I discovered a few unattached, mystery EBS volumes in my AWS Console. I suspect these are leftovers from some test EC2 instances I had that I may have not noticed were NOT set to delete the volume upon termination.

Is there a "Attachment History" anywhere for a volume so I can see what instances it used to go with? Or should I just make a new instance off the volume, SSH in, and try to figure it out for myself?


There is no "Attachment History" - so just start a new instance (default AMI with the Distribution of your choice) and attach all volumes to different /dev/* then mount them readonly on the machine and check for yourself what is on the volumes and if you still need the data.

So you can make sure you won't change anything on these devices/volumes (even booting from these volumes will change logs etc.)


I am not sure how far this will go back, but you can try using the following for recent activity:

$ aws cloudtrail lookup-events --lookup-attributes AttributeKey=ResourceName,AttributeValue=vol-0123456789 --region ca-central-1
  • Without specifically creating a CloudTrail for the resource, it seems that the service only logs the last 7 days for everything else. Still, this is a great tip! – DOOManiac Sep 6 '17 at 19:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.