Back to Checks
aws

Lightsail static IP is associated with an instance

lightsail_static_ip_unused
Service: lightsailSeverity: low
OfficialBuilt-inVerified
Categories:resilience
Resource Type:Other

Amazon Lightsail static IPs detected as not associated with any instance, indicating reserved but unused addresses.

The evaluation focuses on the association state of each static IP to highlight potential leftovers.

Prowler logoProwlerprowler-provider-aws

Risk

Unattached static IPs incur ongoing charges and indicate asset drift. If DNS or apps still reference the address, requests are blackholed, impacting availability. Later attaching the same IP to an unintended host can expose services and data, affecting confidentiality and integrity.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks lightsail_static_ip_unused

Recommendation

Release unused static IPs or attach them to the intended instance.

Apply least privilege for IP allocation, enforce tagging and ownership, and run periodic audits with alerts for unattached addresses. If reservation is required, document purpose and set a time limit to prevent drift and cost.

Remediation

CLI

aws lightsail attach-static-ip --static-ip-name <example_resource_name> --instance-name <example_resource_name>

Terraform

resource "aws_lightsail_static_ip_attachment" "attach" {
  static_ip_name = "<example_resource_name>"  # Critical: specify the static IP to attach
  instance_name  = "<example_resource_name>"  # Critical: target instance; association makes check PASS
}

NativeIaC

Resources:
  AttachStaticIp:
    Type: AWS::Lightsail::StaticIpAttachment
    Properties:
      InstanceName: <example_resource_name>  # Critical: instance to attach to; marks IP as attached
      StaticIpName: <example_resource_name>  # Critical: static IP to attach; fixes FAIL by associating it

Other

1In the AWS Console, go to Lightsail > Networking > Static IPs
2Select the unused static IP and click "Attach to instance"
3Choose the target instance and confirm
4Verify the static IP now shows as attached

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.lightsail.lightsail_client import lightsail_client


class lightsail_static_ip_unused(Check):
    def execute(self) -> Check_Report_AWS:
        findings = []

        for static_ip in lightsail_client.static_ips.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=static_ip)
            report.status = "FAIL"
            report.status_extended = (
                f"Static IP '{static_ip.name}' is not associated with any instance."
            )

            if static_ip.is_attached:
                report.status = "PASS"
                report.status_extended = f"Static IP '{static_ip.name}' is associated with the instance '{static_ip.attached_to}'."

            findings.append(report)

        return findings

References