AWS Unassociated Elastic IP Detector
Identify unassociated public IPv4 addresses incurring AWS scarcity surcharges across dev, staging, and production accounts.
1. Detection Scope & Operational Boundaries
Every ArthaOps detector enforces strict epistemic honesty. We clearly separate what can be mathematically proven via agentless telemetry from what requires contextual human judgement.
What This Detector Identifies
- Allocated Elastic IP addresses in an Amazon VPC with no active AssociationId or InstanceId.
- Static public IPv4 addresses retained after the deletion of temporary NAT Gateways, VPN endpoints, or load balancers.
- Unassociated addresses that have remained idle for $\ge 24$ hours.
What It Cannot Establish Alone
- Whether the IP is allowlisted on external payment gateway firewalls, banking partners, or vendor webhooks where release would break ingress.
- Whether external DNS records (Route 53 or third-party registrars) still point an A-record to the IP.
- Whether the address was acquired through Bring Your Own IP (BYOIP) pools.
2. Telemetry & Evidence Requirements
ArthaOps operates strictly via Plane 1 (Read-Only Discovery). The following CloudFormation / IAM permissions and CloudWatch metrics are evaluated:
AWS::EC2::EIPVerification Protocol: Tested against simulated EC2 address allocations with AssociationId == null and InstanceId == null.
Validation Context: Validated in production AWS accounts uncovering forgotten public IPv4 addresses left over from terminated load balancers.
3. Reproducible AWS CLI Verification Recipe
Query Amazon EC2 for Elastic IP addresses that have no active network association.
# List unassociated Elastic IPs in ap-south-1
aws ec2 describe-addresses \
--region ap-south-1 \
--query "Addresses[?AssociationId==null].{AllocationId:AllocationId,PublicIp:PublicIp,Domain:Domain}" \
--output table-----------------------------------------------------------------
| DescribeAddresses |
+--------------------------+------------------+-----------------+
| AllocationId | Domain | PublicIp |
+--------------------------+------------------+-----------------+
| eipalloc-0a1b2c3d4e5f678 | vpc | 13.235.101.45 |
| eipalloc-0987654321fedcb | vpc | 15.207.88.19 |
+--------------------------+------------------+-----------------+💡 Any Elastic IP with `AssociationId == null` is currently attached to zero AWS network interfaces and incurs continuous hourly billing.
4. Transparent Economic Model
- 730 billable hours per standard calendar month.
- Universal IPv4 rate applies equally to attached and unattached public IPv4 addresses since February 1, 2024.
- Teams with 15 forgotten unassociated EIPs accumulate ₹4,599/mo in pure idle overhead.
- Addresses in customer-owned BYOIP IPv4 ranges do not accrue AWS hourly public IPv4 fees.
5. False-Positive Scenarios & Operational Risks
Never delete or terminate cloud resources blindly. These validated architectural scenarios must be reviewed before initiating remediation:
Documented False-Positive Scenarios
- Whitelisted Partner Endpoints: An Elastic IP previously reserved for NPCI, Razorpay, or bank webhook callbacks may be temporarily unattached during instance migration.
- Disaster Recovery Warm Standby: Reserved IP addresses intended to be mapped rapidly to standby load balancers during catastrophic regional disruptions.
Blast Radius & Remediation Risks
- Irreversible Release Invariant: Once an Elastic IP from the Amazon public pool is released, it is immediately returned to AWS and cannot be recovered. If external DNS or firewalls still reference it, communications will permanently fail.
6. Remediation Procedure & Rollback Runbook
Follow this ordered sequence of verified AWS CLI actions to remediate the resource with complete rollback availability:
Perform Reverse DNS & Hostname Check
Inspect Route 53 resource record sets to verify zero DNS dependencies.
aws route53 list-resource-record-sets --hosted-zone-id Z1234567890 --query "ResourceRecordSets[?ResourceRecords[?Value=='13.235.101.45']]" --output tableRelease the Elastic IP
Release the address back to the AWS public pool using its Allocation ID.
aws ec2 release-address --region ap-south-1 --allocation-id eipalloc-0a1b2c3d4e5f678Audit AWS CloudTrail History
Verify the release event in CloudTrail to confirm clean disallocation.
aws cloudtrail lookup-events --region ap-south-1 --lookup-attributes AttributeKey=EventName,AttributeValue=ReleaseAddress --max-results 5Forensic Rollback Procedure
Amazon-pool Elastic IPs cannot be restored once released. To mitigate risk, unattached IPs should be held in a 14-day quarantine audit before release.
🔒 ArthaOps Assurance: ArthaOps requires explicit confirmation of zero Route 53 record associations before suggesting IP release commands.
CRITICAL LIMITATION: Released Elastic IPs are immediately recycled into the public AWS pool. You cannot regain ownership of the same IP address unless provisioned via BYOIP.
How This Appears in the ArthaOps Control Plane
Elastic IP 13.235.14.88 has been unassociated from any network interface for 86 consecutive days.
Test Your Infrastructure in 180 Seconds
Explore our zero-setup interactive sample report covering real Mumbai findings, or launch a 100% read-only agentless scan across your AWS environment.