Find Orphaned EBS Snapshots Whose Volume Is Gone

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "FindOrphanedSnapshots",
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeSnapshots",
        "ec2:DescribeVolumes",
        "ec2:DescribeImages"
      ],
      "Resource": "*"
    },
    {
      "Sid": "ArchiveOrDeleteSnapshots",
      "Effect": "Allow",
      "Action": [
        "ec2:DeleteSnapshot",
        "ec2:ModifySnapshotTier"
      ],
      "Resource": "arn:aws:ec2:*::snapshot/*"
    }
  ]
}

// find-orphaned-ebs-snapshots.ts
// Finds EBS snapshots you own whose source volume no longer exists and that no AMI you own
// (including disabled and deprecated AMIs) references. Estimates what they cost per month.
// Report-only by default. --apply deletes up to --max snapshots; --apply --archive moves them to
// the archive tier instead.
// Usage: npx tsx find-orphaned-ebs-snapshots.ts [--regions us-east-1,eu-west-1] [--days 30]
//          [--apply [--archive] [--max 20]]
import {
  EC2Client,
  DeleteSnapshotCommand,
  ModifySnapshotTierCommand,
  paginateDescribeImages,
  paginateDescribeSnapshots,
  paginateDescribeVolumes,
  type Snapshot,
} from "@aws-sdk/client-ec2";

// USD per GB-month in us-east-1, as of September 2026. Other Regions differ.
const STANDARD_PER_GB = 0.05;
const ARCHIVE_PER_GB = 0.0125;

const args = process.argv.slice(2);
const flag = (name: string): string | undefined => {
  const i = args.indexOf(name);
  return i >= 0 ? args[i + 1] : undefined;
};
const regions = (flag("--regions") ?? process.env.AWS_REGION ?? "us-east-1").split(",").map((r) => r.trim()).filter(Boolean);
const DAYS = Number(flag("--days") ?? 30);
const MAX = Number(flag("--max") ?? 20);
const APPLY = args.includes("--apply");
const ARCHIVE = args.includes("--archive");
if (!Number.isFinite(DAYS) || DAYS < 0) throw new Error("--days must be 0 or more");
if (!Number.isInteger(MAX) || MAX < 1) throw new Error("--max must be a positive integer");
const cutoff = Date.now() - DAYS * 86_400_000;

interface Orphan {
  Region: string;
  Snapshot: string;
  FormerVolume: string;
  Created: string;
  SizeGiB: number;
  Tier: string;
  EstPerMonth: string;
  Description: string;
}

const isKept = (s: Snapshot): boolean =>
  (s.Tags ?? []).some((t) => t.Key?.toLowerCase() === "keep" && t.Value?.toLowerCase() === "true");

async function findOrphans(ec2: EC2Client, region: string): Promise<Orphan[]> {
  // 1. Every volume that still exists in the Region.
  const volumes = new Set<string>();
  for await (const page of paginateDescribeVolumes({ client: ec2 }, {})) {
    for (const v of page.Volumes ?? []) if (v.VolumeId) volumes.add(v.VolumeId);
  }
  // 2. Every snapshot that an AMI you own depends on, including disabled and deprecated AMIs.
  const amiSnapshots = new Set<string>();
  const images = paginateDescribeImages({ client: ec2 }, { Owners: ["self"], IncludeDisabled: true, IncludeDeprecated: true });
  for await (const page of images) {
    for (const img of page.Images ?? []) {
      for (const bdm of img.BlockDeviceMappings ?? []) if (bdm.Ebs?.SnapshotId) amiSnapshots.add(bdm.Ebs.SnapshotId);
    }
  }
  // 3. Your completed snapshots whose volume is gone, that no AMI needs, older than the cutoff.
  const orphans: Orphan[] = [];
  const snaps = paginateDescribeSnapshots({ client: ec2 }, { OwnerIds: ["self"], Filters: [{ Name: "status", Values: ["completed"] }] });
  for await (const page of snaps) {
    for (const s of page.Snapshots ?? []) {
      if (!s.SnapshotId || !s.VolumeId || volumes.has(s.VolumeId)) continue;
      if (amiSnapshots.has(s.SnapshotId) || isKept(s)) continue;
      if ((s.StartTime?.getTime() ?? Date.now()) > cutoff) continue;
      const size = s.VolumeSize ?? 0;
      const archived = s.StorageTier === "archive";
      orphans.push({
        Region: region,
        Snapshot: s.SnapshotId,
        FormerVolume: s.VolumeId,
        Created: s.StartTime?.toISOString().slice(0, 10) ?? "",
        SizeGiB: size,
        Tier: s.StorageTier ?? "standard",
        EstPerMonth: `<= $${(size * (archived ? ARCHIVE_PER_GB : STANDARD_PER_GB)).toFixed(2)}`,
        Description: (s.Description ?? "").slice(0, 60),
      });
    }
  }
  return orphans.sort((a, b) => b.SizeGiB - a.SizeGiB);
}

