From e8c48c3724aa4a3c3ad0a7ff8e9e82e0d0a62d25 Mon Sep 17 00:00:00 2001 From: Anthony Manfredi Date: Thu, 16 Jul 2026 16:14:01 -0500 Subject: [PATCH] fix: AWS VM counts treat terminated instances as running and misclassify Karpenter nodes is_vm_running() counted every instance whose state was not 'stopped' as running, including 'terminated' and 'shutting-down'. DescribeInstances keeps terminated instances visible for up to ~1 hour, so accounts with high instance churn (e.g. Karpenter or Spot autoscaling) report hundreds of phantom running VMs. Only 'pending' and 'running' states now count as running. Karpenter-launched EKS nodes are tagged with eks:eks-cluster-name and karpenter.sh/* rather than the managed-nodegroup tags in EKS_TAGS, so they were counted in the VM columns instead of the Kubernetes node columns. The Karpenter tag keys are now recognized. Co-Authored-By: Claude Fable 5 --- AWS/aws_cspm_benchmark.py | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/AWS/aws_cspm_benchmark.py b/AWS/aws_cspm_benchmark.py index 4ae73be..5c8d2c2 100644 --- a/AWS/aws_cspm_benchmark.py +++ b/AWS/aws_cspm_benchmark.py @@ -683,6 +683,10 @@ class AWSHandle: "alpha.eksctl.io/nodegroup-type", "aws:eks:cluster-name", "eks:nodegroup-name", + # Karpenter-launched nodes carry these instead of the nodegroup tags above + "eks:eks-cluster-name", + "karpenter.sh/nodepool", + "karpenter.sh/provisioner-name", ] def __init__( @@ -855,7 +859,9 @@ def is_vm_kubenode(cls, vm): @classmethod def is_vm_running(cls, vm): - return vm["State"]["Name"] != "stopped" + # DescribeInstances keeps terminated instances visible for up to ~1 hour, + # so anything not actively pending/running must not count as running. + return vm["State"]["Name"] in ("pending", "running") @property def account_id(self):