Reviewed commit: be11bdcb5. Note: origin/main moved to 3e9660d06 during the review; re-verify against current main before changing code, since a finding may have been fixed or moved.

Where

• cmd/multi_service.go:531-544 - the confirmation inside processPurchaseLoop, prompted at j == 0 of each region's loop
• Called once per region from the for service ... for region ... loops at cmd/multi_service.go:363-400
• Totals shown come from CalculateTotalInstances(recs) where recs is only that region's slice (cmd/multi_service.go:533-538)
• Decline returns createCancelledResults(recs, region, cfg) for that region only (cmd/multi_service.go:542)
• SIGINT handler registered only on the non-CSV branch (cmd/multi_service.go:100-105), which is unreachable from CSV mode because runToolMultiService returns at cmd/multi_service.go:90
• Contrast, the non-CSV path: confirms once with the run-wide total and returns on decline (cmd/multi_service.go:156-163)

What

In CSV mode the purchase confirmation is prompted once per region, showing only that region's totals, and declining cancels only that region. The outer service and region loops then continue and prompt again for the next region. There is no shutdownRequested-style abort anywhere on this path, and the SIGINT handler is not installed.

So the operator never sees the number they are actually authorising, and "no" does not mean no.

Failure scenario

A CSV holds 60 RDS instances spread over 6 regions. The operator runs --input-csv ... --purchase.

They are prompted 6 separate times, each showing roughly 10 instances, and never see the 60 they are authorising in total. If they realise at prompt 3 that the file is wrong and answer "no":

• regions 1 and 2 have already been purchased,
• the tool immediately prompts for region 4 and keeps going,
• there is no way to stop the run short of SIGINT or kill, and SIGINT is not handled on this path either.

The only correct reading of the prompt sequence requires knowing that each prompt is scoped to one region, which nothing on screen says.

Fix direction

Confirm once against the full post-filter recommendation set before the service and region loops, exactly as the non-CSV path does at cmd/multi_service.go:156-163, and treat a decline as terminal for the whole run. Register the same SIGINT handler on this path so an in-flight run can be stopped between regions.

Related

• Two other findings from this review land on the same runToolFromCSV orchestration and are cheapest to fix together: the CSV path writes no audit records and skips CheckAuditLogWritable, and CSV-mode account filters run before AccountName is populated.
• CSV purchase-path: cover ActualPurchase=true and CSV-replay idempotency (followup to #1225) #1326 (CSV purchase-path test coverage for ActualPurchase=true) is why none of this is caught: every existing TestRunToolFromCSV* case is dry-run.