Unattached EBS volumes: how to find them and delete them safely

Terminate a server and its disks should go with it. Often they don’t. The volume stays in your account, attached to nothing, and AWS bills it every month until someone notices.

01How much does an unattached EBS volume cost?

An unattached volume shows the state available. AWS bills EBS for the storage you provisioned, not the data on it, until you delete the volume. Here is a 500 GB volume at us-east-1 list prices:

Extra performance keeps billing too. A gp3 volume includes 3,000 IOPS for free, and every IOPS provisioned above that adds $0.005 a month, attached or not. io1 and io2 volumes also bill for their provisioned IOPS.

02Why do unattached EBS volumes pile up?

Because of a setting called DeleteOnTermination. Its default depends on how the volume was attached:

So the common story: someone launches a server in the console with an extra data disk, the project ends, the server is terminated, and the data disk stays behind. Disks detached during a migration or a resize are the other usual source.

03Is a snapshot cheaper than keeping the volume?

Usually, by a lot. A snapshot is billed at $0.05 per GB-month for the data actually stored in it. AWS doesn’t save empty blocks, so a snapshot of a 500 GB volume holding 120 GB of data is billed for about 120 GB: around $6.00 a month, against $50.00 for keeping the gp2 volume itself.

04How do you find unattached EBS volumes?

In the console: EC2 → Volumes, filter by Volume state = Available. Or with the AWS CLI, which also shows each volume’s size, type, creation date and tags:

aws ec2 describe-volumes --filters Name=status,Values=available \
  --query 'Volumes[].{ID:VolumeId,GiB:Size,Type:VolumeType,Created:CreateTime,Tags:Tags}' \
  --output table

# The same check in every region you have enabled
for r in $(aws ec2 describe-regions --query 'Regions[].RegionName' --output text); do
  echo "== $r"
  aws ec2 describe-volumes --region "$r" --filters Name=status,Values=available \
    --query 'Volumes[].[VolumeId,Size,VolumeType]' --output text
done

05How do you delete an unattached volume safely?

• Check the tags. A Name or owner tag usually tells you whose it was.
• Check when it was detached. CloudTrail event history keeps 90 days of management events; a DetachVolume months ago is a good sign nobody needs it.
• Take a snapshot, then delete. Once the volume is deleted, its data is gone unless a Recycle Bin retention rule covers it.

# When was it detached? (last 90 days)
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=ResourceName,AttributeValue=vol-0123456789abcdef0 \
  --query 'Events[].[EventTime,EventName,Username]' --output table

# Snapshot, wait for it to finish, then delete the volume
aws ec2 create-snapshot --volume-id vol-0123456789abcdef0 \
  --description "Before deleting unattached volume"
aws ec2 wait snapshot-completed --snapshot-ids snap-0123456789abcdef0
aws ec2 delete-volume --volume-id vol-0123456789abcdef0

06How do you stop new ones from appearing?

Check the setting before it matters. In the console, open an instance’s Storage tab and look at the Delete on termination column. Any data volume marked No will outlive the server. If you don’t need to keep it, set it to delete when you launch, or change it on a running instance with aws ec2 modify-instance-attribute and a block device mapping that sets DeleteOnTermination to true.