Elastic IPs allocated but attached to nothing
What does ZopNight detect here?
Since 2024 AWS charges for every allocated public IPv4 address, so an Elastic IP attached to nothing costs about $3.65 a month for doing nothing. ZopNight reports the full cost as recoverable. Releasing one is permanent: you cannot reclaim that address.
Signal and threshold
| Field | Value |
|---|---|
| Rule IDs | RC-016 |
| Category | orphan |
| Severity | low |
| Metric | none — pure configuration read |
| Source | idle_eip.go |
Where it applies
The charge that changed in 2024
Elastic IPs used to be free while associated with a running instance, and only billed when idle. Since February 2024 AWS charges for every in-use public IPv4 address, associated or not. The idle ones were always billable; now they are simply more visible against a larger baseline.
At roughly $3.65 per address per month, a handful is noise and a few hundred is a real line nobody has ever seen itemised.
Release is irreversible, and that matters
You cannot get a specific Elastic IP back once released. It returns to the AWS pool and may be allocated to another account within minutes.
That has practical consequences worth checking before acting:
- Firewall allowlists. If a partner or customer has allowlisted that address, releasing it breaks the integration and you cannot undo it.
- DNS records. An A record pointing at a released address will eventually point at somebody else’s infrastructure.
- Documentation and runbooks. Addresses get written down in places that are not infrastructure-as-code.
This is why the rule is rated low despite a clean, fully-recoverable saving. The dollars are
certain; the blast radius of getting it wrong is not.
Listing addresses with no AssociationId
aws ec2 describe-addresses \ --query 'Addresses[?AssociationId==null].[PublicIp,AllocationId,Tags[?Key==`Name`].Value|[0]]' \ --output tableAnything returned is allocated and attached to nothing.
Distinguishing genuinely spare from forgotten
An address held deliberately for an upcoming migration looks identical to one orphaned by a terminated instance. Tagging the intentional ones is the only durable fix. Without it, the same addresses reappear on this list every month and get re-investigated each time.