Can't delete AWS internet Gateway

Question

I created an internet gateway in AWS VPC dashboard, I attached it to a VPC then I want to detach it but I keep getting this error:

Network vpc-xxxx has some mapped public adresses, Please unmap those public addresses before detaching the gateway. ( Service: AmazonEC2; Status Code: 400; Error Code: DependencyViolation; Request ID: qfdqsdf)

What to do to detache this IGW ? Why exactly do I get this error?

I need to get rid of this IGW without deleting extra resources. please any ideas?

For information, the route table of the VPC does contain public addresses but they are routed to other targets. This IGW is not set as target anywhere.

Is the VPC empty or are there instances in the VPC's public subnet? — helloV, Jul 11 '17 at 07:37
Yes there are instances in the subnets. these subnets are attached to virtual gateway not to internet gateway — Souad, Jul 11 '17 at 07:42
Why do you "need" to get rid of an Internet Gateway? This implies you have **no** instances with public or elastic IP addresses, no NAT Gateways, no external ELBs, and no other resources with an elastic network interface with associated public IP addresses... yet, for some reason you did attach an IGW to your VPC, and it's unclear why that might have been or why you now want to remove it. — Michael - sqlbot, Jul 11 '17 at 09:52
I found a NAT gateway lingering that caused this, and had to delete it. — garryp, Feb 01 '19 at 14:15
I am in the same situation (although in a VPC I created tfor test). Thing is: If the VPC+subnets+instances+public-IPs could live 'before' the internet gateway was attached, I don't see any reason for it not being able to detach after an attach. I mean... I have a table. I put a glass. I want to remove the glass. It says "there's thirsty people there". Okey... before placing the glass, the table had no glasses and that's all. — Xavi Montero, Apr 29 '20 at 21:54
Additionally, if I'm not misunderstood, the Internet Gateway allows OUTGOING traffic. I mean: I might want to have a host with a public IP to reach it via ssh, but maybe I don't wont that host to start connections to the outside world. Isn't the Internet Gateway intended only for outgoing traffic? Maybe I'm confused with that. — Xavi Montero, Apr 29 '20 at 21:58

score 54 · Accepted Answer · edited Nov 29 '22 at 02:30

54

You have some resources in the VPC that have been assigned a Public IP address, such as:

Amazon EC2 instances
Amazon RDS instances
Amazon Redshift cluster
VPC NAT Gateways
etc.

These IP addresses might have been assigned as an Elastic IP address or as an "auto-assign Public IP address" on instance creation.

You will need to delete these Elastic IP addresses before the Internet Gateway can be removed. If they were auto-assigned IP addresses, then Stop the instances to remove the public IP addresses.

You might also need to edit your Route Tables so that they do not refer to the Internet Gateway.

edited Nov 29 '22 at 02:30

Mark D

3,317
1
26
27

answered Jul 11 '17 at 09:52

John Rotenstein

241,921
22
380
470

1

Thanks for RDS tip, in my case *someone* did set up a database without cloudformation and caused the vpc stack to not be deletable. – luk2302 Aug 24 '17 at 08:33
4

Also EC2->Network Interfaces-> filter by VPC Id. In our case there were left-over Client VPN IP assignments. – ab77 Feb 05 '19 at 17:42
I can't think of anything that fits under the "etc." category, but I guess AWS is releasing new services all the time. – Jordan Stewart May 24 '19 at 07:02
5

Load balancers fit in "etc" – thelr Apr 24 '20 at 14:39

Ben A · Answer 2 · 2019-07-17T11:51:30.047

24

had eks in a vpc, deleted the cluster but now there's network interfaces with an EIP and sg attached to them that were loadbalancers that did not get deleted when deleting the cluster because the deployments were not deleted inside the cluster before deleting the cluster itself. Had to find all associated ELB's and delete them, then security groups, then intefaces, EIP, all the way down the line till finally deleting the internet gateway and vpc.

edited Jul 17 '19 at 11:51

answered Jul 17 '19 at 11:21

Ben A

462
4
13

7

Delete the load balancer helps! – LuQQiu Jun 26 '21 at 03:24
Delete NAT gateway also – Francisco Cardoso Dec 20 '21 at 13:39
I also had to delete the security groups – ChuyAMS Feb 16 '22 at 05:34

score 4 · Answer 3 · answered Jun 18 '18 at 10:46

4

I had to delete NAT gateway that was hanging around to resolve mine.

answered Jun 18 '18 at 10:46

simplytunde

197
2
7

3

Was ELB + sec groups in my case – Max Lobur Dec 11 '19 at 22:12

score 3 · Answer 4 · answered Sep 23 '18 at 15:50

3

For those facing the same problem check also Route tables having the Internet Gateway as target

answered Sep 23 '18 at 15:50

smndiaye

438
7
13

score 2 · Answer 5 · answered Sep 23 '19 at 15:11

2

Personally, I had to manually reject connections from the endpoint services in the VPC.
Endpoint Services > Select Service > Endpoint Connections > Select connection > Actions > Reject endpoint connection request

answered Sep 23 '19 at 15:11

karuhanga

3,010
1
27
30

Yeah if you have a VPC Private Link in an API Gateway I need to do this in order to delete them. You need to reject the connection like you mentioned first – Christopher Thomas May 29 '20 at 07:05

score 0 · Answer 6 · answered Sep 06 '22 at 15:30

0

In my case, I had to remove the dependency of Public IP from the DMS Replication instance.

answered Sep 06 '22 at 15:30

arul

1
1

score 0 · Answer 7 · answered Jun 13 '23 at 14:42

0

In my case, I had to delete 5 x Classic Load Balancers that were part of the VPC which I wanted to remove the Internet Gateway from.

answered Jun 13 '23 at 14:42

user2730025

1
2

Can't delete AWS internet Gateway

7 Answers7