Elastic IP is associated with an instance or interface

Check ID: ec2_elastic_ip_unassigned
Provider: AWS
Service: ec2
Severity: LOW
Categories: internet-exposed
Resource type: AwsEc2Eip

What this check verifies

EC2 Elastic IPs that are allocated but not associated with any instance or network interface. The evaluation identifies EIPs present in the account without an active association.

Risk

Unused Elastic IPs consume public IPv4 capacity and incur ongoing charges. Hoarded addresses can exhaust quotas, blocking new allocations and delaying deployments (availability). Lack of ownership tracking increases operational drift and misconfigurations, risking unintended exposure when later reassigned.

Recommendation

Release unused Elastic IPs or promptly associate them only where required. Enforce least privilege for address allocation, apply tagging to track ownership, and schedule periodic audits. Prefer private networking or managed front ends to reduce public IPv4 use. Automate reclaiming of unassociated addresses in lifecycle policies.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws ec2 release-address —allocation-id <ALLOCATION_ID>

# Associate an existing unassigned Elastic IP to an instance
resource "aws_eip_association" "<example_resource_name>" {
  allocation_id = "<example_allocation_id>"  # Critical: target unassigned EIP
  instance_id   = "<example_instance_id>"     # Critical: attach EIP to this instance to pass the check
}

# Associate an existing unassigned Elastic IP to an instance
Resources:
  <example_resource_name>:
    Type: AWS::EC2::EIPAssociation
    Properties:
      AllocationId: <example_allocation_id>  # Critical: selects the unassigned EIP to associate
      InstanceId: <example_instance_id>      # Critical: associates the EIP to this instance, fixing the finding

References

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/elastic-ip-addresses-eip.html

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ec2_elastic_ip_unassigned. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires