Delete Unused AWS EBS Volumes

1. Sign in to the AWS Management Console to access the EC2 dashboard via https://console.aws.amazon.com/ec2/.

2. Navigate to the left panel and click the Volumes under the Elastic Block Store section. (Similarly to what we did in the Audit section).

3. Select the unused volume you intend to delete.

5. (Optional) Create a snapshot of your volume:

a. Select the Actions button and choose the Create Snapshot option:

b.  Fill in the description in the resulting box and click Create

6. To delete the unused volume, click the Actions button again and choose the Delete Volume option:

7. Confirm the deletion in the popup box.

1. Execute the describe-volumes command which retrieves all unused EBS volumes.

aws ec2 describe-volumes \\
--region us-east-1 \\
--filters Name=status,Values=available

2. Again, a JSON Object containing configuration data for each detected unused EBS volume should be returned as output

{
    "Volumes": [
        {
            "Attachments": [],
            "AvailabilityZone": "us-east-1d",
            "CreateTime": "2019-12-02T12:01:41.088000+00:00",
            "Encrypted": false,
            "Size": 8,
            "SnapshotId": "snap-09328b730a42039c6",
            **"State": "available",**
            "VolumeId": "vol-0b810c6c7e4a334cb",
            "Iops": 100,
            "Tags": [
                {
                    "Key": "Name",
                    "Value": "Ashish_ZF1"
                }
            ],
            "VolumeType": "gp2",
            "MultiAttachEnabled": false
        },
        {
            "Attachments": [],
            "AvailabilityZone": "us-east-1d",
            "CreateTime": "2019-12-13T04:20:57.505000+00:00",
            "Encrypted": false,
            "Size": 50,
            "SnapshotId": "snap-0415d8298c7099b66",
            **"State": "available",**
            "VolumeId": "vol-06d24eb6b77f09e70",
            "Iops": 150,
            "VolumeType": "gp2",
            "MultiAttachEnabled": false
        },
				...
        {
            "Attachments": [],
            "AvailabilityZone": "us-east-1d",
            "CreateTime": "2020-02-07T08:29:07.029000+00:00",
            "Encrypted": false,
            "Size": 80,
            "SnapshotId": "snap-0415d8298c7099b66",
            **"State": "available",**
            "VolumeId": "vol-012e179cf459c730e",
            "Iops": 240,
            "VolumeType": "gp2",
            "MultiAttachEnabled": false
        }
]

3. Next, run the delete-volume command along with the volume ID of the EBS volume you intend to delete. Below is a sample delete-volume command:

aws ec2 delete-volume \\
--region us-east-1 \\
--volume-id vol-012e179cf459c730e

4. To confirm the selected EBS volume has been deleted, re-run the describe-volumes command while specifying the volume-id:

aws ec2 describe-volumes \\
--region us-east-1 \\
--volume-id vol-e323363d

5. The command should return a volume not found error.

A client error (InvalidVolume.NotFound) occurred when calling the DescribeVolumes operation: The volume 'vol-e323363d' does not exist.


Required IAM permission for AutomationAssumeRole:

• ssm:StartAutomationExecution
• ssm:GetAutomationExecution
• ec2:CreateSnapshot
• ec2:DeleteVolume
• ec2:DescribeSnapshots
• ec2:DescribeVolumes

1. Add Automatic Remediation Action:

• On the “Rules” page, click on the “ec2-volume-inuse-check” rule.
• In the “Remediation Action Details” section, opt for “AWSConfigRemediation-DeleteUnusedEBSVolume.”
• Select the “Resource ID” parameter and choose “VolumeId” from the list. At runtime, this parameter will be replaced with the noncompliant EBS volume’s ID.
• Within the “Parameters” section, provide values for the following:
  • “CreateSnapshot” (optional): Set to “true” if you wish to generate a snapshot of the EBS volume before deletion.
  • “AutomationAssumeRole”: Input the Amazon Resource Name (ARN) of the previously created “AssumeRole” service role.

2. Test Automatic Remediation for the AWS Config Rule:

• Inside the AWS Config Console, navigate to the “Rules” page and select the “ec2-volume-inuse-check” rule.
• In the “Actions” menu, choose “Re-evaluate.”
• Allow the rule to assess the non-compliant resources and validate the successful deletion of unused Amazon EBS volumes.

Troubleshooting: Sometimes, AWS Config doesn’t accurately reflect the resource state. So to troubleshoot it turn the recorder off and then turn it back on again from the AWS Config Settings page. The recorder captures the state of the resources. For newly created or deleted resources, it might take some time for the recorder to reflect the current state.