Unattached EBS volumes in the available state for at least 7 days

Detaching a volume does not stop the bill

Amazon EBS pricing charges volume storage by the GB you provision per month until you release it, with extra charges for IOPS and throughput above the baseline on types that support them. The detach guide is direct about it: after you detach a volume you are still charged for its storage, and you must delete it to stop the charges.

Volumes end up unattached when instances are terminated with data volumes set to be preserved, when someone detaches a disk for a quick fix, or when a test environment is torn down unevenly.

Listing unattached volumes

aws ec2 describe-volumes --filters Name=status,Values=available \
  --query 'Volumes[].[VolumeId,Size,VolumeType,CreateTime,Tags]' --output table

Look at the tags before anything else. The EBS CSI driver’s tagging docs list ebs.csi.aws.com/cluster and CSIVolumeName as tags it adds to every volume it creates; volumes like that belong to a Kubernetes cluster and should be handled through it, not the EC2 console.

Three checks before a finding

1. The volume’s state is available, meaning it is not attached to any instance.
2. It does not look Kubernetes-managed: no name starting pvc- or kubernetes-dynamic-pvc-, and no kubernetes.io/created-for/pvc/name, kubernetes.io/cluster/ or KubernetesCluster tag. Deleting a volume that backs a persistent volume claim would strand the pod that needs it.
3. When ZopNight has the volume’s creation time, the volume must be at least 7 days old, which keeps volumes still being provisioned or migrated out of the list.

Cases handled elsewhere or left out

AWS exposes no detach timestamp, so the 7 days count from creation; an old volume detached yesterday can still qualify, which is why the fix steps start with a check. A volume that backs a released Kubernetes persistent volume in a cluster whose node group has been abandoned is counted under EKS Abandoned Node Group instead, so the same cost is not reported twice. Volumes with no price are skipped.

The full volume cost comes back

saving = the volume's monthly cost (storage + provisioned IOPS + provisioned throughput)
cost after fix = 0

Removing an unattached volume

1. Check the volume’s tags and recent CloudTrail DetachVolume events to see who detached it and when.
2. Snapshot it if the data may be needed: aws ec2 create-snapshot --volume-id vol-0123456789abcdef0.
3. Delete it with aws ec2 delete-volume --volume-id vol-0123456789abcdef0.