Find and Delete Default VPCs You Aren’t Using

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ReportDefaultVpcs",
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeRegions",
        "ec2:DescribeVpcs",
        "ec2:DescribeNetworkInterfaces",
        "ec2:DescribeSecurityGroups",
        "ec2:DescribeRouteTables",
        "ec2:DescribeNetworkAcls",
        "ec2:DescribeVpcEndpoints",
        "ec2:DescribeVpcPeeringConnections",
        "ec2:DescribeSubnets",
        "ec2:DescribeInternetGateways"
      ],
      "Resource": "*"
    },
    {
      "Sid": "DeleteEmptyDefaultVpcsOnlyWithApply",
      "Effect": "Allow",
      "Action": [
        "ec2:DeleteSubnet",
        "ec2:DetachInternetGateway",
        "ec2:DeleteInternetGateway",
        "ec2:DeleteVpc"
      ],
      "Resource": "*"
    }
  ]
}

// find-default-vpcs.ts
// Finds the default VPC in each Region and checks whether anything uses it: network interfaces,
// extra security groups, custom route tables and network ACLs, VPC endpoints and peering connections.
// Report only by default. With --apply it deletes EMPTY default VPCs in dependency order:
// detach and delete the internet gateway, delete the default subnets, then delete the VPC.
// Usage: npx tsx find-default-vpcs.ts [--regions all | us-east-1,eu-west-1] [--apply]
import {
  DeleteInternetGatewayCommand,
  DeleteSubnetCommand,
  DeleteVpcCommand,
  DescribeRegionsCommand,
  DescribeVpcsCommand,
  DetachInternetGatewayCommand,
  EC2Client,
  paginateDescribeInternetGateways,
  paginateDescribeNetworkAcls,
  paginateDescribeNetworkInterfaces,
  paginateDescribeRouteTables,
  paginateDescribeSecurityGroups,
  paginateDescribeSubnets,
  paginateDescribeVpcEndpoints,
  paginateDescribeVpcPeeringConnections,
  type Filter,
} from "@aws-sdk/client-ec2";

const args = process.argv.slice(2);
const flag = (name: string): string | undefined => {
  const i = args.indexOf(name);
  return i >= 0 ? args[i + 1] : undefined;
};
const apply = args.includes("--apply");

interface Row {
  Region: string;
  Vpc: string;
  ENIs: number;
  Blockers: string; // what keeps the VPC from being "empty"
  Status: string;
}

async function listRegions(): Promise<string[]> {
  const wanted = flag("--regions") ?? process.env.AWS_REGION ?? "us-east-1";
  if (wanted !== "all") return wanted.split(",").map((r) => r.trim()).filter(Boolean);
  // Regions enabled for this account (opt-in Regions you haven't enabled are left out).
  const { Regions = [] } = await new EC2Client({ region: "us-east-1" }).send(new DescribeRegionsCommand({}));
  return Regions.map((r) => r.RegionName ?? "").filter(Boolean).sort();
}

async function blockersFor(ec2: EC2Client, vpcId: string): Promise<{ enis: number; blockers: string[] }> {
  const byVpc: Filter[] = [{ Name: "vpc-id", Values: [vpcId] }];
  const client = { client: ec2 };
  let enis = 0, extraSgs = 0, customRts = 0, customAcls = 0, endpoints = 0, peerings = 0;

  for await (const p of paginateDescribeNetworkInterfaces(client, { Filters: byVpc })) enis += p.NetworkInterfaces?.length ?? 0;
  for await (const p of paginateDescribeSecurityGroups(client, { Filters: byVpc })) {
    extraSgs += (p.SecurityGroups ?? []).filter((g) => g.GroupName !== "default").length;
  }
  for await (const p of paginateDescribeRouteTables(client, { Filters: byVpc })) {
    customRts += (p.RouteTables ?? []).filter((t) => !(t.Associations ?? []).some((a) => a.Main)).length;
  }
  for await (const p of paginateDescribeNetworkAcls(client, { Filters: byVpc })) {
    customAcls += (p.NetworkAcls ?? []).filter((a) => !a.IsDefault).length;
  }
  for await (const p of paginateDescribeVpcEndpoints(client, { Filters: byVpc })) endpoints += p.VpcEndpoints?.length ?? 0;
  const peeringFilters: Filter[] = [{ Name: "status-code", Values: ["active", "pending-acceptance", "provisioning"] }];
  for (const side of ["requester-vpc-info.vpc-id", "accepter-vpc-info.vpc-id"]) {
    const Filters = [...peeringFilters, { Name: side, Values: [vpcId] }];
    for await (const p of paginateDescribeVpcPeeringConnections(client, { Filters })) peerings += p.VpcPeeringConnections?.length ?? 0;
  }

