From 130d8cfa56540bb30554cd86c8e6c963b4d3d127 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Sun, 5 Jul 2026 09:00:26 +0000
Subject: [PATCH] Propose remediation:
 2-aws-finops-unattached-volume-vol-077beae6eaa6dfe77 (run 28735475579.1)

---
 .../finding.json                              | 32 +++++++++++++++++++
 .../preflight.sql                             |  1 +
 .../rationale.md                              |  7 ++++
 .../remediation.sql                           |  1 +
 4 files changed, 41 insertions(+)
 create mode 100644 remediations/proposed/28735475579-1/2-aws-finops-unattached-volume-vol-077beae6eaa6dfe77/finding.json
 create mode 100644 remediations/proposed/28735475579-1/2-aws-finops-unattached-volume-vol-077beae6eaa6dfe77/preflight.sql
 create mode 100644 remediations/proposed/28735475579-1/2-aws-finops-unattached-volume-vol-077beae6eaa6dfe77/rationale.md
 create mode 100644 remediations/proposed/28735475579-1/2-aws-finops-unattached-volume-vol-077beae6eaa6dfe77/remediation.sql

diff --git a/remediations/proposed/28735475579-1/2-aws-finops-unattached-volume-vol-077beae6eaa6dfe77/finding.json b/remediations/proposed/28735475579-1/2-aws-finops-unattached-volume-vol-077beae6eaa6dfe77/finding.json
new file mode 100644
index 0000000..f98ff33
--- /dev/null
+++ b/remediations/proposed/28735475579-1/2-aws-finops-unattached-volume-vol-077beae6eaa6dfe77/finding.json
@@ -0,0 +1,32 @@
+{
+  "run_id": "28735475579",
+  "target": "finops-aws",
+  "provider": "aws",
+  "check_id": "aws-finops-unattached-volume",
+  "check_file": "finops-aws/unattached-volumes.yaml",
+  "check_name": "Unattached EBS volumes",
+  "query": "SELECT volumeId, size, status, AvailabilityZone, volumeType, createTime\nFROM aws.ec2_native.volumes\nWHERE region = 'ap-southeast-2'",
+  "severity": "LOW",
+  "category": "waste",
+  "kind": null,
+  "region": "ap-southeast-2",
+  "suggested_remediation": {
+    "type": "delete",
+    "tool": "stackql",
+    "preflight_query": "SELECT volumeId FROM aws.ec2_native.volumes WHERE region = 'ap-southeast-2' AND volumeId = 'vol-077beae6eaa6dfe77' AND status = 'available'\n",
+    "sql_query": "DELETE FROM aws.ec2.volumes WHERE region = 'ap-southeast-2' AND VolumeId = 'vol-077beae6eaa6dfe77'\n",
+    "command": null,
+    "description": "Delete the unattached EBS volume (snapshot first if its data may be needed)."
+  },
+  "fields": {
+    "AvailabilityZone": "ap-southeast-2a",
+    "createTime": "2026-01-09T02:09:38.878Z",
+    "size": "1",
+    "status": "available",
+    "volumeId": "vol-077beae6eaa6dfe77",
+    "volumeType": "gp2",
+    "region": "ap-southeast-2",
+    "category": "waste",
+    "estimated_monthly_usd": 0.1
+  }
+}
diff --git a/remediations/proposed/28735475579-1/2-aws-finops-unattached-volume-vol-077beae6eaa6dfe77/preflight.sql b/remediations/proposed/28735475579-1/2-aws-finops-unattached-volume-vol-077beae6eaa6dfe77/preflight.sql
new file mode 100644
index 0000000..c7dcc4d
--- /dev/null
+++ b/remediations/proposed/28735475579-1/2-aws-finops-unattached-volume-vol-077beae6eaa6dfe77/preflight.sql
@@ -0,0 +1 @@
+SELECT volumeId FROM aws.ec2_native.volumes WHERE region = 'ap-southeast-2' AND volumeId = 'vol-077beae6eaa6dfe77' AND status = 'available'
diff --git a/remediations/proposed/28735475579-1/2-aws-finops-unattached-volume-vol-077beae6eaa6dfe77/rationale.md b/remediations/proposed/28735475579-1/2-aws-finops-unattached-volume-vol-077beae6eaa6dfe77/rationale.md
new file mode 100644
index 0000000..da304fb
--- /dev/null
+++ b/remediations/proposed/28735475579-1/2-aws-finops-unattached-volume-vol-077beae6eaa6dfe77/rationale.md
@@ -0,0 +1,7 @@
+This remediation deletes the unattached EBS volume `vol-077beae6eaa6dfe77` (1 GiB, `gp2`) in availability zone `ap-southeast-2a` of region `ap-southeast-2`. The volume is reported as `available` (i.e. not attached to any instance), and the preflight query re-confirms `status = 'available'` immediately before the `DELETE` runs, so an in-use volume will not be removed.
+
+Confidence: **high** — the finding is a deterministic FinOps waste check and the preflight guard makes the delete idempotent and safe against a race with a re-attach.
+
+Captain's call: this volume is very small (1 GiB) and was created on 2026-01-09T02:09:38.878Z (roughly six months old at time of review), which lowers the blast radius, but the finding carries **no tags or name**, so there is no signal to confirm it is not part of a real workload or a manually-detached data disk. As the remediation description notes, snapshot the volume first if its data may still be needed before approving the delete.
+
+Estimated monthly saving: **$0.1/month** (from `.fields.estimated_monthly_usd`).
diff --git a/remediations/proposed/28735475579-1/2-aws-finops-unattached-volume-vol-077beae6eaa6dfe77/remediation.sql b/remediations/proposed/28735475579-1/2-aws-finops-unattached-volume-vol-077beae6eaa6dfe77/remediation.sql
new file mode 100644
index 0000000..9efa4c0
--- /dev/null
+++ b/remediations/proposed/28735475579-1/2-aws-finops-unattached-volume-vol-077beae6eaa6dfe77/remediation.sql
@@ -0,0 +1 @@
+DELETE FROM aws.ec2.volumes WHERE region = 'ap-southeast-2' AND VolumeId = 'vol-077beae6eaa6dfe77'