Terminated instances showing up in ssm get-inventory CLI

Question

Hi all,  
  
I need to automatise run command to install and configure CW and get inventory for creating JSON files with the installed Applications.  Splunk will pull these files from S3. I have created some scripst for this using the AWS CLI but I'm facing an issue.  
When I query ssm inventory like bellow, terminated instances are still showing up on the CLI eventhough some have been terminated days ago.  
  
Example:  aws ssm get-inventory --filters '\[{"Key":"AWS:Tag.Key","Values":\["OS"],"Type":"Equal"},{"Key":"AWS:Tag.Value","Values":\["windows"],"Type":"Equal"}]'| grep -i instanceid | awk '{print $2}' | sed 's/.**"$.**$"\[^"]*$/\1/' | wc -l  
  
5  
  
I have only four running instances with those particular tags.   
  
Even ec2 describe says that it has been terminated. Bellow the terminated instance id which is still showing up in the inventory list. On the GUI I cannot see the terminated instance.  
  
 aws ec2 describe-instances --instance-ids i-06122dfe502f15968  
{  
    "Reservations": \[  
        {  
            "Instances": \[  
                {  
                    "Monitoring": {  
                        "State": "disabled"  
                    },  
                    "StateReason": {  
                        "Message": "Client.UserInitiatedShutdown: User initiated shutdown",  
                        "Code": "Client.UserInitiatedShutdown"  
                    },  
                    "PublicDnsName": "",  
                    "Platform": "windows",  
                    "State": {  
                        "Code": 48,  
                        "Name": "terminated"  
...  
  
Can you guys help me with this. How can I remove them or when will AWS remove?  
  
Thanks  
  
Norbert  
  
Edited by: NorbertS on Jun 17, 2021 11:51 AM

NorbertS · Answer

I think I found a solution to query the inventory without listing the terminated instances IDs.  
Bellow is my one liner.  
aws ssm get-inventory --filters '\[{"Key":"AWS:Tag.Key","Values":\["OS"],"Type":"Equal"},{"Key":"AWS:Tag.Value","Values":\["windows"],"Type":"Equal"},{"Key":"AWS:InstanceInformation.InstanceStatus","Values":\["terminated"],"Type":"NotEqual"}]'| grep -i instanceid | awk '{print $2}' | sed 's/.**"$.**$"\[^"]*$/\1/'  
  
Now it is only showing the running instances.  
  
Cheers  
  
Norbert

Terminated instances showing up in ssm get-inventory CLI

Add your answer

Relevant content