retirement-radar 0.1.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Het Patel
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,91 @@
+<p align="center"><img src="https://raw.githubusercontent.com/Het101/retirement-radar/main/docs/banner.png" alt="Retirement Radar: find AWS resources before end of support costs you money" width="100%"></p>
+
+<p align="center">
+  <a href="https://www.npmjs.com/package/retirement-radar"><img src="https://img.shields.io/npm/v/retirement-radar?color=E5484D&label=npm" alt="npm version"></a>
+  <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT-3f4756" alt="MIT license"></a>
+  <img src="https://img.shields.io/badge/AWS-read--only-3f4756" alt="Read-only">
+</p>
+
+# Retirement Radar
+
+Find what in your AWS account is about to lose support before it starts costing you money or gets force-upgraded.
+
+```bash
+npx retirement-radar scan
+```
+
+<img src="https://raw.githubusercontent.com/Het101/retirement-radar/main/docs/scan-output.png" alt="Example output: a table of resources with status RETIRED, EXTENDED, SOON or UPCOMING, the end-of-support date and what it means, plus the monthly EKS extended support cost" width="100%">
+
+<sub>Example output with sample data.</sub>
+
+## What it checks
+
+| Service | What | Why it matters |
+|---|---|---|
+| EKS | Kubernetes version per cluster | After standard support, clusters move to extended support at 6x the control-plane price, then get force-upgraded |
+| RDS / Aurora | Engine major version (PostgreSQL, MySQL, Aurora) | After standard support, RDS bills Extended Support per vCPU-hour automatically |
+| Lambda | Function runtime | Deprecated runtimes get no security patches, then can't be created or updated |
+
+Dates live in [`retirements.yaml`](retirements.yaml), each section with its AWS source link. A version that isn't listed shows as `unknown`, never as fine.
+
+## Run it
+
+You need Node 18+ and the [AWS CLI v2](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html), signed in (`aws configure`, `aws sso login`, or an assumed role). Retirement Radar uses your AWS CLI, so profiles, SSO and roles just work.
+
+```bash
+npx retirement-radar scan
+```
+
+| Option | |
+|---|---|
+| `--region eu-west-1,us-east-1` | Only these regions (default: every enabled region) |
+| `--profile prod` | AWS CLI profile |
+| `--json` | Machine-readable output |
+| `--all` | Also list resources with more than a year left |
+| `--fail-on soon` | Exit 1 if anything is `retired`, `extended` or `soon` (levels: `retired`, `extended`, `soon`, `upcoming`) |
+| `--data my.yaml` | Use your own dates file |
+
+## Safe by design
+
+- **Read-only.** It only calls `sts get-caller-identity`, `ec2 describe-regions`, `eks list-clusters` / `describe-cluster`, `rds describe-db-instances` / `describe-db-clusters` and `lambda list-functions`.
+- **Local.** Nothing is sent anywhere; no telemetry.
+- A region or service you can't read becomes a warning, not a failed scan.
+
+Minimal IAM policy:
+
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [{
+    "Effect": "Allow",
+    "Action": ["ec2:DescribeRegions", "eks:ListClusters", "eks:DescribeCluster",
+               "rds:DescribeDBInstances", "rds:DescribeDBClusters", "lambda:ListFunctions"],
+    "Resource": "*"
+  }]
+}
+```
+
+## In CI
+
+```yaml
+# .github/workflows/retirement-radar.yml - weekly, fails when something needs action within 90 days
+on: { schedule: [{ cron: "0 8 * * 1" }], workflow_dispatch: {} }
+permissions: { id-token: write, contents: read }
+jobs:
+  scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: aws-actions/configure-aws-credentials@v4
+        with: { role-to-assume: arn:aws:iam::123456789012:role/retirement-radar, aws-region: us-east-1 }
+      - run: npx retirement-radar scan --fail-on soon
+```
+
+## Contributing dates
+
+Found a wrong or missing date? Edit `retirements.yaml`, include the AWS source link in the PR, and run `npm test`.
+
+## Roadmap
+
+Azure and GCP retirements, ElastiCache / OpenSearch / MSK versions, hosted weekly scans with alerts, cost per finding. Part of [HetOps](https://hetops.dev).
