Delete Unattached & Unused AWS EBS Volumes

Risk level: Medium

Rule ID: EBS-001

Identify any unattached (unused) Elastic Block Store (EBS) volumes available in your AWS account and remove them in order to lower the cost of your monthly AWS bill and reduce the risk of confidential/sensitive data leaving your premise.

This rule can help you work with the AWS Well-Architected Framework

Any Elastic Block Store volume created in your AWS account is adding charges to your monthly bill, regardless whether is being used or not. If you have EBS volumes (other than root volumes) that are unattached to an EC2 instance or have very low I/O activity, consider deleting them. Removing unattached/orphaned Elastic Block Store volumes will help you avoid unexpected charges on your AWS bill and halt access to any sensitive data available on these volumes.

Backup your data - once a volume is deleted, the data will be lost and the volume cannot be attached to an instance. Since EBS snapshots are much more cost-effective as they are stored as objects using AWS Simple Storage Service (S3) service, it is recommended to create volume snapshots before deleting them.

Audit

To determine if there are any unattached and unused EBS volumes, perform the following:

 

Using AWS Console

1. Login to the AWS Management Console.
 
2. Navigate to EC2 dashboard at https://console.aws.amazon.com/ec2/.
 
3. In the navigation panel, under Elastic Block Store, click Volumes.
 
4. To identify any unattached EBS volumes, check their status under State column:
 

 
5. If the status is in-use, the volume is currently attached and cannot be deleted. If the status is available, the volume is not attached to an EC2 instance and can be safely deleted.
 

Using AWS CLI

1. Run describe-volumes command (OSX/Linux/UNIX) via AWS CLI to determine if you have any unattached EBS volumes:

aws ec2 describe-volumes \\
--region us-east-1 \\
--filters Name=status,Values=available

 
2. The command output should return a JSON object which describes each existing unattached volume:

{
    "Volumes": [
        {
            "Attachments": [],
            "AvailabilityZone": "us-east-1d",
            "CreateTime": "2019-12-02T12:01:41.088000+00:00",
            "Encrypted": false,
            "Size": 8,
            "SnapshotId": "snap-09328b730a42039c6",
            **"State": "available",**
            "VolumeId": "vol-0b810c6c7e4a334cb",
            "Iops": 100,
            "Tags": [
                {
                    "Key": "Name",
                    "Value": "Ashish_ZF1"
                }
            ],
            "VolumeType": "gp2",
            "MultiAttachEnabled": false
        },
        {
            "Attachments": [],
            "AvailabilityZone": "us-east-1d",
            "CreateTime": "2019-12-13T04:20:57.505000+00:00",
            "Encrypted": false,
            "Size": 50,
            "SnapshotId": "snap-0415d8298c7099b66",
            **"State": "available",**
            "VolumeId": "vol-06d24eb6b77f09e70",
            "Iops": 150,
            "VolumeType": "gp2",
            "MultiAttachEnabled": false
        },
				...
        {
            "Attachments": [],
            "AvailabilityZone": "us-east-1d",
            "CreateTime": "2020-02-07T08:29:07.029000+00:00",
            "Encrypted": false,
            "Size": 80,
            "SnapshotId": "snap-0415d8298c7099b66",
            **"State": "available",**
            "VolumeId": "vol-012e179cf459c730e",
            "Iops": 240,
            "VolumeType": "gp2",
            "MultiAttachEnabled": false
        }
]

Remediation / Resolution

To remove any unused and unwanted Elastic Block Store volumes from your AWS account, you need to perform the following:

 

Using AWS Console

1. Login to the AWS Management Console.

2. Navigate to EC2 dashboard at https://console.aws.amazon.com/ec2/.

3. In the navigation panel, under Elastic Block Store, click Volumes.

4. Select your unattached volume (See Audit Section on how to find unattached volumes).

5. (Optional) Create a snapshot of your volume:

a. Click the Actions dropdown button from the EBS dashboard top menu and select Create Snapshot:

Delete Unattached EBS Volumes AWS

b. In the Create Snapshot dialog box, provide a name and a description for the volume snapshot (optional) and click Create

6. Click the Actions dropdown button from the EBS dashboard top menu and select Delete Volume:

7. In the Delete Volume dialog box, confirm the action and click Yes, Delete.

Using AWS CLI

1. Run describe-volumes command (OSX/Linux/UNIX) via AWS CLI to determine if you have any unattached EBS volumes:

aws ec2 describe-volumes \\
--region us-east-1 \\
--filters Name=status,Values=available

 
2. The command output should return a JSON object which describes each existing unattached volume:

{
    "Volumes": [
        {
            "Attachments": [],
            "AvailabilityZone": "us-east-1d",
            "CreateTime": "2019-12-02T12:01:41.088000+00:00",
            "Encrypted": false,
            "Size": 8,
            "SnapshotId": "snap-09328b730a42039c6",
            **"State": "available",**
            "VolumeId": "vol-0b810c6c7e4a334cb",
            "Iops": 100,
            "Tags": [
                {
                    "Key": "Name",
                    "Value": "Ashish_ZF1"
                }
            ],
            "VolumeType": "gp2",
            "MultiAttachEnabled": false
        },
        {
            "Attachments": [],
            "AvailabilityZone": "us-east-1d",
            "CreateTime": "2019-12-13T04:20:57.505000+00:00",
            "Encrypted": false,
            "Size": 50,
            "SnapshotId": "snap-0415d8298c7099b66",
            **"State": "available",**
            "VolumeId": "vol-06d24eb6b77f09e70",
            "Iops": 150,
            "VolumeType": "gp2",
            "MultiAttachEnabled": false
        },
				...
        {
            "Attachments": [],
            "AvailabilityZone": "us-east-1d",
            "CreateTime": "2020-02-07T08:29:07.029000+00:00",
            "Encrypted": false,
            "Size": 80,
            "SnapshotId": "snap-0415d8298c7099b66",
            **"State": "available",**
            "VolumeId": "vol-012e179cf459c730e",
            "Iops": 240,
            "VolumeType": "gp2",
            "MultiAttachEnabled": false
        }
]

 
3. Run delete-volume command (OSX/Linux/UNIX) via AWS CLI to delete any unused EBS volumes, identified in the previous step. The next example command describes an unattached volume with the ID vol-012e179cf459c730e:

aws ec2 delete-volume \\
--region us-east-1 \\
--volume-id vol-012e179cf459c730e

 
4. To make sure the selected EBS volume have been successfully removed, run again describe-volumes command (OSX/Linux/UNIX):

aws ec2 describe-volumes \\
--region us-east-1 \\
--volume-id vol-e323363d

 
5. The command output should return the InvalidVolume.NotFound error:

A client error (InvalidVolume.NotFound) occurred when calling the DescribeVolumes operation: The volume 'vol-e323363d' does not exist.

 

Still Need Help?

Come see why we are the #1 cloud management platform and why companies like Uber, Dickey’s BBQ Pit and Norwegian Cruise Line trust nOps to manage their cloud.