Orphaned EBS Snapshot
What does ZopNight detect here?
Orphaned EBS snapshots, meaning the source volume is provably gone with no self-owned AMI referencing them, are priced at 100% of their monthly cost as deletable. ZopNight vetoes stateful and DR-backup snapshots via metadata, tags, and name tokens, and notes each snapshot is priced independently even though incremental chains share billed blocks.
Signal and threshold
| Field | Value |
|---|---|
| Rule IDs | RC-021 |
| Category | orphan |
| Severity | low |
| Metric | none — pure configuration read |
| Source | orphan_snapshot.go |
Where it applies
The orphan marker and the stateful veto
- Metadata[“source_disk_gone”] == “true”: the authoritative orphan signal (stamped by the discoverer’s stampOrphanSnapshot when the source volume is provably gone and no self-owned AMI references the snapshot). ParentUID == "" is accepted as a transitional fallback for rows last discovered before the marker existed; post the synthetic-parent grouping release, orphans carry the marker and a synthetic “Orphaned EBS Snapshots” folder ParentUID.
- Stateful/DR-backup veto (2026-07): uses the full-resource classifier matchesStatefulWorkload(resource), which covers Metadata engine (managed data-service engine), Metadata/Tag tier == “data”, business tags (e.g. Application Type = SAP), or a stateful name-token scan, not just a name-only scan. A snapshot whose stateful identity is only discoverable via metadata/tags (generic Name) is now also vetoed, matching the sibling stateful-gated rules (spot_adoption, graviton_migration, ebs_iops_overalloc, underutilized_ec2). Previously the veto called the name-only fallback (matchesStatefulWorkloadName(resource.Name)) even though Evaluate holds the full *model.Resource, so a generically-named DR/DB backup snapshot classified stateful only by tags/metadata was not protected from a full-delete recommendation.
- cost basis (r.pricing[uid] > 0): abstains when pricing is unavailable
Why incremental billing over-counts this
savings = cost × 1.00 (full cost recoverable on delete) when priced; abstains otherwise. Known limitation (unchanged, tracked as a producer follow-up): EBS snapshots are incremental (a chain shares unchanged blocks and AWS bills only unique blocks), but this rule prices each snapshot independently at its full nominal cost, over-counting recoverable savings for a deleted chain of non-stateful snapshots. Correct incremental-block pricing needs an aggregator unique-block/delta-size producer that does not exist today; the stateful/DR veto above mitigates only the highest-risk DR-backup subset, not the general over-count.
Confirming no AMI references it
- Verify the source volume no longer exists
- Check if this snapshot is referenced by any AMI
- If orphaned and not needed, delete the snapshot
- Consider creating an AMI if the snapshot data is valuable