+
+MIT licensed.

package/package.json

@@ -0,0 +1,36 @@
+{
+  "name": "retirement-radar",
+  "version": "0.1.1",
+  "description": "Read-only scan of your AWS account for EKS, RDS and Lambda versions near end of support.",
+  "bin": {
+    "retirement-radar": "src/cli.js"
+  },
+  "files": [
+    "src",
+    "retirements.yaml"
+  ],
+  "scripts": {
+    "test": "node --test",
+    "prepublishOnly": "node --test"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "keywords": [
+    "aws",
+    "eks",
+    "rds",
+    "lambda",
+    "end-of-life",
+    "deprecation",
+    "devops"
+  ],
+  "repository": "github:Het101/retirement-radar",
+  "homepage": "https://hetops.dev",
+  "license": "MIT",
+  "dependencies": {
+    "yaml": "^2.5.0"
+  },
+  "author": "Het Patel (https://hetops.dev)",
+  "bugs": "https://github.com/Het101/retirement-radar/issues"
+}

package/retirements.yaml

@@ -0,0 +1,68 @@
+# End-of-support dates Retirement Radar checks against.
+# Every section links its source. Found a wrong or missing date? Open a PR with the source link.
+# Versions not listed here show up as "unknown", never as safe.
+updated: "2026-10-04"
+
+eks:
+  source: https://docs.aws.amazon.com/eks/latest/userguide/kubernetes-versions.html
+  # After standard support ends, clusters move to extended support automatically and cost more.
+  # After extended support ends, AWS upgrades the control plane for you.
+  cost: Extended support adds $0.50 per cluster-hour, about $365 a month per cluster.
+  monthlyCost: 365
+  versions:
+    "1.23": { standard: "2023-10-11", extended: "2024-10-11" }
+    "1.24": { standard: "2024-01-31", extended: "2025-01-31" }
+    "1.25": { standard: "2024-05-01", extended: "2025-05-01" }
+    "1.26": { standard: "2024-06-11", extended: "2025-06-11" }
+    "1.27": { standard: "2024-07-24", extended: "2025-07-24" }
+    "1.28": { standard: "2024-11-26", extended: "2025-11-26" }
+    "1.29": { standard: "2025-03-23", extended: "2026-03-23" }
+    "1.30": { standard: "2025-07-23", extended: "2026-07-23" }
+    "1.31": { standard: "2025-11-26", extended: "2026-11-26" }
+    "1.32": { standard: "2026-03-23", extended: "2027-03-23" }
+    "1.33": { standard: "2026-07-29", extended: "2027-07-29" }
+
+rds:
+  source: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/extended-support.html
+  # After standard support ends, RDS enrols the database in Extended Support and bills it per vCPU-hour.
+  cost: RDS Extended Support is billed per vCPU-hour on top of the instance price.
+  engines:
+    postgres:
+      "11": { standard: "2024-02-29" }
+      "12": { standard: "2025-02-28" }
+      "13": { standard: "2026-02-28" }
+      "14": { standard: "2027-02-28" }
+      "15": { standard: "2028-02-29" }
+      "16": { standard: "2029-02-28" }
+    mysql:
+      "5.7": { standard: "2024-02-29" }
+      "8.0": { standard: "2026-07-31" }
+    aurora-postgresql:
+      "11": { standard: "2024-02-29" }
+      "12": { standard: "2025-02-28" }
+      "13": { standard: "2026-02-28" }
+      "14": { standard: "2027-02-28" }
+      "15": { standard: "2028-02-29" }
+      "16": { standard: "2029-02-28" }
+    aurora-mysql:
+      "5.7": { standard: "2024-10-31" }
+
+lambda:
+  source: https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html
+  # Deprecated runtimes stop getting security patches; AWS then blocks creating and later updating functions.
