Use the Conformity Knowledge Base AI to help improve your Cloud Posture

EBS Volumes Attached To Stopped EC2 Instances

Trend Cloud One™ – Conformity is a continuous assurance tool that provides peace of mind for your cloud infrastructure, delivering over 1000 automated best practice checks.

Risk Level: High (not acceptable risk)
Rule ID: EBS-010

Identify any AWS Elastic Block Store (EBS) volumes that are currently attached to stopped EC2 instances and remove them if the instances are no longer needed in order avoid unexpected charges on your AWS bill.

This rule resolution is part of the Conformity Security & Compliance tool for AWS.

Sustainability
Cost
optimisation
Operational
excellence

Each EBS volume created in your AWS account is adding charges to your monthly bill regardless whether is being used or not by the associated EC2 instance, therefore any forgotten and unused EBS volume represents a good candidate to reduce your monthly AWS costs and avoid accumulating unnecessary usage charges.


Audit

To identify any AWS EBS volumes currently attached to stopped EC2 instances, perform the following:

Using AWS Console

01 Sign in to AWS Management Console.

02 Navigate to EC2 dashboard at https://console.aws.amazon.com/ec2/.

03 In the left navigation panel, under Elastic Block Store, click Volumes.

04 Choose the EBS volume that you want to examine.

05 Select the Description tab from the bottom panel and click the EC2 instance identifier (ID) listed as value for the Attachment information attribute. This will redirect you to the Instances page on the EC2 dashboard.

06 On the EC2 Instances page, verify the current state of the EC2 instance associated with the selected EBS volume, available in the Instance State column. If the current state of the instance is set to stopped, the selected EBS volume is attached to a stopped AWS EC2 instance, therefore the unused EBS volume is adding charges to your AWS bill for provisioned storage.

07 Repeat steps no. 4 – 6 to determine the usage status for other Amazon EBS volumes provisioned in the current region.

08 Change the AWS region from the navigation bar and repeat the process for the other regions.

Using AWS CLI

01 Run describe-volumes command (OSX/Linux/UNIX) using custom query filters to list the IDs of the EBS volumes provisioned in the selected AWS region:

aws ec2 describe-volumes
	--region us-east-1
	--output table
	--query 'Volumes[*].VolumeId'

02 The command output should return a table with the requested EBS volume IDs:

---------------------------
|     DescribeVolumes     |
+-------------------------+
|  vol-0a73c7b9a0303c9cc  |
|  vol-0322cc4ff65dcf5f7  |
|  vol-51c790a8443fee454  |
|  vol-2a3f9009cdda37842  |
+-------------------------+

03 Execute describe-volumes command again (OSX/Linux/UNIX) using the volume ID returned at the previous step and appropriate filtering to expose the ID of the EC2 instance associated with the selected EBS volume:

aws ec2 describe-volumes
	--region us-east-1
	--volume-ids vol-0a73c7b9a0303c9cc
	--query 'Volumes[*].Attachments[*].InstanceId[]'

04 The command output should return the requested instance ID:

[
    "i-03436cd5393adcba4"
]

05 Run describe-instances command (OSX/Linux/UNIX) using the instance ID returned at the previous step as identifier and custom query filters to get the state of the EC2 instance associated with the selected EBS volume:

aws ec2 describe-instances
	--region us-east-1
	--instance-ids i-0322cc4ff65dcf5f7
	--query 'Reservations[*].Instances[*].State.Name[]'

06 The command output should return the current state of the instance:

[
    "stopped"
]

If the instance state, returned by the describe-instances command output, is set to "stopped", as shown in the example above, the selected EBS volume is attached to a stopped EC2 instance, therefore the unused AWS EBS volume will incur charges for the provisioned storage.

07 Repeat steps no. 3 – 6 to determine the usage status for other Amazon EBS volumes provisioned in the current region.

08 Change the AWS region by updating the --region command parameter value and repeat steps no. 1 - 7 to perform the entire audit process for other regions.

Option 1: If the stopped EC2 instance and the attached EBS volume(s) are no longer needed, you can safely remove them from your account to avoid accumulating unnecessary charges. To delete the necessary EC2 resources, perform the following:

Note: Backup your EBS data first - once a volume is deleted, the data will be lost and the volume cannot be attached to an EC2 instance. Since EBS snapshots are much more cost-effective because are stored as objects using AWS Simple Storage Service (S3) service, it is recommended to create volume snapshots before deleting them.

Using AWS Console

01 Sign in to AWS Management Console.

02 Navigate to EC2 dashboard at https://console.aws.amazon.com/ec2/.

03 In the left navigation panel, under Elastic Block Store, click Volumes.

04 Select the unused EBS volume that you want to delete (see Audit section Step 1 to identify the right resource).

05 Click the Actions dropdown button from the EBS dashboard top menu and select Create Snapshot.

06 In the Create Snapshot dialog box, provide a name and a short description for the snapshot then click Create to take the volume snapshot.

07 Once the volume snapshot is successfully created, select the Description tab from the bottom panel and click on the EC2 instance ID listed as value for the Attachment information attribute. This will redirect you to the Instances page on the EC2 dashboard.

08 On the EC2 Instances page, click the Actions dropdown button from the dashboard top menu, select Instance State then click Terminate to remove the stopped instance from your AWS account. In the Terminate Instances dialog box, review the instance details then click Yes, Terminate to confirm your action. The resource status should change to shutting-down and then to terminated as the removal process progress. The process will delete both the selected EC2 instance and the EBS volume attached to it.

09 Repeat steps no. 4 – 8 to remove other unused AWS EBS volumes and their stopped EC2 instances, provisioned in the current region.

10 Change the AWS region from the navigation bar and repeat the process for other regions.

Using AWS CLI

01 Run create-snapshot command (OSX/Linux/UNIX) to create a new snapshot from the unused EBS volume that you want to delete (see Audit section Step 2 to identify the right volume).

aws ec2 create-snapshot
	--region us-east-1
	--volume-id vol- 0a73c7b9a0303c9cc

02 The command output should return the new volume snapshot metadata:

{
    "Description": "",
    "Encrypted": false,
    "VolumeId": "vol- 0a73c7b9a0303c9cc",
    "State": "pending",
    "VolumeSize": 200,
    "Progress": "",
    "StartTime": "2017-10-12T19:21:34.000Z",
    "SnapshotId": "snap-cd5aefa3",
    "OwnerId": "123456789012"
}

03 Execute terminate-instances command (OSX/Linux/UNIX) using the ID of the EC2 instance that you want to remove as identifier (see Audit section Step 2 to identify the right instance) to terminate the unused (stopped) EC2 instance and its attached EBS volume:

aws ec2 terminate-instances
	--region us-east-1
	--instance-ids i-03436cd5393adcba4

04 The command output should return the terminate request metadata:

{
    "TerminatingInstances": [
        {
            "InstanceId": "i-03436cd5393adcba4",
            "CurrentState": {
                "Code": 32,
                "Name": "shutting-down"
            },
            "PreviousState": {
                "Code": 16,
                "Name": "running"
            }
        }
    ]
}

05 Repeat steps no. 1 – 4 to remove other unused AWS EBS volumes and the associated (stopped) EC2 instances, available in the current region.

06 Change the AWS region by updating the --region command parameter value and repeat steps no. 1 - 5 to perform the entire process for other regions.

Option 2: If the stopped EC2 instance will be restarted soon, the attached EBS volume(s) cannot be removed, therefore no action is required.

References

Publication date Oct 14, 2017