Skip to main content
orphan · aws

Orphaned EBS Snapshot

resource types
1
rule IDs covered
1
severity
low

What does ZopNight detect here?

Orphaned EBS snapshots, meaning the source volume is provably gone with no self-owned AMI referencing them, are priced at 100% of their monthly cost as deletable. ZopNight vetoes stateful and DR-backup snapshots via metadata, tags, and name tokens, and notes each snapshot is priced independently even though incremental chains share billed blocks.

Signal and threshold

How ZopNight evaluates Orphaned EBS Snapshot.
Field Value
Rule IDsRC-021
Categoryorphan
Severitylow
Metricnone — pure configuration read
Sourceorphan_snapshot.go

The orphan marker and the stateful veto

  • Metadata[“source_disk_gone”] == “true”: the authoritative orphan signal (stamped by the discoverer’s stampOrphanSnapshot when the source volume is provably gone and no self-owned AMI references the snapshot). ParentUID == "" is accepted as a transitional fallback for rows last discovered before the marker existed; post the synthetic-parent grouping release, orphans carry the marker and a synthetic “Orphaned EBS Snapshots” folder ParentUID.
  • Stateful/DR-backup veto (2026-07): uses the full-resource classifier matchesStatefulWorkload(resource), which covers Metadata engine (managed data-service engine), Metadata/Tag tier == “data”, business tags (e.g. Application Type = SAP), or a stateful name-token scan, not just a name-only scan. A snapshot whose stateful identity is only discoverable via metadata/tags (generic Name) is now also vetoed, matching the sibling stateful-gated rules (spot_adoption, graviton_migration, ebs_iops_overalloc, underutilized_ec2). Previously the veto called the name-only fallback (matchesStatefulWorkloadName(resource.Name)) even though Evaluate holds the full *model.Resource, so a generically-named DR/DB backup snapshot classified stateful only by tags/metadata was not protected from a full-delete recommendation.
  • cost basis (r.pricing[uid] > 0): abstains when pricing is unavailable

Why incremental billing over-counts this

savings = cost × 1.00 (full cost recoverable on delete) when priced; abstains otherwise. Known limitation (unchanged, tracked as a producer follow-up): EBS snapshots are incremental (a chain shares unchanged blocks and AWS bills only unique blocks), but this rule prices each snapshot independently at its full nominal cost, over-counting recoverable savings for a deleted chain of non-stateful snapshots. Correct incremental-block pricing needs an aggregator unique-block/delta-size producer that does not exist today; the stateful/DR veto above mitigates only the highest-risk DR-backup subset, not the general over-count.

Confirming no AMI references it

  1. Verify the source volume no longer exists
  2. Check if this snapshot is referenced by any AMI
  3. If orphaned and not needed, delete the snapshot
  4. Consider creating an AMI if the snapshot data is valuable

See it fire on your bill.

Connect an account read-only. The first findings land in minutes.

417 rule families across 353 resource types on 22 platforms. Every threshold, metric, and IAM action is documented on these pages before you grant anything.

417 rule families documented
353 resource types covered
read-only default access level
Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console· Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console·