+  runtimes:
+    nodejs14.x: "2023-12-04"
+    nodejs16.x: "2024-06-12"
+    nodejs18.x: "2025-09-01"
+    nodejs20.x: "2026-04-30"
+    python3.7: "2023-12-04"
+    python3.8: "2024-10-14"
+    python3.9: "2025-12-15"
+    ruby2.7: "2023-12-07"
+    ruby3.2: "2026-03-31"
+    java8: "2024-01-08"
+    go1.x: "2024-01-08"
+    provided: "2024-01-08"
+    dotnet6: "2024-12-20"
+    dotnet7: "2024-05-14"
+    dotnet8: "2026-11-10"

package/src/cli.js

@@ -0,0 +1,134 @@
+#!/usr/bin/env node
+// retirement-radar scan: read-only. Runs the AWS CLI you already have (your profiles, SSO, roles),
+// calls only list/describe APIs, and prints what is near end of support. Nothing is sent anywhere.
+const { execFile } = require('node:child_process');
+const { SEVERITY, loadRetirements, evaluate, sortFindings, failsAt } = require('./radar');
+
+const HELP = `Usage: retirement-radar scan [options]
+
+Options:
+  --region a,b       Regions to scan (default: every enabled region)
+  --profile name     AWS CLI profile
+  --json             Print findings as JSON
+  --all              Also list resources that are fine
+  --fail-on level    Exit 1 if anything is at this level or worse: ${SEVERITY.slice(0, 4).join(', ')}
+  --data file        Use your own retirements.yaml
+`;
+
+function parseArgs(argv) {
+  const o = { cmd: argv[0] };
+  for (let i = 1; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === '--json' || a === '--all') o[a.slice(2)] = true;
+    else if (['--region', '--profile', '--fail-on', '--data'].includes(a)) o[a.slice(2)] = argv[++i];
+    else throw new Error(`Unknown option ${a}`);
+  }
+  return o;
+}
+
+function awsRunner(profile) {
+  return (args, region) => new Promise((resolve, reject) => {
+    const full = [...args, '--output', 'json', ...(region ? ['--region', region] : []), ...(profile ? ['--profile', profile] : [])];
+    execFile('aws', full, { maxBuffer: 64 * 1024 * 1024, windowsHide: true }, (err, stdout, stderr) => {
+      if (err && err.code === 'ENOENT') return reject(new Error('AWS CLI not found. Install AWS CLI v2 and sign in (aws configure / aws sso login).'));
+      if (err) return reject(new Error((stderr || err.message).trim().split('\n').pop()));
+      try { resolve(JSON.parse(stdout || '{}')); } catch { reject(new Error('Unexpected AWS CLI output')); }
+    });
+  });
+}
+
+const DB_ENGINE = /^(aurora|mysql|postgres|mariadb|oracle|sqlserver)/;
+
+async function collectRegion(region, aws, warn) {
+  const items = [];
+  const step = async (label, fn) => { try { await fn(); } catch (e) { warn(`${region} ${label}: ${e.message}`); } };
+  await Promise.all([
+    step('EKS', async () => {
+      const { clusters = [] } = await aws(['eks', 'list-clusters'], region);
+      for (const name of clusters) {
+        const { cluster } = await aws(['eks', 'describe-cluster', '--name', name], region);
+        items.push({ service: 'EKS', region, resource: name, version: cluster.version });
+      }
+    }),
+    step('RDS', async () => {
+      const [{ DBInstances = [] }, { DBClusters = [] }] = await Promise.all([
+        aws(['rds', 'describe-db-instances'], region), aws(['rds', 'describe-db-clusters'], region)]);
+      // Cluster members share the cluster's engine version: report the cluster once.
