AWS Orphans: EBS, Snapshots, Elastic IPs, Keys and Secrets
The proof behind each AWS orphan finding, and how much of the cleanup ZopNight is allowed to run for you.
AWS makes it easy to leave things behind. Terminating an instance can leave its volumes; deleting a volume leaves its snapshots; releasing an application leaves its Elastic IP, its secrets and its KMS key. ZopNight’s AWS orphan rules look for these, but each rule has to prove its case from a control-plane field or measured activity, and the cleanup mode depends on how strong that proof is.
The AWS orphan rules, by proof and cleanup mode
| Rule | What proves it | Cleanup |
|---|---|---|
| Orphaned EBS Volume | Volume status available, not Kubernetes-managed, at least 7 days old (no true detach time yet) | Advisory |
| Orphaned EBS Snapshot | Source volume provably gone and no AMI of yours references it | Guided |
| Unassociated Elastic IP | Unassociated for 7 days, derived from CloudTrail activity | Evidence-backed delete |
| Unused KMS Key | Customer-managed, enabled, zero aliases, no crypto requests | Guided |
| Unused Secrets Manager Secret | A real last-access signal showing non-use | Guided |
| CloudWatch Dashboard Review | Last viewed 45 or more days ago, with a real billed cost | Guided |
| ECR Unused Images (Not Pulled) | Images not pulled, keyed on last pull time rather than tag status | Prune images, repository stays |
| S3 Incomplete Multipart Uploads Accumulating | No abort rule and a measured count of incomplete uploads | Add a lifecycle rule |
Other AWS orphan rules cover unused internet gateways, inactive VPC peering connections, WAF web ACLs with nothing associated, idle CodeCommit repositories and orphaned Bedrock custom models, all as guided deletes.
Why the EBS volume stays advisory
The auto-delete path for block storage requires a real “detached since” time held for at least seven days. For EBS, ZopNight’s dwell gate currently keys on the volume’s creation time, so an old volume detached a moment ago could still pass. Until a true last-detach signal is captured, the finding stays advisory and a person decides. The Orphaned EBS Snapshot rule ships as guided for a related reason: snapshot deletion is irreversible, so it always gets a type-to-confirm review.
Stopped instances are not orphans here
An instance stopped for 30 days with volumes still attached is handled by Idle EC2 Instance, which prices the residual storage and Elastic IP. See AWS idle findings.
Where to go next
Fact sheets for the resources above: EBS volume, EBS snapshot, Elastic IP, KMS key, ECR. The cleanup workflow is on orphan cleanup, the storage angle on AWS EBS, and every AWS rule is listed in AWS recommendations. Deletes need a read + write account and pass an admin approval step when started by a non-admin.