OVH announced this week that new Public Cloud instances no longer include a public IPv4: the address becomes its own monthly line. AWS did the same in 2024, Azure and Oracle Cloud have billed reserved addresses for years. The number on the invoice is small, three or four dollars a month per address. The problem is not the number; it is that nobody looks at it.
An address that is attached to a VM is at least doing something. The one that costs you for nothing is the reserved address whose VM was deleted months ago: the allocation stays, the bill stays, and no alert fires because nothing is wrong. The same goes for the disk that was attached to that VM. Here is what both look like on a live map, read from the provider API with a read-only credential:
Why they survive
A VM is deleted from a console, from a pipeline, from a Terraform apply. The public IP and the boot disk were created as separate resources, sometimes by a different team, and the deletion of the VM does not touch them. They do not show up in terraform plan because they were never in that state file, and they do not show up in a cost alert because they cost the same every month.
How to find them in five minutes, without any tool
Read-only commands, one per provider, run per region, because the orphan is usually in the region the team stopped using:
- Azure:
az network public-ip list --query "[?ipConfiguration==null].[name,resourceGroup,location]" -o table, andaz disk list --query "[?diskState=='Unattached'].[name,diskSizeGb,resourceGroup]" -o table - Oracle Cloud:
oci network public-ip list --scope REGION --lifetime RESERVED --compartment-id $Cand keep the rows with noassigned-entity-id;oci bv volume list --compartment-id $Cagainstoci compute volume-attachment list - AWS:
aws ec2 describe-addresses --query "Addresses[?AssociationId==null]"andaws ec2 describe-volumes --filters Name=status,Values=available
Then put the list in a spreadsheet, delete what nobody claims, and run it again next month, because the spreadsheet is stale the day after you make it.
What Control Cloud does with the same question
It asks it every time it reads the account. In the clip above, the alerts page lists what bills for nothing: proven orphans and disks of stopped VMs, with size, attach state and tier. On the map, every disk hangs from the VM that mounts it, so a disk with no edge, or an address in orange with no VM behind it, stands out before you read a single row. The credential is read-only; nothing is deleted on your behalf.
Full 60-second demo · Video guides
Request access
Solo plan is free: 1 operator, 1 provider, no card. Team comes with a 7-day trial.
One concrete thing, if you have a minute: run the first command for your least-used region and reply with the count. I will post ours from the demo organization in the comments.
Top comments (1)
Ours, as promised, from the demo organization in the clip: 4 proven orphans (the public IP in orange on the Azure map is one of them, held by a NIC whose VM is gone) and 5 disks of stopped VMs. "Proven" is the operative word: an address or disk the read could not verify, because of a permission or a region that did not answer, is reported as unknown and never counted as a saving. Releasing an IP that was still in a DNS record costs more than paying for it one more month.