actions unless the resource belongs to a specific team** + +Consider a platform team that enables Compute Optimizer Automation across many accounts but wants to leave one team's resources out of the rule. The team already tags resources with a `team` tag for other purposes, but not every resource carries it. They want automation applied broadly while excluding any resource tagged `team` = `TeamA`. + +The following rule criteria uses `StringNotEqualsIfExists` on the **Resource tags** attribute, with the tag key `team` and the value `TeamA`. A recommended action is included when the resource doesn't have the `team` tag at all, or when the tag is set to any value other than `TeamA`. Because many resources won't carry the tag, `IfExists` is what keeps them in scope — without it, every untagged resource would be excluded. + +Criteria configuration: + +Attribute | Operator | Tag key | Values +---|---|---|--- +Resource tags | `StringNotEqualsIfExists` | `team` | `TeamA` + +Evaluation: + +Recommended action state | Result | Explanation +---|---|--- +The resource does not have the `team` tag | Match | The attribute is absent, and `IfExists` evaluates absent attributes as true. +The resource has tag `team` = `web` | Match | The tag is present and the value does not match `TeamA`. +The resource has tag `team` = `TeamA` | No match | The tag is present and the value matches `TeamA`, so the recommended action is excluded. + +**Example: Include recommended actions unless the resource has an opt-out tag** + +You can let resource owners exclude individual resources from automation by applying a dedicated opt-out tag. In this example, an owner adds the `automation-opt-out` tag to any resource they want to leave out. + +The following rule criteria uses `StringNotLikeIfExists` on the **Resource tags** attribute, with the tag key `automation-opt-out` and the value `*`. The `*` wildcard matches any value, so any resource that carries the tag is excluded. A recommended action is included when the resource doesn't have the `automation-opt-out` tag. + +Criteria configuration: + +Attribute | Operator | Tag key | Values +---|---|---|--- +Resource tags | `StringNotLikeIfExists` | `automation-opt-out` | `*` + +Evaluation: + +Recommended action state | Result | Explanation +---|---|--- +The resource does not have the `automation-opt-out` tag | Match | The attribute is absent, and `IfExists` evaluates absent attributes as true. +The resource has tag `automation-opt-out` = `true` | No match | The tag is present, and `*` matches any value, so the recommended action is excluded. +The resource has tag `automation-opt-out` = `temporary` | No match | The tag is present, and `*` matches any value, so the recommended action is excluded. + +**Example: Combine multiple criteria** + +You can combine multiple criteria to narrow the scope of your rule. All criteria must match for a recommended action to be included in the rule (AND logic). + +The following configuration automates EBS volume recommended actions that: + + 1. Are in us-east-1 and us-west-2 + + 2. Were generated with a lookback period of at least 32 days; and + + 3. Are not opted out of automation (no `automation-opt-out` tag). + + + + +This rule includes a recommended action only when all three conditions are met simultaneously. + +Criteria configuration: + +Attribute | Operator | Values +---|---|--- +AWS Region | `StringEquals` | `us-east-1`, `us-west-2` +Lookback period (days) | `NumericGreaterThanEquals` | `32` +Resource tags (key: `automation-opt-out`) | `StringNotLikeIfExists` | `*` +