Which AWS resources can be attached / related to a specific VPC? (to verify it's safe to delete it)

Question

I'm looking for a way to understand if we are making use of a specific VPC

The easy way is to review resources 1-by-1 like:

EC2 Machines
RDS
Client-VPN-Endpoint
Other resources - What else do I need to check?

And check manually. is there another way to determine what is relying on a specific VPC before I'll delete it?

You can generate VPC Flow logs and check what traffic is happening in your VPC. Have you considered that? — Marcin, Jan 23 '21 at 10:40
In addition to performing aws cloud watch logs insight query for your VPC flowlogs. Your can also have a look at [this](https://aws.amazon.com/premiumsupport/knowledge-center/troubleshoot-dependency-error-delete-vpc/) from aws. — amitd, Jan 23 '21 at 10:59
Looks like a duplicate of https://stackoverflow.com/questions/61997608/how-can-i-list-all-resources-that-belongs-to-a-certain-vpc/64280537#64280537 — Alon Lavian, May 02 '21 at 09:08

score 0 · Answer 1 · answered May 02 '21 at 09:06

You can do it in two ways: AWS CLI or AWS console.

AWS CLI

You can use AWS CLI to list all ENIs associated with the VPC and prettify the output using the --query parameter to get a resource list with the desired fields (AZ, instance-id, etc.).

  `aws ec2 describe-network-interfaces --filters Name=vpc-id,Values=<vpc-id> --query  'NetworkInterfaces[*].[AvailabilityZone, OwnerId, Attachment.InstanceId, PrivateIpAddresses[*].Association.PublicIp]'

  `aws ec2 describe-network-interfaces --filters Name=vpc-id,Values=<vpc-id> --query  'NetworkInterfaces[*].[RequesterId,Description]'

A sample of the raw output (only one instance on the VPC):

 "NetworkInterfaces": [
     {
         "Association": {
             "IpOwnerId": "amazon",
             "PublicDnsName": "ec2-54-196-57-169.compute-1.amazonaws.com",
             "PublicIp": "54.196.57.169"
         },
         "Attachment": {
             "AttachTime": "2020-08-24T10:59:16+00:00",
             "AttachmentId": "eni-attach-047e562690aabbffd",
             "DeleteOnTermination": true,
             "DeviceIndex": 0,
             "InstanceId": "i-0fe495a6c17bd0f82",
             "InstanceOwnerId": "570398916848",
             "Status": "attached"
         },
         "AvailabilityZone": "us-east-1d",
         "Description": "",
         "Groups": [
             {
                 "GroupName": "launch-wizard-1",
                 "GroupId": "sg-0aa7d8257bb487e1b"
             }
         ],
         "InterfaceType": "interface",
         "Ipv6Addresses": [],
         "MacAddress": "0e:58:38:33:9a:31",
         "NetworkInterfaceId": "eni-0b20855178d276783",
         "OwnerId": "570398916848",
         "PrivateDnsName": "ip-172-31-34-30.ec2.internal",
         "PrivateIpAddress": "172.31.34.30",
         "PrivateIpAddresses": [
             {
                 "Association": {
                     "IpOwnerId": "amazon",
                     "PublicDnsName": "ec2-54-196-57-169.compute-1.amazonaws.com",
                     "PublicIp": "54.196.57.169"
                 },
                 "Primary": true,
                 "PrivateDnsName": "ip-172-31-34-30.ec2.internal",
                 "PrivateIpAddress": "172.31.34.30"
             }
         ],
         "RequesterManaged": false,
         "SourceDestCheck": true,
         "Status": "in-use",
         "SubnetId": "subnet-e2bc5fbd",
         "TagSet": [],
         "VpcId": "vpc-6ad2e110"
     }
 ]

And now filtered:

For the first --query

 [
     "us-east-1d",
     "57039816848",
     "i-0fe495a6c17bd0f82",
     [
         "44.196.57.169"
     ]
 ]

And for the second --query (another VPC):

 [
     "amazon-elasticache",
     "ElastiCache alon-001"
 ],
 [
     "amazon-elasticache",
     "ElastiCache alon-002"
 ],
 [
     "975289786086",
     "arn:aws:ecs:us-east-2:57039916848:attachment/22a90802-fae7-4afb-9a7e-43e6f4be8ca4"
 ],
 [
     "074689309192",
     "Interface for NAT Gateway nat-069344579d8bda20"
 ],
 [
     "amazon-elb",
     "ELB app/EC2Co-EcsEl-YX74WCWEGOK/0b6d7bc60b540b1"
 ],
 [
     "amazon-elb",
     "ELB app/EC2Co-EcsEl-YX74WCWGGOK/0b6bd7c60b540b1"
 ],
 [
     "amazon-elasticache",
     "ElastiCache alon-003"
 ]

AWS Console

You can do the same using the AWS console. Under EC2->Network Interfaces, search for the desired vpc-id in the search bar.

Which AWS resources can be attached / related to a specific VPC? (to verify it's safe to delete it)

1 Answers1