Delete-on-Termination Disabled for EBS Volume

Explanation

When EC2 instances are provisioned, each attached EBS volume has a `DeleteOnTermination` flag that determines whether it will be deleted when the instance is terminated. If this flag is set to `false` - often unintentionally in custom launch templates, AMIs, or older automation scripts - volumes persist after termination, resulting in orphaned storage. While detached volumes are easy to detect and clean up after the fact, proactively identifying attached volumes with `DeleteOnTermination=false` can prevent future waste before it occurs.

Relevant Billing Model

EBS volumes are billed per GB-month of provisioned storage. If a volume is not automatically deleted when its EC2 instance is terminated, charges continue to accrue even if the volume is no longer in use.

Detection

• The volume is attached to an active EC2 instance
• The `DeleteOnTermination` flag is set to `false`
• The instance is not intended to retain persistent data on termination (e.g., ephemeral workloads or stateless apps)

Remediation

• Update the instance configuration to set `DeleteOnTermination=true` for non-persistent volumes
• Modify infrastructure-as-code templates and launch configurations to use the correct flag by default
• Establish policy controls or monitoring to flag instances with unnecessary persistent volume retention
• Periodically review long-lived instances for non-root volumes with this misconfiguration
• Educate engineering teams on the default behavior and risks of leaving the flag unset