PacketSensei

Unassociated Elastic IPs: How to Find Them and What They Cost

PacketSensei

Unassociated Elastic IPs are public IPv4 addresses allocated to the account and attached to nothing — billed hourly and consuming a quota of five. They are one of the most reliable sources of pure waste in an AWS account, because nothing in the console flags them and nothing fails when they exist — the bill simply stays higher than it needs to be.

This page covers what they cost, the command that lists yours, and — importantly — what to check before deleting anything.

What they are and why they linger

An Elastic IP is a public IPv4 address reserved for your account. AWS charges for it whether or not it is associated with anything, and since the February 2024 pricing change it charges for all public IPv4 addresses, including ones attached to running instances.

An unassociated Elastic IP is therefore pure loss on two axes: the hourly charge, and one of the five Elastic IPs the region’s default quota allows.

What they cost

At roughly $0.005 per hour, a single idle Elastic IP is about $3.60 a month. That sounds trivial until you count them across every region and account in an organisation — a hundred stragglers is $360 a month for nothing at all.

The quota cost is often the sharper one. Hitting AddressLimitExceeded during a deployment because five addresses are held by terminated instances is a real outage.

Finding yours

# Unassociated addresses in this region.
aws ec2 describe-addresses \
  --query 'Addresses[?AssociationId==null].{IP:PublicIp,Alloc:AllocationId,Name:Tags[?Key==`Name`]|[0].Value}' \
  --output table

# Every region at once.
for r in $(aws ec2 describe-regions --query 'Regions[].RegionName' --output text); do
  n=$(aws ec2 describe-addresses --region "$r" \
       --query 'length(Addresses[?AssociationId==null])' --output text 2>/dev/null)
  [ "$n" != "0" ] && [ -n "$n" ] && echo "$r: $n unassociated"
done

To release one:

aws ec2 release-address --allocation-id eipalloc-0123456789abcdef0

Before you delete

Releasing an address gives it up permanently. You will not get the same address back, and AWS may allocate it to another customer within minutes.

That matters when the address is in someone else’s allow-list — a partner firewall, a payment provider, an SMTP reputation record, a DNS A record that has not been updated. Search your own infrastructure-as-code and DNS zones for the literal address before releasing it, and check whether it appears in any external allow-list you have agreed to.

An address unassociated for a long time is usually safe. An address unassociated since this morning may belong to an instance someone is about to restart.

Stopping them coming back

Prefer designs that need no Elastic IP at all: load balancers provide stable DNS names, NAT gateways manage their own addresses, and private subnets need no public address.

Where one is genuinely required, tag it with the system that owns it and the reason. An untagged Elastic IP is indistinguishable from a leaked one six months later.

Prices quoted are us-east-1 list rates, last checked on 2026-08-22, and are shown with the arithmetic so you can substitute the rates for your own region. Always confirm against the AWS pricing page before acting on a number.