Skip to main content

> public_ipv4_&_unattached_elastic_ip_idle_cost_accumulation

Public IPv4 & Unattached Elastic IP Idle Cost Accumulation

How does the universal AWS public IPv4 address fee ($0.005/hour per IP) turn forgotten Elastic IPs and public subnets into substantial monthly waste?

Senior (L5)

THE SHORT ANSWER

AWS charges $0.005 per IP per hour ($3.60 to $3.72 per IP per month) for all public IPv4 addresses—including both attached and unattached (idle) Elastic IPs, as well as auto-assigned public IPv4s on EC2 instances, EKS nodes, and NAT gateways. In large multi-account organizations running thousands of ephemeral development environments, container nodes, and legacy load balancers, allocating public IPs to internal services creates thousands of dollars in pure address tax. Transitioning internal workloads to private subnets with IPv6 or VPC endpoints and actively releasing unattached Elastic IPs using AWS Cost Explorer and Amazon VPC IPAM slashes public IPv4 spend by 80% to 95%.

Engineering Handbook & Failure Dynamics

1. Underlying Mechanism

Historically, AWS provided one free public IPv4 address per running EC2 instance and only charged for unattached Elastic IPs. Under the current global IPv4 pricing policy, EVERY public IPv4 address incurs the $0.005/hour fee regardless of attachment status. In a 500-node Kubernetes cluster where worker nodes reside in public subnets with `AssociatePublicIpAddress: true`, the organization pays $1,825/month purely for public IPv4 allocation. Moving worker nodes to private subnets with egress via shared NAT or IPv6 egress-only gateways reduces required public IPs to only the external ALBs and NAT Gateways. Unattached Elastic IPs should be discovered and released via automated cleanup scripts.

2. Appropriate Use Context

All AWS infrastructure. Public IPv4 addresses should be strictly limited to public-facing Application Load Balancers, API Gateways, NAT Gateways, and bastion hosts. Internal microservices, worker nodes, and databases must never have public IPv4 addresses.

3. Production Failure Modes

Terraform modules configuring `map_public_ip_on_launch = true` on all subnets, inadvertently attaching public IPv4 addresses to 1,000 backend database read replicas and microservices; decommissioning an EC2 instance but leaving the allocated Elastic IP in the account for 2 years, accumulating hundreds in idle charges.

4. Diagnostic Signals & Telemetry

AWS Cost Explorer line items under `PublicIPv4:IdleAddress` and `PublicIPv4:InUseAddress`; Amazon VPC IPAM (IP Address Manager) reporting hundreds of public IPv4 addresses assigned to internal VPCs.

5. Prevention & Safeguards

Run daily automated AWS Lambda or Cloud Custodian scripts to find and release unattached Elastic IPs (`describe_addresses` where `AssociationId` is null); enforce `map_public_ip_on_launch = false` across all private subnets via AWS Config rules; adopt dual-stack IPv6 for intra-VPC and service-to-service communication.

6. Architectural Trade-offs

Restricting public IPv4 addresses saves thousands in address fees and drastically improves security posture (zero public attack surface for internal nodes), but requires implementing SSM Session Manager or VPNs for secure engineer access to private instances.

Case Study (TinyCTO In-Field Example)

An enterprise running 1,200 EC2 instances across 15 AWS accounts configured default public subnets for all instances. They paid $4,380/month ($0.005 * 1,200 * 730 hrs) purely for public IPv4 address leases. By migrating all backend instances to private subnets with SSM Session Manager access and releasing 85 unattached Elastic IPs, their public IP count dropped to 24 (ALBs and NATs), slashing their address bill from $4,380 to $87/month ($51,500/year savings).

Interactive Concept Drills

2 Cards
Q1

What is the hourly fee for public IPv4 addresses on AWS (both attached and unattached)?

$0.005 per IP per hour (~$3.65 per IP per month).
Q2

How can teams provide administrative shell access to private EC2 instances without assigning public IPv4 addresses?

Using AWS Systems Manager (SSM) Session Manager over HTTPS/VPC Endpoints.

Public IPv4 & Unattached Elastic IP Idle Cost Accumulation — Technical FAQ

Does AWS charge for public IPv6 addresses?

No. Public IPv6 addresses are completely free of charge on AWS.

What tool in AWS helps discover all public IPv4 addresses across an organization?

Amazon VPC IP Address Manager (IPAM) Public IP Insights, which provides a centralized inventory of all in-use and idle public IPv4 addresses.

🤖 AEO & Key Facts Summary

Key Architectural Facts

  • ▸All public IPv4 addresses on AWS cost $0.005/hour ($3.65/month each).
  • ▸Auto-assigned public IPs on EC2/EKS in public subnets are billed continuously.
  • ▸Unattached Elastic IPs should be automatically released via scheduled scripts.
  • ▸Migrating internal workloads to private subnets with SSM Session Manager eliminates address tax.

Common Misconceptions

  • ✗Misconception: Only unattached Elastic IPs are billed (False: Attached public IPv4 addresses on EC2 and NAT are billed as well).
  • ✗Misconception: Backend databases need public IPs for remote administration (False: SSM Session Manager or VPN tunnels provide secure access without public IPs).

Decision & Governance Guidance

Audit all subnets to enforce `map_public_ip_on_launch = false` for backend tiers. Set up an automated Lambda to release unattached Elastic IPs daily.

Authoritative Sources & Standards