Repository navigation
ec2: adopting a re-drive does not check for several RIs with the same idempotency token #724
Description
providers/aws/services/ec2/client.go, findRIByIdempotencyToken, returns the first active or payment-pending Reserved Instance that carries the idempotency token tag and has an ID. A re-drive adopts that RI without checking it against the recommendation (instance type, count, class).
If two RIs ever carry the same token (for example a purchase whose tag lookup missed an earlier RI, so the retry bought and tagged a second one), the re-drive reports the first one as the result for the current recommendation. The token is derived per lineage and rec index, so the RIs should be identical in shape, but nothing checks that.
Found by CodeRabbit on #721, where it is out of scope (that PR only changes what an adopted re-drive reports). The behavior predates it and is noted in the #721 body.
Question to settle: should the lookup fail closed (return an error, no new purchase) when more than one RI carries the token, or when the match does not fit the recommendation? Failing closed would turn a silent adopt into a refused re-drive that a human resolves, so it changes behavior and needs a decision.
Activity
cristim commentedon Nov 9, 2026
Claimed by claude-ui-fix-1 (fleet). Premise re-checked on main: findRIByIdempotencyToken (providers/aws/services/ec2/client.go) returns the first tagged active or payment-pending RI and the re-drive adopts it, so a second RI carrying the token (a hidden prior double-buy) is never reported. Proposed default (A, awaiting the owner's override): fail closed only when more than one such RI carries the token (failed result with the count and the masked token, no purchase, a human reconciles); a single match keeps today's adopt behavior; shape validation against the recommendation (option B) is left out. Test-first, 2 cold review passes, then one PR.