+      for (const i of DBInstances) if (!i.DBClusterIdentifier && DB_ENGINE.test(i.Engine)) {
+        items.push({ service: 'RDS', region, resource: i.DBInstanceIdentifier, engine: i.Engine, version: i.EngineVersion });
+      }
+      for (const c of DBClusters) if (DB_ENGINE.test(c.Engine)) {
+        items.push({ service: 'RDS', region, resource: c.DBClusterIdentifier, engine: c.Engine, version: c.EngineVersion });
+      }
+    }),
+    step('Lambda', async () => {
+      const { Functions = [] } = await aws(['lambda', 'list-functions'], region);
+      for (const f of Functions) if (f.Runtime) items.push({ service: 'Lambda', region, resource: f.FunctionName, version: f.Runtime });
+    }),
+  ]);
+  return items;
+}
+
+async function scan({ regions, aws, db, now = Date.now(), warn = () => {} }) {
+  if (!regions || !regions.length) {
+    const { Regions = [] } = await aws(['ec2', 'describe-regions'], 'us-east-1');
+    regions = Regions.map((r) => r.RegionName);
+  }
+  const items = (await Promise.all(regions.map((r) => collectRegion(r, aws, warn)))).flat();
+  return sortFindings(items.map((i) => evaluate(i, db, now)));
+}
+
+// ── Output ─────────────────────────────────────────────────────
+const tty = process.stdout.isTTY && !process.env.NO_COLOR;
+const paint = (code, s) => (tty ? `\x1b[${code}m${s}\x1b[0m` : s);
+const COLOR = { retired: 31, extended: 31, soon: 33, upcoming: 36, ok: 32, unknown: 90 };
+
+function table(findings) {
+  const rows = findings.map((f) => [f.status.toUpperCase(), f.service, f.region, f.resource,
+    f.engine ? `${f.engine} ${f.version}` : f.version, f.date ? `${f.date} (${f.days < 0 ? `${-f.days}d ago` : `in ${f.days}d`})` : '-', f.note]);
+  const head = ['STATUS', 'SERVICE', 'REGION', 'RESOURCE', 'VERSION', 'DATE', 'WHAT IT MEANS'];
+  const w = head.map((h, c) => Math.max(h.length, ...rows.map((r) => String(r[c]).length)));
+  const line = (r, status) => r.map((v, c) => {
+    if (c === r.length - 1) return v;
+    const cell = String(v).padEnd(w[c]);
+    return c === 0 && status ? paint(COLOR[status], cell) : cell;
+  }).join('  ');
+  return [paint(1, line(head)), ...rows.map((r, i) => line(r, findings[i].status))].join('\n');
+}
+
+async function main(argv = process.argv.slice(2)) {
+  let o;
+  try { o = parseArgs(argv); } catch (e) { console.error(e.message + '\n\n' + HELP); return 2; }
+  if (o.cmd !== 'scan') { console.log(HELP); return o.cmd ? 2 : 0; }
+  const db = loadRetirements(o.data);
+  const warnings = [];
+  let findings;
+  const aws = awsRunner(o.profile);
+  try {
+    // Fail fast with one clear message instead of a warning per region.
+    const id = await aws(['sts', 'get-caller-identity']);
+    if (!o.json) console.log(paint(90, `Scanning AWS account ${id.Account} (read-only)...
+`));
+    findings = await scan({ regions: o.region && o.region.split(','), aws, db, warn: (w) => warnings.push(w) });
+  } catch (e) { console.error(`retirement-radar: ${e.message}`); return 2; }
+
+  if (o.json) {
+    console.log(JSON.stringify({ dataUpdated: db.updated, findings, warnings }, null, 2));
+  } else {
+    const shown = o.all ? findings : findings.filter((f) => f.status !== 'ok');
+    const count = (s) => findings.filter((f) => f.status === s).length;
+    if (shown.length) console.log(table(shown) + '\n');
+    const eksExtra = findings.reduce((n, f) => n + (f.monthlyCost || 0), 0);
+    const tally = SEVERITY.map((s) => count(s) && `${count(s)} ${s}`).filter(Boolean).join(', ');
+    console.log(`${findings.length} resources scanned${tally ? `: ${tally}` : ''}.`);
+    if (eksExtra) console.log(paint(31, `EKS extended support is costing about $${eksExtra.toLocaleString()} a month.`));
+    if (count('unknown')) console.log(paint(90, 'Unknown = version not in retirements.yaml yet. PRs with a source link welcome.'));
+    if (!o.all && count('ok')) console.log(paint(90, `${count('ok')} fine (more than a year left); --all lists them.`));
+    console.log(paint(90, `Dates updated ${db.updated}. Sources: ${[db.eks.source, db.rds.source, db.lambda.source].join(' ')}`));
+    for (const w of warnings) console.error(paint(33, `warning: ${w}`));
+  }
+  return o['fail-on'] && failsAt(findings, o['fail-on']) ? 1 : 0;
+}
+
+if (require.main === module) main().then((code) => { process.exitCode = code; });
+module.exports = { main, scan, parseArgs, table };

package/src/radar.js

@@ -0,0 +1,68 @@
+// Match what runs in an AWS account against retirements.yaml. Pure logic; the CLI does the I/O.
