All cheat sheets
Cost Governancecheat sheet

Trusted Advisor — Unassociated Elastic IPs

The cleanest 'free money' finding in AWS: EIPs reserved but attached to nothing, billed ~$3.60/month each — sometimes by the hundreds. Release everything except tagged partner-allowlist/DR reserves; the per-resource cost is small enough that nobody notices the bleed.

Last reviewed: July 14, 2026

Prefer step by step? Take the guided Trusted Advisor — Unassociated Elastic IPs walkthrough — free, anonymous, interactive.Have an AI assistant? Jump to the copy-paste audit prompt at the bottom of this sheet.

TL;DR: Every Elastic IP reserved but attached to nothing bills at $0.005/hour (~$3.60/month) — trivial per-resource, which is exactly why it accumulates silently into "wait, we have 200 EIPs?" Releasing truly-unassociated EIPs is the single most fire-and-forget cost action in AWS: outside a few tagged exceptions (partner allowlists, hardcoded DNS), nothing needs an unattached EIP to stay reserved. The one caution: release is irreversible — you get an IP back, not the IP.

The numbers

  • ~$3.60/month per unassociated EIP ($0.005/hr). (As of 2024 AWS bills all EIPs — even attached ones — at this rate; releasing the unattached ones is the only fully-free move.)
  • A stopped instance's EIP still bills — the old "free if attached to a running instance" carve-out never covered stopped instances.
  • A multi-year unaudited account often holds 50–300 unassociated EIPs accumulating at 5–10/month from CI-driven churn — $2K–13K/year recovered.
  • Field examples: a SaaS onboarding bug leaked ~200 EIPs = $720/mo ($8,640/yr), cleaned in one hour + a 30-min fix; 8 EIPs from a cancelled launch released for $345/yr (new ones allocated with zero drama when the project later relaunched).

Do this

  1. List them: aws ec2 describe-addresses --query "Addresses[?AssociationId==null]" — sort/count and note the estimated savings.
  2. Triage by tag and DNS — skip anything tagged purpose=/partner=/do-not-release=true, and grep Route 53 (public and private) for any long-TTL record pointing at the address.
  3. Cross-reference IaC — any EIP not declared in Terraform/CloudFormation was allocated manually and forgotten (more deletable).
  4. Post a "releasing these Friday unless yours" list, wait 48h, then bulk-release: aws ec2 release-address --allocation-id <id> in a loop (or console multi-select).
  5. Prevent recurrence — lint IaC to fail on aws_eip without a matching aws_eip_association, pair allocate-address/release-address in scripts, and add a Config rule flagging EIPs unattached >7 days.

Gotchas

  • Release is irreversible for the specific address — it returns to AWS's regional pool within hours, so tag anything a partner firewall or long-TTL DNS record depends on and skip it.
  • NAT Gateway EIPs won't appear here (they're associated with the NAT) — the NAT itself is the far bigger cost (~$32/mo+).
  • us-east-1 re-allocation can be harder under high demand — don't release if you specifically need a us-east-1 IP within hours.
  • Cleanup without prevention is a hobby — if the same EIPs re-flag, you have a creation problem (IaC or offboarding scripts leaking), not a cleanup one.

Skip this if

  • The EIP is a real partner-allowlist or hardcoded-DNS dependency — tag it explicitly (purpose=partner-allowlist, do-not-release=true), document the relationship, and consider AWS Global Accelerator anycast IPs for more resilient static addressing.
  • Don't hoard "spare" EIPs as a backup pool — that's ~$43/yr each in pure overhead; you can allocate spares in seconds during a real incident. Same-shape cleanups: Trusted Advisor — Idle Load Balancers and the pricier cousin NAT Gateway Consolidation. Parent: Trusted Advisor Cost Optimization.

Run this audit with your AI assistant

Paste this into Claude, ChatGPT, or any agent that can run the AWS CLI with read-only credentials. It audits your account for exactly the waste this sheet describes — and changes nothing.

You are auditing an AWS account for unassociated Elastic IPs. Use the AWS
CLI with READ-ONLY credentials. Do not create, modify, or delete
anything — report findings and recommended (unapplied) fixes only.

1. Find them: aws ec2 describe-addresses --query
   "Addresses[?AssociationId==null]" — list allocation IDs, addresses,
   tags. Each unassociated EIP bills ~$0.005/hr (~$3.60/mo).
2. Keep-vs-release triage per EIP: check Tags for purpose/partner/
   do-not-release; grep Route 53 (public + private) for the address in
   long-TTL records; note any that should be preserved (partner
   allowlists, hardcoded firewall rules).
3. Root-cause for recurring findings: flag IaC aws_eip declarations
   without a matching aws_eip_association, and any provisioning script
   that allocates without a paired release (offboarding leaks).
4. Prevention: recommend a Config rule / Lambda that flags EIPs
   unassociated >7 days.

Report a table: EIP | tags | DNS refs? | keep-or-release | est. $/mo. Note
release is irreversible (can't get the SAME IP back). Change nothing.
Works with any assistant that can run shell commands.

Want the guided version?

The Trusted Advisor — Unassociated Elastic IPs walkthrough covers this topic interactively — it asks about your setup, branches to what’s relevant, and quizzes you on the tricky parts. Free and anonymous.

Start the walkthrough

More Cost Governance cheat sheets

AWS Billing Conductor

Billing Conductor restructures how a bill is allocated and presented internally — pro-forma invoices with custom rates, markups, and line items — without changing what AWS actually charges. It's an accounting tool for MSPs and complex chargeback, not a savings tool.

AWS Budget Actions

A regular budget emails you; a Budget Action does the thing for you — attach a deny-IAM policy, apply an SCP, or stop tagged EC2/RDS when a threshold breaks. The difference between an alarm and a circuit breaker, and it costs nothing extra.

AWS Budgets

The one cost-governance feature to set up first: a threshold plus a notification that pings you before the bill lands. Forecasted-80% is the single most effective alert AWS offers; first two budgets are free.

AWS Cost and Usage Reports

Cost Explorer is a dashboard; CUR is the database. Every billing line item — one resource × one hour × one usage type, hundreds of columns — dumped to S3 for Athena/QuickSight when the question doesn't fit Cost Explorer's dropdowns. Use CUR 2.0 via Data Exports.