Back to Checks
aws

Elastic IP is associated with an instance or network interface

ec2_elastic_ip_unassigned
Service: ec2Severity: low
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:AwsEc2Eip

EC2 Elastic IPs that are allocated but not associated with any instance or network interface. The evaluation identifies EIPs present in the account without an active association.

Prowler logoProwlerprowler-provider-aws

Risk

Unused Elastic IPs consume public IPv4 capacity and incur ongoing charges. Hoarded addresses can exhaust quotas, blocking new allocations and delaying deployments (availability). Lack of ownership tracking increases operational drift and misconfigurations, risking unintended exposure when later reassigned.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks ec2_elastic_ip_unassigned

Recommendation

Release unused Elastic IPs or promptly associate them only where required. Enforce least privilege for address allocation, apply tagging to track ownership, and schedule periodic audits. Prefer private networking or managed front ends to reduce public IPv4 use. Automate reclaiming of unassociated addresses in lifecycle policies.

Remediation

CLI

aws ec2 release-address --allocation-id <ALLOCATION_ID>

Terraform

# Associate an existing unassigned Elastic IP to an instance
resource "aws_eip_association" "<example_resource_name>" {
  allocation_id = "<example_allocation_id>"  # Critical: target unassigned EIP
  instance_id   = "<example_instance_id>"     # Critical: attach EIP to this instance to pass the check
}

NativeIaC

# Associate an existing unassigned Elastic IP to an instance
Resources:
  <example_resource_name>:
    Type: AWS::EC2::EIPAssociation
    Properties:
      AllocationId: <example_allocation_id>  # Critical: selects the unassigned EIP to associate
      InstanceId: <example_instance_id>      # Critical: associates the EIP to this instance, fixing the finding

Other

1In the AWS console, go to EC2 > Network & Security > Elastic IPs
2Select the Elastic IP with Status = Not associated
3Choose Actions > Associate Elastic IP address
4Select Instance (or Network interface), pick the target, and click Associate
5Alternatively, to remove the finding by deleting the unused EIP: Actions > Release Elastic IP address > Release

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.ec2.ec2_client import ec2_client


class ec2_elastic_ip_unassigned(Check):
    def execute(self):
        findings = []
        for eip in ec2_client.elastic_ips:
            report = Check_Report_AWS(metadata=self.metadata(), resource=eip)
            if eip.public_ip:
                report.resource_id = eip.public_ip
                report.status = "FAIL"
                report.status_extended = f"Elastic IP {eip.public_ip} is not associated with an instance or network interface."
                if eip.association_id:
                    report.status = "PASS"
                    report.status_extended = f"Elastic IP {eip.public_ip} is associated with an instance or network interface."
                findings.append(report)

        return findings

References