Internet gateways not attached to any VPC
What does ZopNight detect here?
ZopNight flags an internet gateway that has no VPC attachment in `ec2:DescribeInternetGateways`. AWS does not charge for an internet gateway, so the finding is fixed at $0 per month and exists for account hygiene: a detached gateway serves no traffic and usually outlives a deleted or rebuilt VPC. Delete it after checking route tables for stale routes.
Signal and threshold
| Field | Value |
|---|---|
| Rule IDs | RC-161 |
| Category | advisory |
| Severity | low |
| Metric | none — pure configuration read |
| Threshold | no VPC attachment |
| Source | ZopNight |
| Permissions used | ec2:DescribeInternetGateways · ec2:DescribeRouteTables |
Where it applies
A detached internet gateway does nothing
An internet gateway only has a job while it is attached to a VPC and a route table points
0.0.0.0/0 at it. The internet gateway guide
states there is no charge for an internet gateway; the costs come from data transfer by instances
that use one. So a detached gateway costs nothing. It is still worth removing, because it is usually
debris from a VPC that was torn down by hand, and it clutters every audit of internet-facing paths.
Listing gateways without an attachment
A gateway with an empty Attachments list is detached:
aws ec2 describe-internet-gateways \ --query 'InternetGateways[?length(Attachments)==`0`].[InternetGatewayId,OwnerId]' \ --output tableCheck whether any route table still sends traffic to it:
aws ec2 describe-route-tables \ --filters Name=route.gateway-id,Values=igw-0123456789abcdef0 \ --query 'RouteTables[].[RouteTableId,VpcId]'The single signal ZopNight uses
The rule fires when ZopNight’s inventory records the gateway as not attached to any VPC. There is no metric and no waiting period: the attachment state is the whole test, and it is re-checked on every evaluation, so a gateway that gets attached again drops out of the results.
Attached gateways are out of scope
An attached gateway is never flagged here, even if the VPC behind it has no public subnets or no running instances. Whether an attached gateway is still needed is a design question this rule does not try to answer.
Why the estimate is always $0
With no standing charge to recover, the finding is fixed at $0 per month by design. It is not dropped for being below any savings floor, because its value is a cleaner network inventory, not money.
Deleting a detached gateway
- Confirm the gateway is not part of a VPC you plan to rebuild, and that no infrastructure-as-code stack still declares it (deleting it by hand would make that stack drift).
- Remove any stale routes that target it.
- Delete it:
aws ec2 delete-internet-gateway --internet-gateway-id igw-0123456789abcdef0.