+const fs = require('node:fs');
+const path = require('node:path');
+const YAML = require('yaml');
+
+const DAY = 86400000;
+const SOON_DAYS = 90;
+const UPCOMING_DAYS = 365;
+// Worst first. "extended" = past standard support and paying for it (EKS, RDS).
+const SEVERITY = ['retired', 'extended', 'soon', 'upcoming', 'ok', 'unknown'];
+
+function loadRetirements(file = path.join(__dirname, '..', 'retirements.yaml')) {
+  return YAML.parse(fs.readFileSync(file, 'utf8'));
+}
+
+// "13.12" -> "13", "9.6.24" -> "9.6", "8.0.35" -> "8.0", "5.7.mysql_aurora.2.11.2" -> "5.7"
+function majorVersion(engine, version) {
+  const parts = String(version || '').split('.');
+  if (/postgres/.test(engine) && Number(parts[0]) >= 10) return parts[0];
+  return parts.slice(0, 2).join('.');
+}
+
+const daysUntil = (date, now) => Math.ceil((Date.parse(date) - now) / DAY);
+const byDays = (days) => (days <= SOON_DAYS ? 'soon' : days <= UPCOMING_DAYS ? 'upcoming' : 'ok');
+
+// item: { service: 'EKS'|'RDS'|'Lambda', region, resource, version, engine? }
+function evaluate(item, db, now = Date.now()) {
+  const f = { ...item, status: 'unknown', date: null, days: null, note: 'Version not in retirements.yaml', source: null };
+  if (item.service === 'EKS') {
+    const v = db.eks.versions[item.version];
+    f.source = db.eks.source;
+    if (!v) return f;
+    const std = daysUntil(v.standard, now);
+    const ext = daysUntil(v.extended, now);
+    if (ext < 0) return { ...f, status: 'retired', date: v.extended, days: ext, note: 'Extended support ended; AWS force-upgrades the control plane' };
+    if (std < 0) return { ...f, status: 'extended', date: v.extended, days: ext, note: `Paid extended support until this date, then AWS force-upgrades. ${db.eks.cost}`, monthlyCost: db.eks.monthlyCost };
+    return { ...f, status: byDays(std), date: v.standard, days: std, note: 'Standard support ends; extended support charges start' };
+  }
+  if (item.service === 'RDS') {
+    const major = majorVersion(item.engine, item.version);
+    const v = (db.rds.engines[item.engine] || {})[major];
+    f.source = db.rds.source;
+    if (!v) return f;
+    const std = daysUntil(v.standard, now);
+    if (std < 0) return { ...f, status: 'extended', date: v.standard, days: std, note: `Past standard support. ${db.rds.cost}` };
+    return { ...f, status: byDays(std), date: v.standard, days: std, note: 'Standard support ends; Extended Support billing starts' };
+  }
+  if (item.service === 'Lambda') {
+    const date = db.lambda.runtimes[item.version];
+    f.source = db.lambda.source;
+    if (!date) return f;
+    const d = daysUntil(date, now);
+    if (d < 0) return { ...f, status: 'retired', date, days: d, note: 'Runtime deprecated: no security patches' };
+    return { ...f, status: byDays(d), date, days: d, note: 'Runtime deprecation' };
+  }
+  return f;
+}
+
+const sortFindings = (list) => [...list].sort((a, b) =>
+  SEVERITY.indexOf(a.status) - SEVERITY.indexOf(b.status) || (a.days ?? 1e9) - (b.days ?? 1e9));
+
+// Exit non-zero in CI when anything is at or worse than `level`.
+const failsAt = (findings, level) => {
+  const max = SEVERITY.indexOf(level);
+  return max >= 0 && findings.some((f) => f.status !== 'unknown' && SEVERITY.indexOf(f.status) <= max);
+};
+
+module.exports = { SEVERITY, loadRetirements, majorVersion, evaluate, sortFindings, failsAt };