Save Money by Cleaning Up Orphaned EBS Volumes from Deleted EC2 Instances Using Terraform 💸

# modules/ebs-cleanup/main.tf

# Lambda function to detect and tag orphaned volumes
resource "aws_lambda_function" "ebs_cleanup" {
filename = data.archive_file.lambda.output_path
function_name = "ebs-orphan-cleanup"
role = aws_iam_role.lambda.arn
handler = "index.handler"
runtime = "python3.11"
timeout = 300
source_code_hash = data.archive_file.lambda.output_base64sha256

environment {
variables = {
GRACE_PERIOD_DAYS = var.grace_period_days
DRY_RUN = var.dry_run
SNS_TOPIC_ARN = aws_sns_topic.cleanup_alerts.arn
}
}
}

# Lambda code
data "archive_file" "lambda" {
type = "zip"
output_path = "${path.module}/lambda.zip"

source {
content = <<-EOF
import boto3
import os
from datetime import datetime, timedelta, timezone

ec2 = boto3.client('ec2')
sns = boto3.client('sns')

GRACE_PERIOD_DAYS = int(os.environ.get('GRACE_PERIOD_DAYS', 7))
DRY_RUN = os.environ.get('DRY_RUN', 'true').lower() == 'true'
SNS_TOPIC_ARN = os.environ.get('SNS_TOPIC_ARN')

def handler(event, context):
"""Detect and optionally delete orphaned EBS volumes"""

# Find all available (unattached) volumes
response = ec2.describe_volumes(
Filters=[{'Name': 'status', 'Values': ['available']}]
)

volumes_to_delete = []
volumes_to_tag = []
total_size = 0
total_cost = 0

for volume in response['Volumes']:
volume_id = volume['VolumeId']
size = volume['Size']
create_time = volume['CreateTime']

# Check if volume has deletion marker tag
tags = {tag['Key']: tag['Value'] for tag in volume.get('Tags', [])}
marked_for_deletion = tags.get('OrphanedVolume') == 'true'
deletion_date = tags.get('DeletionDate')

# Calculate age
age_days = (datetime.now(timezone.utc) - create_time).days

if marked_for_deletion and deletion_date:
# Check if grace period has passed
deletion_datetime = datetime.fromisoformat(deletion_date.replace('Z', '+00:00'))
if datetime.now(timezone.utc) >= deletion_datetime:
volumes_to_delete.append({
'id': volume_id,
'size': size,
'age_days': age_days
})
total_size += size
total_cost += size * 0.08
else:
# First time seeing this orphan - tag it
volumes_to_tag.append({
'id': volume_id,
'size': size,
'age_days': age_days
})

# Tag volumes for deletion
if volumes_to_tag:
deletion_date = (datetime.now(timezone.utc) + timedelta(days=GRACE_PERIOD_DAYS)).isoformat()

for vol in volumes_to_tag:
print(f"Tagging volume {vol['id']} for deletion on {deletion_date}")
ec2.create_tags(
Resources=[vol['id']],
Tags=[
{'Key': 'OrphanedVolume', 'Value': 'true'},
{'Key': 'DeletionDate', 'Value': deletion_date},
{'Key': 'DetectedDate', 'Value': datetime.now(timezone.utc).isoformat()}
]
)

# Delete volumes (if not dry run)
deleted_count = 0
if volumes_to_delete and not DRY_RUN:
for vol in volumes_to_delete:
try:
print(f"Deleting volume {vol['id']} ({vol['size']}GB, {vol['age_days']} days old)")
ec2.delete_volume(VolumeId=vol['id'])
deleted_count += 1
except Exception as e:
print(f"Failed to delete {vol['id']}: {str(e)}")

# Send notification
message = f"""
EBS Orphan Cleanup Report
========================

Volumes Tagged for Deletion ({GRACE_PERIOD_DAYS} day grace period):
- Count: {len(volumes_to_tag)}
- Total Size: {sum(v['size'] for v in volumes_to_tag)}GB
- Monthly Cost: ${sum(v['size'] for v in volumes_to_tag) * 0.08:.2f}

Volumes Deleted (grace period expired):
- Count: {deleted_count if not DRY_RUN else 0}
- Total Size: {total_size}GB
- Monthly Savings: ${total_cost:.2f}

Mode: {'DRY RUN (no deletions)' if DRY_RUN else 'ACTIVE (deleting volumes)'}

Tagged volumes will be deleted in {GRACE_PERIOD_DAYS} days if not reattached.
"""

if SNS_TOPIC_ARN and (volumes_to_tag or volumes_to_delete):
sns.publish(
TopicArn=SNS_TOPIC_ARN,
Subject='EBS Orphan Cleanup Report',
Message=message
)

print(message)

return {
'tagged': len(volumes_to_tag),
'deleted': deleted_count,
'dry_run': DRY_RUN
}
EOF
filename = "index.py"
}
}

# IAM role for Lambda
resource "aws_iam_role" "lambda" {
name = "ebs-cleanup-lambda-role"

assume_role_policy = jsonencode({
Version = "2012-10-17"
Statement = [{
Action = "sts:AssumeRole"
Effect = "Allow"
Principal = {
Service = "lambda.amazonaws.com"
}
}]
})
}

# Lambda permissions
resource "aws_iam_role_policy" "lambda_ebs" {
role = aws_iam_role.lambda.id

policy = jsonencode({
Version = "2012-10-17"
Statement = [
{
Effect = "Allow"
Action = [
"ec2:DescribeVolumes",
"ec2:DeleteVolume",
"ec2:CreateTags"
]
Resource = "*"
},
{
Effect = "Allow"
Action = [
"sns:Publish"
]
Resource = aws_sns_topic.cleanup_alerts.arn
},
{
Effect = "Allow"
Action = [
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:PutLogEvents"
]
Resource = "arn:aws:logs:*:*:*"
}
]
})
}

# EventBridge rule - run daily
resource "aws_cloudwatch_event_rule" "daily_cleanup" {
name = "ebs-daily-cleanup"
description = "Run EBS orphan cleanup daily"
schedule_expression = "cron(0 2 * * ? *)" # 2 AM UTC daily
}

resource "aws_cloudwatch_event_target" "lambda" {
rule = aws_cloudwatch_event_rule.daily_cleanup.name
target_id = "lambda"
arn = aws_lambda_function.ebs_cleanup.arn
}

resource "aws_lambda_permission" "allow_eventbridge" {
statement_id = "AllowExecutionFromEventBridge"
action = "lambda:InvokeFunction"
function_name = aws_lambda_function.ebs_cleanup.function_name
principal = "events.amazonaws.com"
source_arn = aws_cloudwatch_event_rule.daily_cleanup.arn
}

# SNS topic for alerts
resource "aws_sns_topic" "cleanup_alerts" {
name = "ebs-cleanup-alerts"
}

resource "aws_sns_topic_subscription" "email" {
topic_arn = aws_sns_topic.cleanup_alerts.arn
protocol = "email"
endpoint = var.alert_email
}

# Variables
variable "grace_period_days" {
description = "Days to wait before deleting orphaned volumes"
type = number
default = 7
}

variable "dry_run" {
description = "If true, only tag volumes, don't delete"
type = bool
default = true
}

variable "alert_email" {
description = "Email for cleanup notifications"
type = string
}

# Outputs
output "lambda_function_name" {
value = aws_lambda_function.ebs_cleanup.function_name
}

output "sns_topic_arn" {
value = aws_sns_topic.cleanup_alerts.arn
}