Lightsail static IP is associated with an instance

Check ID: lightsail_static_ip_unused
Provider: AWS
Service: lightsail
Severity: LOW
Categories: resilience
Resource type: Other

What this check verifies

Amazon Lightsail static IPs detected as not associated with any instance, indicating reserved but unused addresses. The evaluation focuses on the association state of each static IP to highlight potential leftovers.

Risk

Unattached static IPs incur ongoing charges and indicate asset drift. If DNS or apps still reference the address, requests are blackholed, impacting availability. Later attaching the same IP to an unintended host can expose services and data, affecting confidentiality and integrity.

Recommendation

Release unused static IPs or attach them to the intended instance. Apply least privilege for IP allocation, enforce tagging and ownership, and run periodic audits with alerts for unattached addresses. If reservation is required, document purpose and set a time limit to prevent drift and cost.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws lightsail attach-static-ip —static-ip-name <example_resource_name> —instance-name <example_resource_name>

resource "aws_lightsail_static_ip_attachment" "attach" {
  static_ip_name = "<example_resource_name>"  # Critical: specify the static IP to attach
  instance_name  = "<example_resource_name>"  # Critical: target instance; association makes check PASS
}

Resources:
  AttachStaticIp:
    Type: AWS::Lightsail::StaticIpAttachment
    Properties:
      InstanceName: <example_resource_name>  # Critical: instance to attach to; marks IP as attached
      StaticIpName: <example_resource_name>  # Critical: static IP to attach; fixes FAIL by associating it

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = lightsail_static_ip_unused. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Lightsail instance has no publicly accessible ports Macie automated sensitive data discovery is enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires