AWS Unattached EBS Volume Detector
Locate orphaned Elastic Block Store volumes detached from terminated EC2 instances silently accruing GB-month storage fees.
1. Detection Scope & Operational Boundaries
Every ArthaOps detector enforces strict epistemic honesty. We clearly separate what can be mathematically proven via agentless telemetry from what requires contextual human judgement.
What This Detector Identifies
- EBS block volumes in available status (zero attached EC2 instances) for 7 or more consecutive days.
- Orphaned gp2, gp3, io1, and io2 volumes left behind when EC2 instances were terminated without DeleteOnTermination flags enabled.
- Provisioned IOPS volumes (io1/io2) continuously billing for reserved IOPS despite having no compute attachment.
What It Cannot Establish Alone
- Whether the unattached disk contains an unmounted forensic filesystem snapshot preserved for legal compliance or incident response.
- Whether the volume is designated as a warm standby disk for an active-passive disaster recovery architecture.
- Whether a CI/CD build worker pipeline re-attaches the volume on scheduled off-peak test runs.
2. Telemetry & Evidence Requirements
ArthaOps operates strictly via Plane 1 (Read-Only Discovery). The following CloudFormation / IAM permissions and CloudWatch metrics are evaluated:
AWS::EC2::VolumeVerification Protocol: Tested with synthetic volumes created, attached, detached, and verified in available state across gp2, gp3, and io1 tiers.
Validation Context: Validated in production AWS Mumbai environments uncovering unattached disks retained after spot instance churn.
3. Reproducible AWS CLI Verification Recipe
List all EBS volumes in available status with size, volume type, and creation date.
# List unattached EBS volumes across ap-south-1
aws ec2 describe-volumes \
--region ap-south-1 \
--filters Name=status,Values=available \
--query "Volumes[*].{VolumeId:VolumeId,SizeGB:Size,Type:VolumeType,IOPS:Iops,Created:CreateTime,Encrypted:Encrypted}" \
--output table-------------------------------------------------------------------------------------
| DescribeVolumes |
+----------------------+------------+-----------+------+--------+-------------------+
| Created | Encrypted | IOPS | Size | Type | VolumeId |
+----------------------+------------+-----------+------+--------+-------------------+
| 2026-08-10T14:30:00Z | True | 3000 | 500 | gp2 | vol-0123456789abc |
+----------------------+------------+-----------+------+--------+-------------------+💡 Volumes in available state are disconnected from all compute instances. Unless intentionally retained, every GB of storage accrues full monthly EBS costs.
4. Transparent Economic Model
- Pricing reflects baseline storage capacity charges.
- gp2 to gp3 migration provides an immediate 20% price reduction even while evaluating retirement.
- Converting an unattached 500 GB volume to an EBS snapshot reduces monthly cost from ₹4,788 to ₹2,100 (56% immediate savings).
- Provisioned IOPS charges on io1/io2 ($0.065 per provisioned IOPS-month) are additional if applicable.
- EBS direct API access fees and snapshot archive egress are not included in base recurring waste.
5. False-Positive Scenarios & Operational Risks
Never delete or terminate cloud resources blindly. These validated architectural scenarios must be reviewed before initiating remediation:
Documented False-Positive Scenarios
- Forensic Evidence Preservation: Disks detached following a security compromise must be preserved indefinitely under regulatory custody.
- Static Backup Repositories: Legacy teams sometimes detach database volumes manually as an ad-hoc snapshot technique before migrations.
- Spot Fleet Interruption Re-attachment: Ephemeral spot nodes that dynamically re-attach designated state disks upon replacement launch.
Blast Radius & Remediation Risks
- Permanent Data Loss Invariant: Deleting an EBS volume is an irreversible AWS API action. Discarded blocks cannot be undeleted by AWS Support.
- Mandatory Mitigation: Never delete an unattached volume without taking an EBS point-in-time snapshot first.
6. Remediation Procedure & Rollback Runbook
Follow this ordered sequence of verified AWS CLI actions to remediate the resource with complete rollback availability:
Capture Forensic Pre-Action Snapshot
Create an immutable point-in-time snapshot with automated metadata tags documenting the source volume and deletion reason.
aws ec2 create-snapshot --region ap-south-1 --volume-id vol-0123456789abc --description "Pre-deletion snapshot by ArthaOps" --output tableVerify Snapshot Status is Completed
Wait for snapshot completion before attempting volume destruction to ensure full data durability.
aws ec2 wait snapshot-completed --region ap-south-1 --snapshot-ids snap-0987654321fedcba0Delete the Unattached Volume
Permanently delete the EBS volume now that its blocks are preserved in low-cost S3-backed snapshot storage.
aws ec2 delete-volume --region ap-south-1 --volume-id vol-0123456789abcArchive Snapshot after 30 Days (Optional)
Move the snapshot to EBS Snapshot Archive tier ($0.0125/GB-mo) for long-term compliance retention.
aws ec2 modify-snapshot-tier --snapshot-id snap-0987654321fedcba0 --storage-tier archiveForensic Rollback Procedure
To restore the volume at any time, execute `aws ec2 create-volume --region ap-south-1 --availability-zone ap-south-1a --snapshot-id snap-xxxx --volume-type gp3`. The reconstructed volume is ready for attachment within 30 seconds.
🔒 ArthaOps Assurance: ArthaOps enforces the Snapshot-First Invariant: Plane 2 remediation scripts refuse to call `ec2:DeleteVolume` without a verified `completed` snapshot state.
Deleting an EBS volume is completely irreversible without a prior snapshot. AWS Support cannot recover deleted volume blocks.
How This Appears in the ArthaOps Control Plane
1,000 GB gp2 volume unattached for 42 days following batch worker instance teardown.
Test Your Infrastructure in 180 Seconds
Explore our zero-setup interactive sample report covering real Mumbai findings, or launch a 100% read-only agentless scan across your AWS environment.