  const blockers = [
    enis && `${enis} ENIs`,
    extraSgs && `${extraSgs} extra SGs`,
    customRts && `${customRts} custom route tables`,
    customAcls && `${customAcls} custom NACLs`,
    endpoints && `${endpoints} endpoints`,
    peerings && `${peerings} peerings`,
  ].filter((b): b is string => Boolean(b));
  return { enis, blockers };
}

async function deleteDefaultVpc(ec2: EC2Client, vpcId: string): Promise<void> {
  const client = { client: ec2 };
  // 1. Subnets (the default VPC has one default subnet per Availability Zone).
  for await (const page of paginateDescribeSubnets(client, { Filters: [{ Name: "vpc-id", Values: [vpcId] }] })) {
    for (const s of page.Subnets ?? []) await ec2.send(new DeleteSubnetCommand({ SubnetId: s.SubnetId }));
  }
  // 2. Internet gateway: detach, then delete.
  for await (const page of paginateDescribeInternetGateways(client, { Filters: [{ Name: "attachment.vpc-id", Values: [vpcId] }] })) {
    for (const igw of page.InternetGateways ?? []) {
      await ec2.send(new DetachInternetGatewayCommand({ InternetGatewayId: igw.InternetGatewayId, VpcId: vpcId }));
      await ec2.send(new DeleteInternetGatewayCommand({ InternetGatewayId: igw.InternetGatewayId }));
    }
  }
  // 3. The VPC. Its default security group, main route table and default network ACL go with it.
  await ec2.send(new DeleteVpcCommand({ VpcId: vpcId }));
}

async function scanRegion(region: string): Promise<Row[]> {
  const ec2 = new EC2Client({ region });
  const { Vpcs = [] } = await ec2.send(new DescribeVpcsCommand({ Filters: [{ Name: "is-default", Values: ["true"] }] }));
  const rows: Row[] = [];
  for (const vpc of Vpcs) {
    const vpcId = vpc.VpcId ?? "";
    const { enis, blockers } = await blockersFor(ec2, vpcId);
    let status = blockers.length ? "in use: keep" : apply ? "deleting" : "empty: would delete";
    if (!blockers.length && apply) {
      try {
        await deleteDefaultVpc(ec2, vpcId);
        status = "deleted";
      } catch (err) {
        status = `failed: ${err instanceof Error ? err.name : String(err)}`;
      }
    }
    rows.push({ Region: region, Vpc: vpcId, ENIs: enis, Blockers: blockers.join(", ") || "none", Status: status });
  }
  if (!Vpcs.length) rows.push({ Region: region, Vpc: "(no default VPC)", ENIs: 0, Blockers: "", Status: "-" });
  return rows;
}

async function main(): Promise<void> {
  const rows: Row[] = [];
  for (const region of await listRegions()) rows.push(...(await scanRegion(region)));
  console.table(rows);
  const empty = rows.filter((r) => r.Status.startsWith("empty") || r.Status === "deleted").length;
  const used = rows.filter((r) => r.Status.startsWith("in use")).length;
  console.log(`${empty} empty default VPCs, ${used} in use`);
  if (!apply) console.log("Dry run: nothing was deleted. Re-run with --apply to delete the empty ones.");
}

main().catch((err) => {
  console.error(err);
  process.exit(1);
});

npm install @aws-sdk/client-ec2
npm install --save-dev tsx typescript

# Report every enabled Region
AWS_PROFILE=readonly npx tsx find-default-vpcs.ts --regions all

# Delete the empty ones in two Regions
AWS_PROFILE=netadmin npx tsx find-default-vpcs.ts --regions eu-north-1,ap-southeast-2 --apply

# Changed your mind? A new default VPC, per Region
aws ec2 create-default-vpc --region eu-north-1

┌─────────┬──────────────────┬────────────────────┬──────┬─────────────────────────────────────┬───────────────────────┐
│ (index) │ Region           │ Vpc                │ ENIs │ Blockers                            │ Status                │
├─────────┼──────────────────┼────────────────────┼──────┼─────────────────────────────────────┼───────────────────────┤
│ 0       │ 'ap-southeast-2' │ 'vpc-0a1b2c3d'     │ 0    │ 'none'                              │ 'empty: would delete' │
│ 1       │ 'eu-north-1'     │ 'vpc-0b2c3d4e'     │ 0    │ 'none'                              │ 'empty: would delete' │
│ 2       │ 'eu-west-1'      │ 'vpc-0c3d4e5f'     │ 3    │ '3 ENIs, 1 extra SGs'               │ 'in use: keep'        │
│ 3       │ 'us-east-1'      │ 'vpc-0d4e5f60'     │ 0    │ '1 endpoints'                       │ 'in use: keep'        │
│ 4       │ 'us-west-2'      │ '(no default VPC)' │ 0    │ ''                                  │ '-'                   │
└─────────┴──────────────────┴────────────────────┴──────┴─────────────────────────────────────┴───────────────────────┘
2 empty default VPCs, 2 in use
Dry run: nothing was deleted. Re-run with --apply to delete the empty ones.