CoreStack FinOps

FinOps Policies

The following cost optimization policies are added for FinOps:

Improved rightsizing optimizations using AI models for:
- AWS EC2
- AWS RDS
- Azure VM
- GCP VM
GCP Services
- Idle Checks GCP Memory Store – Memcached
- Idle Checks GCP Memory Store – Redis
- Optimize Configuration - GCP App Engine Flexible Instance – Storage Checks
- Optimize Configuration - GCP App Engine Flexible instance – CPU Checks
AWS Services
- Optimize Configuration - AWS DMS Replication Instances Storage
- Optimize Configuration - AWS FSX Filesystems Backups
- Idle checks - AWS CloudWatch Alarm
- Governance checks - AWS CloudWatch

Recommendation Logic

In cases where there are multiple recommendations available for the same resource, Schedule Recommendation will only show the top cost saving recommendation for that resource in the CoreStack portal.
- For example: If a resource has both an hourly and weekly recommendation, the recommendation that has the highest cost savings potential will be selected by the system and shown in the portal.

Optimization Actions

The list of actions performed on a recommendation, which is shown on the Optimization Actions screen, has been enhanced to show more tracked actions.

CoreStack SecOps

Enhancements have been made to the AWS threat email template.
Correction of policy mapping for NIST V5 compliance standard.
Security Posture field realignment made for AWS and Azure vulnerabilities.

Downloadable CSV Reports for Security Hub Findings

Users can apply filters on Security Hub posture and the relevant data can be downloaded as CSV.

Compliance Standards

Added the following compliance standard:

CIS Azure (2.0) - CS

SecOps Dashboard

Added two additional widgets in Security Executive Dashboard:
- Five Cloud Accounts with Least Compliant by Standard
- Top 5 Cloud Accounts with High Risk

CoreStack CloudOps

AWS backup failure and monitoring metrics have been added for: abort, created, pending, failed, and completed. Alerts will be created if they are configured through monitoring and alerts configuration.
The inventory by tag report has been enhanced to accommodate new data and graphs as per customer request. Support is now available for region-wise details of tags along with revamp of the report.
AWS Patch report is now available as an SSRS report that can be scheduled and emailed by the customer and downloaded as a PDF or excel file.

Impersonate

Impersonate service account for GCP has been added. This will allow users to perform any required operation on Terraform templates.

Terraform Templates - CI/CD Config File Management

CoreStack Automation now provides the opportunity to edit/manage the saved CI/CD configuration files on the GitHub deployment repo for provisioned resources. A user would be able to perform an edit and save the changes in the config management of provisioned resources.
After the user edits and saves these pre-existing CI/CD configuration files on the deployment repo for the provisioned resources through CoreStack, the existing Azure DevOps/ADO pipeline would sense the changes to these CI/CD config files and trigger the pipeline execution. This in turn will update the configuration setting of the resource on the target account.

Service Resource Integration

Below is the list of service resources supported:

Service Name	Metrics Added	Inventory Support	Activity Support	Relationships Support	Tagging Governance Support
Azure Backup	NumberOfBackupJobsCompleted, NumberOfBackupJobsRunning,NumberOfBackupJobsCreated,NumberOfBackupJobsPending
AWS Security Hub	No	Yes	No	No	No
Azure_Analysis_Services_Servers	MemoryUsage,qpu_metric,MemoryLimitHard,memory_metric,mashup_engine_memory_metric,mashup_engine_qpu_metric	Yes	Yes	No	Yes
AWS FSx	No	Yes	Yes	Yes	Yes
AWS Database Migration Service	CPUUtilization, WriteIOPS, ReadIOPS, MemoryAllocated, AvailableMemory, FreeStorageSpace	No	Yes	No	Yes
Azure Standard Private Endpoint	PEBytesIn,PEBytesOut	No	No	No	No
Cloud Composer	composer.googleapis.com/environment/database/cpu/utilization	No	No	No	Yes
Certificate Authority Service	privateca.googleapis.com/ca/cert/create_count, privateca.googleapis.com/ca/cert/create_request_count, privateca.googleapis.com/ca/resource_state, privateca.googleapis.com/ca/cert_expiration, privateca.googleapis.com/ca/cert_chain_expiration, privateca.googleapis.com/ca/cert_revoked, privateca.googleapis.com/ca/cert/ca_cert_creation, privateca.googleapis.com/ca/cert/create_failure_count	Yes	Yes	Yes	Yes
App Engine	appengine.googleapis.com/system/cpu/utilization appengine.googleapis.com/system/memory/usage appengine.googleapis.com/flex/cpu/utilization appengine.googleapis.com/flex/memory/usage appengine.googleapis.com/flex/connections/current appengine.googleapis.com/flex/instance/cpu/utilization appengine.googleapis.com/flex/instance/guest/memory/bytes_used appengine.googleapis.com/flex/instance/nginx/connections/current appengine.googleapis.com/flex/instance/guest/disk/bytes_used	Yes	Yes	Yes	Yes
Networking	QueryVolume, RecordSetCapacityUtilization, RecordSetCount	No	No	No	No
Dataproc Metastore	metastore.googleapis.com/service/request_count, metastore.googleapis.com/service/health	Yes	Yes	No	Yes
Cloud Key Management Service	No	Yes	Yes	No	Yes
DataFusion	No	Yes	Yes	No	Yes

