Internet gateways detached from every VPC
What does ZopNight detect here?
Detached internet gateways cost nothing (AWS has no IGW charge at all), so ZopNight reports them at $0 with a concrete delete action rather than inventing a saving. Each account also has a default quota of 5 IGWs per region, and detached ones consume it while providing nothing.
Signal and threshold
| Field | Value |
|---|---|
| Rule IDs | RC-161 |
| Category | orphan |
| Severity | low |
| Metric | none — pure configuration read |
| Source | vpc_unused_igw.go |
Where it applies
Free, and flagged anyway
An internet gateway carries no charge attached or detached: the VPC price list has no internet gateway line anywhere in AWS billing. An earlier version of this rule multiplied a pricing lookup that was always zero and shipped $0 “savings” under a cost category. The current version stops pretending: the finding is advisory, the dollar is explicitly nothing, and the action is simply to delete an object that serves no purpose. Not every worthwhile cleanup has an invoice attached.
What a detached IGW actually costs you
Three non-monetary things. Quota: the default limit is 5 internet gateways per region, and a graveyard of detached ones can block the next real VPC build with a confusing limit error. Audit noise: an IGW in the account reads as “internet egress exists here” to every scanner and reviewer until they check the attachment, so each detached one is a false lead in security reviews. And intent ambiguity: nobody can tell whether it was meant to be reattached, which is how they survive years of cleanups.
The detection is attachment state, nothing more
Discovery stamps a boolean when the gateway has no live VPC attachment; the rule fires only on that confirmed detached state. Attached gateways never fire, and neither do gateways whose state could not be read. There is no traffic analysis here because none is needed: a detached IGW cannot carry traffic by construction, which makes this one of the few findings in the directory that is provable from configuration alone.
Find them in one query
aws ec2 describe-internet-gateways \ --query 'InternetGateways[?Attachments==`[]`].InternetGatewayId' --output tableDeleting, and the one thing to check first
Deletion is a single console or CLI action with no waiting period and no dependency teardown, since the gateway is already attached to nothing. The only worthwhile pre-check is history: if the IGW was recently detached during an incident or a migration, confirm the detachment was intended as permanent, then delete. Any route tables that once pointed at it belong to VPCs it no longer touches, so sweep those separately when you next audit the VPC itself.