unused_ip_addresses

AWS Unused IP Addresses

What it does

This Policy Template scans all IP addresses in the given account and identifies any unused IP addresses. If any are found, an incident report will show the IP addresses, and related information, and an email will be sent to the user-specified email address. If the user approves that the IP addresses should be deleted, the policy will delete the IP addresses. Optionally, the user can specify one or more tags that if found on an IP address will exclude the IP address from the list.

Prerequisites

This Policy Template uses Credentials for authenticating to datasources -- in order to apply this policy you must have a Credential registered in the system that is compatible with this policy. If there are no Credentials listed when you apply the policy, please contact your Flexera Org Admin and ask them to register a Credential that is compatible with this policy. The information below should be consulted when creating the credential(s).

• AWS Credential (provider=aws) which has the following permissions:

  • ec2:DescribeRegions
  • ec2:DescribeAddresses
  • pricing:GetProducts
  • ec2:ReleaseAddress

  Example IAM Permission Policy:

  {
      "Version": "2012-10-17",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "ec2:DescribeRegions",
                  "ec2:DescribeAddresses",
                  "pricing:GetProducts",
                  "ec2:ReleaseAddress"
              ],
              "Resource": "*"
          }
      ]
  }

• Flexera Credential (provider=flexera) which has the following roles:

  • billing_center_viewer

The Provider-Specific Credentials page in the docs has detailed instructions for setting up Credentials for the most common providers.

Functional Details

An Elastic IP (EIP) is an IP address that can be reserved from AWS for an account. Once Elastic IP is created, it can be assigned to any instance available in an account. The reserved IP in an account which is not associated with a running EC2 instance or an Elastic Network Interface (ENI) is known as Unused Elastic IP and it incur charges. If EIP is not needed, charges can be stopped by releasing the unused EIP.

Policy savings details

The policy includes the estimated savings. The estimated savings is recognized if the resource is terminated. The savings is calculated using the per hour cost of unused IPs for a period of 30 days and is displayed in the Estimated Monthly Savings column and the total estimated sum of all the unused IPs is displayed in the incident detail message. Please note that the estimated savings is calculated and displayed in USD($), excluding any discounts.

Input Parameters

This policy has the following input parameters required when launching the policy.

• Allowed Regions - A list of allowed regions for an AWS account. Please enter the allowed regions code if SCP is enabled, see Available Regions in AWS; otherwise, the policy may fail on regions that are disabled via SCP. Leave blank to consider all the regions.
• Account Number - The Account number for use with the AWS STS Cross Account Role. Leave blank when using AWS IAM Access key and secret. It only needs to be passed when the desired AWS account is different than the one associated with the Flexera One credential. more
• Email addresses - Email addresses of the recipients you wish to notify when new incidents are created
• Exclusion Tags - A list of AWS tags to ignore Elastic IPs. Format: Key=Value.
• Automatic Actions - When this value is set, this policy will automatically take the selected action(s).

Please note that the "Automatic Actions" parameter contains a list of action(s) that can be performed on the resources. When it is selected, the policy will automatically execute the corresponding action on the data that failed the checks, post incident generation. Please leave it blank for manual action. For example if a user selects the "Terminate Resources" action while applying the policy, all the resources that didn't satisfy the policy condition will be terminated.

Policy Actions

The following policy actions are taken on any resources found to be out of compliance.

• Send an email report
• Delete unused IP addresses after approval

Supported Clouds

• AWS

Cost

This Policy Template does not launch any instances, and so does not incur any cloud costs.