Why do I have running EC2 instances that I didn't launch?
Last updated: 2020-12-07
I checked the Amazon Elastic Compute Cloud (Amazon EC2) console, and I have instances running that I don't remember launching. Where did these instances come from and how can I remove them?
To discover how EC2 instances on your account were launched, do the following:
- Determine if the instances were launched by other AWS services.
- Determine if other authorized users of your AWS account launched the instances.
Determine if the instances were launched by other AWS services
Some AWS services launch EC2 instances as part of their function. The following services, among others, might be configured to launch EC2 instances:
- AWS CloudFormation: You can configure a CloudFormation template to launch one or more instances on your behalf as part of a stack. For more information, see What is AWS CloudFormation? To delete the stack and all its resources, see Deleting a stack on the AWS CloudFormation console.
- AWS Elastic Beanstalk: Elastic Beanstalk environments include EC2 instances and Auto Scaling rules by default. An environment's Auto Scaling rules might launch EC2 instances, depending on how they are configured. For more information, see What Is Elastic Beanstalk? To terminate an environment and all its resources, see Terminate an Elastic Beanstalk environment.
- AWS OpsWorks: AWS OpsWorks Stacks can launch groups of AWS resources according to the instructions in the stack's cookbook. If you launch an OpsWorks stack, then the cookbook might be configured to launch EC2 instances as part of the stack. To terminate the resources associated with a stack, delete a stack.
- Amazon EMR: Amazon EMR allows you to launch clusters and nodes, which are groups of EC2 instances. To terminate the instances associated with a cluster, terminate the Amazon EMR cluster.
Note: You might need to complete additional steps before or after terminating resources.
If you're charged for EC2 resources that you previously terminated, see Why am I being charged for EC2 when all my instances have been terminated? or Why am I charged for Elastic IP addresses when all my Amazon EC2 instances have been terminated?
Determined if other authorized users launched the instances
Another authorized user might have launched the instances as part of a project that they were working on.
You can use AWS CloudTrail to look for instances of the RunInstances API call. Or, check with other authorized AWS users on your team to verify if they launched instances.
Note: You can use AWS Identity and Access Management (IAM) to manage which users can launch instances or use AWS services.