Find unused AWS resources, and work out who made them

Most AWS accounts are paying for things nobody uses any more. Each one is small, so nobody chases it. Finding them is the easy half. The hard half is knowing whether they're safe to delete.

Find them in every region

The console shows one region at a time, and the forgotten things tend to be in the region nobody looks at. This lists unattached volumes in every enabled region:

for region in $(aws ec2 describe-regions --query 'Regions[].RegionName' --output text); do
  echo "$region"
  aws ec2 describe-volumes --region "$region" \
    --filters Name=status,Values=available \
    --query 'Volumes[].[VolumeId,Size,CreateTime]' --output table
done

The same pattern works for Elastic IPs that aren't attached to anything:

aws ec2 describe-addresses \
  --query 'Addresses[?AssociationId==null].[PublicIp,AllocationId]' --output table

And for log groups that never expire:

aws logs describe-log-groups \
  --query 'logGroups[?!retentionInDays].[logGroupName,storedBytes]' --output table

Cost Explorer, Trusted Advisor and Compute Optimizer will also point you at likely waste. What they won't tell you is who made something, or whether it's still needed.

Find out who made it

Deleting something because it looks unused is how outages happen. Start with tags, if you have them. If you don't, CloudTrail's event history keeps 90 days of management events in each region:

aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=ResourceName,AttributeValue=vol-0123456789abcdef0 \
  --query 'Events[].[EventName,Username,EventTime]' --output table

If the resource is in Terraform or CloudFormation, delete it there, not by hand, or it'll come back on the next apply.

Ask, then act

Send the owner a short list: what it is, what it costs a month, and a choice to fix it, keep it, or snooze it. Write the answer down, so next month nobody has to ask about the same volume again.

The full guide, with more places waste hides, is at getstrays.com/guides/find-unused-aws-resources.

Disclosure: I built Strays, a read-only tool that does this every week and asks the owners in Slack or Teams.