Activity Swagger Mapping

Defining three level hierarchy to categorize the resources.

AWS Simple System Manager (SSM) - Email Notification Failure

The AWS Simple System Manager (SSM) feature now supports an email notification for any SSM document related failure that occurs during execution from CoreStack.
If there is a failure, the user will get a notification about the failure through email. They will receive all the details in the email and will be able to navigate to the respective execution for mitigation.

Map Configuration Item from CMDB in Incident Ticket

When a new threshold alert incident is created in ServiceNow, it will be mapped with a right CMDB configuration item automatically.

CMDB Table Reference

Configuration item as an inventory attribute is added for all the inventory resource positioning by default and is visible as False.

CoreStack Core

User Delegation

Rules are created to perform user delegation.
Rules help to delegate a particular tenant-role(s)/user(s)/user groups from a source account master to a target account master.
A rule can be modified, deleted, and viewed anytime.

Accessing and Switching Account Masters

An Admin user having access to multiple account masters can use a new drop-down option next to the Tenant selection drop-down to select an account master. By using the account master drop-down, Admin users can switch from one account master to another one.

Policy Engine Support for Azure

The CoreStack policy engine option has been added for Azure cloud accounts (in addition to AWS).

CoreStack Assessments

Auto-Assessment Completion

Auto-assessment has been introduced in CoreStack Assessments through which:

Automated workload gets created for onboarded cloud accounts in bundles CoreStack Assessments and Cumulus Plus.
Upon inventory sync, assessment gets triggered based on pre-defined well-architected framework, that is, AWS-WAF for AWS account, Azure-WAF for Azure accounts, and so on.
After assessment scanning is complete, an email is sent with the assessment report in PDF format.
The user can edit/update both automated workloads and assessments and can use manually created ones.

Frameworks

AWS Well Architected Framework: Updated to latest available version from AWS (April 2023).

Bulk Action for Workloads

Added the bulk action to change workload state (active/inactive) and workload owner name.

Bugs Fixed

Tagging Governance: Bulk remediation is now provided with the progress monitor so users can know the status in real time.
For Tagging Governance, the baseline enabled at the cloud account scope was showing in other cloud accounts as well. This has been fixed.
Template execution failed due to the frequent STS token expiry. The timeout value has been increased to 24 hours to allow smooth execution of the templates.
Executive Dashboard: The default edit permission was not working and has been fixed.
Users who were using Azure AD Single Sign-On were not able to access the CoreStack portal. This has been fixed.
Bugs related to FinOps reports, including the generation of these reports, have been addressed.
Customers who have configured the white-labelled SMTP address were not able to send emails after the last major product release. This has been addressed.
CoreStack External API: Changes in the parameters resulted in an error while fetching the data through the CoreStack external API. The correct parameter details have been updated in the API notes.
Incorrect parameters resulted in the wrong recommendations showing in the AWS EFS Orphan policy. This is now fixed.

External APIs

To see the external APIs which are added, modified, and removed in this release, refer to: https://docs.corestack.io/docs/external-apis-42-2305
To see all the available external APIs, refer to: https://docs.corestack.io/reference/authtoken

Known Issues

Below APIs are not working as expected. We will try to fix it before the next release.

/operations/anomaly_detector/activity_insights/{tenant_id}/list_category
/operations/anomaly_detector/activity_insights/{tenant_id}/list_user