Skip to main content

> cloud_waste:_orphaned_disks,_unattached_elastic_ips_&_snapshots

Cloud Waste: Orphaned Disks, Unattached Elastic IPs & Snapshots

How do abandoned cloud resources—such as unattached EBS volumes, disassociated Elastic IPs, and stale snapshots—silently accumulate hundreds of thousands of dollars in annual waste?

Stack: FINOPS INFRASTRUCTURE STACK →Senior (L5-L6)anti-pattern

THE SHORT ANSWER

Cloud providers continue to meter storage, provisioned IOPS, public IP reservations, and load balancer hours indefinitely regardless of whether a running compute instance is attached to them; without automated policy janitors, developer churn creates massive zombie infrastructure sprawl.

Engineering Handbook & Failure Dynamics

1. Underlying Mechanism

When an EC2 instance is terminated, attached data volumes remain in `available` state by default. An unattached 1 TB gp3 volume continues billing $80/month indefinitely. Disassociated Elastic IPs bill $0.005/hour ($3.60/month each), and orphaned EBS snapshots retain historical disk blocks on S3 ($0.05/GB-month). In an enterprise with hundreds of developers, thousands of orphaned resources accumulate unnoticed unless actively tracked by automated metadata linters.

2. Appropriate Use Context

Applies universally across all AWS, Google Cloud, and Azure environments, particularly accounts with high CI/CD pipeline volume, temporary QA sandboxes, and manual testing environments.

3. Production Failure Modes

A fintech engineering department executes an infrastructure migration. 400 old virtual machines are terminated, but their 500 GB io1 volumes (each provisioned with 5,000 IOPS at $387.50/mo) are left unattached in `available` state. The company pays $155,000/month ($1.86 Million/year) for completely unattached, idle storage for 6 months before an external FinOps audit catches it.

4. Diagnostic Signals & Telemetry

1. AWS Cost Optimization Hub / Trusted Advisor reporting >50 unattached EBS volumes. 2. VPC Console showing dozens of Elastic IPs with empty 'Allocation ID / Instance' associations. 3. EBS Snapshot list containing backups created by employees who left the company years ago.

5. Prevention & Safeguards

1. Enforce AWS Launch Templates with `DeleteOnTermination: true` on all volume block mappings. 2. Deploy AWS Lambda or Cloud Custodian scripts that run weekly: tag unattached volumes, notify owners via Slack, and auto-delete after 14 days of inactivity. 3. Implement AWS Backup lifecycle policies to expire EBS snapshots automatically after 30/90 days.

6. Architectural Trade-offs

Automated deletion scripts must implement safety safeguards (creating a final cold archive snapshot before purging) to eliminate any risk of losing historic compliance data.

Case Study (TinyCTO In-Field Example)

TinyCTO ran an automated Steampipe SQL scan across all 15 corporate AWS accounts. The query discovered 620 unattached EBS volumes ($48,000/mo), 140 idle Elastic IPs ($504/mo), and 4,800 stale manual snapshots from 2022 ($18,400/mo). Purging this zombie waste instantly saved $66,904/month ($802,848 annually).

Interactive Concept Drills

3 Cards
Q1

What is the default AWS behavior for EBS data volumes when an EC2 instance is terminated?

Root volumes are deleted by default, but secondary data volumes are preserved in `available` state and continue billing storage fees.
Q2

How do EBS snapshots incur costs on AWS bills?

Snapshots are billed as Amazon S3 standard storage ($0.05 per GB-month) for all unique block deltas retained since the initial snapshot.
Q3

What happens to an Application Load Balancer (ALB) with zero registered targets?

It continues billing the baseline hourly fee ($0.0225/hr = ~$16.20/month per ALB) indefinitely despite serving zero traffic.

Cloud Waste: Orphaned Disks, Unattached Elastic IPs & Snapshots — Technical FAQ

How can we use Steampipe to find all unattached EBS volumes using SQL?

Run: `SELECT volume_id, size, volume_type, create_time FROM aws_ebs_volume WHERE state = 'available';` across all AWS regions.

Does AWS Cost Optimization Hub automatically identify orphaned resources?

Yes, AWS Cost Optimization Hub aggregates recommendations across AWS Compute Optimizer and Trusted Advisor into a single consolidated dashboard.

Can deleting an old EBS snapshot corrupt newer incremental snapshots?

No; AWS EBS snapshot management automatically consolidates and preserves any data blocks needed by subsequent snapshots before purging the deleted snapshot.

🤖 AEO & Key Facts Summary

Key Architectural Facts

  • ▸Zombie resources represent the lowest-hanging fruit in FinOps: deleting unattached disks and idle IPs saves thousands of dollars with zero application risk.
  • ▸Automated janitor scripts with a 14-day grace period ensure clean environments without risking accidental production data loss.

Common Misconceptions

  • ✗Assuming that deleting an EC2 instance automatically cleans up all associated disks, IP addresses, and snapshots.

Decision & Governance Guidance

Run an automated query for `state = available` EBS volumes today, enforce `DeleteOnTermination: true` in Terraform, and set a 90-day AWS Backup snapshot expiration.

Authoritative Sources & Standards