▸ Guides / Networking
AWS Elastic IP cost: what you pay, and how to find idle IPs
Updated · Prices checked against AWS pricing · 6 min read
AWS charges for every public IPv4 address by the hour, whether it is attached to something or not. Elastic IPs are the ones that outlive what they were for: the instance is gone, the NAT gateway was deleted, the proof of concept ended, and the address is still allocated and still billed.
One forgotten address costs very little. Dozens spread across regions and accounts become a line on the bill that nobody owns. This guide covers what Elastic IPs cost, which ones count as idle, and how to find and release them.
[ What it costs ]
Since February 1, 2024, AWS charges $0.005 an hour for each public IPv4 address. The rate is the same for an address in use and an idle one, and it applies to every public IPv4 address in your account, not only Elastic IPs: the public IPs on EC2 instances, load balancers and NAT gateways are billed the same way. Addresses you bring yourself (BYOIP) are not charged.
| Per address, per hour | $0.005 |
|---|---|
| Per address, per month (730 hours) | $3.65 |
| Per address, per year | $43.80 |
| 10 idle addresses, per year | $438 |
[ What counts as idle ]
AWS treats an Elastic IP as idle when it isn't associated with a network interface, or when it's associated with a stopped resource such as a stopped EC2 instance. An idle address costs the same as one in use. The difference is that it does nothing for you.
Where idle addresses come from
- ▸An instance was terminated, but its Elastic IP was kept just in case.
- ▸A NAT gateway was deleted. Deleting one disassociates its Elastic IP but doesn't release it, so the address stays allocated.
- ▸An instance has been stopped for months with an Elastic IP still attached.
- ▸A migration, test or proof of concept allocated addresses and ended without cleaning up.
In Cost Explorer they appear under the usage types PublicIPv4InUseAddress (Hrs) and PublicIPv4IdleAddress (Hrs). Filtering on the idle one tells you what idle addresses cost the account, but not which addresses they are.
[ Find them ]
An Elastic IP that isn't associated with anything has no association ID. This lists those addresses in the region your CLI is set to:
$ aws ec2 describe-addresses --query "Addresses[?AssociationId==null].[PublicIp,AllocationId]" --output table
Elastic IPs are regional, so one region isn't the whole account. This runs the same query in every region enabled for the account and puts the region in front of each address:
$ for region in $(aws ec2 describe-regions --query "Regions[].RegionName" --output text); do aws ec2 describe-addresses --region "$region" --query "Addresses[?AssociationId==null].[PublicIp,AllocationId]" --output text | sed "s/^/$region /"; done
Both run in bash or zsh, and in AWS CloudShell, which already has your credentials. An address attached to a stopped instance still has an association ID, so it won't appear here: check those against your stopped instances.
[ Release them ]
Once you're sure nothing needs an address, release it by its allocation ID, in its own region:
$ aws ec2 release-address --allocation-id eipalloc-0123456789abcdef0 --region us-east-1
For the addresses you keep, add an Owner tag. Public IPv4 addresses support cost allocation tags, so once the tag is activated in Billing, Cost Explorer can split the charge by owner.
[ Across many accounts ]
The loop above covers one account. With ten or fifty, the same job means assuming a role in each account, running the loop, merging the output, and doing it again next month when new addresses have appeared.
That is the job Resource Atlas does. It runs inside an AWS account you own, scans every connected account through a read-only role, and lists their Elastic IPs in one table with the unassociated ones counted at the top. It covers the region you deploy it to in each account; for addresses in other regions, the loop above still does the job. Community is free for up to 2 AWS accounts.
[ See it in the demo ]
The live demo scans a sample estate of three AWS accounts. Its Elastic IP page lists 12 addresses and flags the 5 that are associated with nothing, including ones named old-loadbalancer, poc-endpoint and migration-temp.
Questions
Is an Elastic IP free when it is attached to a running instance?
No. Since February 1, 2024, AWS charges $0.005 an hour for every public IPv4 address, attached or not, which is about $3.65 a month per address.
What counts as an idle Elastic IP?
AWS treats an Elastic IP as idle when it is not associated with a network interface, or when it is associated with a stopped resource such as a stopped EC2 instance. It is charged the same $0.005 an hour as an address in use.
How do I see what public IPv4 addresses cost me?
In Cost Explorer, filter on the usage types PublicIPv4InUseAddress (Hrs) and PublicIPv4IdleAddress (Hrs). That gives the cost for the account but not which addresses it comes from. To see the addresses themselves, list them with aws ec2 describe-addresses in each region, or use Public IP Insights in VPC IP Address Manager.
Will releasing an Elastic IP break anything?
Only if something still points at the address. Before releasing one, check DNS records, firewall rules and any partner allowlists that use it. A released address goes back to AWS's pool, and you cannot count on getting the same one back.