async function act(ec2: EC2Client, o: Orphan): Promise<boolean> {
  try {
    if (ARCHIVE) {
      if (o.Tier === "archive") return false; // already archived
      await ec2.send(new ModifySnapshotTierCommand({ SnapshotId: o.Snapshot, StorageTier: "archive" }));
      console.log(`archiving ${o.Snapshot} (${o.Region})`);
      return true;
    } else {
      await ec2.send(new DeleteSnapshotCommand({ SnapshotId: o.Snapshot }));
      console.log(`deleted ${o.Snapshot} (${o.Region})`);
      return true;
    }
  } catch (err) {
    const e = err as { name?: string; message?: string };
    console.error(`skipped ${o.Snapshot}: ${e.name ?? "Error"}: ${e.message ?? String(err)}`);
    return false;
  }
}

async function main(): Promise<void> {
  let acted = 0;
  let total = 0;
  let gib = 0;
  let monthly = 0;
  for (const region of regions) {
    const ec2 = new EC2Client({ region });
    const orphans = await findOrphans(ec2, region);
    total += orphans.length;
    gib += orphans.reduce((sum, o) => sum + o.SizeGiB, 0);
    monthly += orphans.reduce((sum, o) => sum + o.SizeGiB * (o.Tier === "archive" ? ARCHIVE_PER_GB : STANDARD_PER_GB), 0);
    if (orphans.length) console.table(orphans);
    if (!APPLY) continue;
    for (const o of orphans) {
      if (acted >= MAX) break;
      if (await act(ec2, o)) acted++;
    }
  }
  console.log(`${total} orphaned snapshots older than ${DAYS} days, ${gib} GiB of source volume size.`);
  console.log(`At most $${monthly.toFixed(2)} per month at us-east-1 rates (snapshots are incremental; the billed size is usually lower).`);
  if (!APPLY) console.log("Report only: nothing was deleted. Re-run with --apply (or --apply --archive).");
  else console.log(`${ARCHIVE ? "Archive" : "Delete"} requested for ${acted} snapshots (limit --max ${MAX}).`);
}

main().catch((err) => {
  console.error(err);
  process.exit(1);
});

npm install @aws-sdk/client-ec2
npm install --save-dev tsx typescript

# Report only, two Regions, snapshots older than 30 days
AWS_PROFILE=readonly npx tsx find-orphaned-ebs-snapshots.ts --regions us-east-1,eu-west-1

# Archive up to 3 of them instead of deleting
AWS_PROFILE=cleanup npx tsx find-orphaned-ebs-snapshots.ts --regions us-east-1 --apply --archive --max 3

# Delete up to 10, only if older than 90 days
AWS_PROFILE=cleanup npx tsx find-orphaned-ebs-snapshots.ts --regions us-east-1 --days 90 --apply --max 10

$ AWS_PROFILE=readonly npx tsx find-orphaned-ebs-snapshots.ts --regions us-east-1 --days 30
┌─────────┬─────────────┬──────────────────────────┬─────────────────────────┬──────────────┬─────────┬────────────┬─────────────┬─────────────────────────────────────────────┐
│ (index) │ Region      │ Snapshot                 │ FormerVolume            │ Created      │ SizeGiB │ Tier       │ EstPerMonth │ Description                                 │
├─────────┼─────────────┼──────────────────────────┼─────────────────────────┼──────────────┼─────────┼────────────┼─────────────┼─────────────────────────────────────────────┤
│ 0       │ 'us-east-1' │ 'snap-0c4b5a69788011223' │ 'vol-0c7d6e5f403122938' │ '2025-06-30' │ 1000    │ 'archive'  │ '<= $12.50' │ 'end of project archive'                    │
│ 1       │ 'us-east-1' │ 'snap-0f1e2d3c4b5a69788' │ 'vol-0a9b8c7d6e5f40312' │ '2025-11-03' │ 500     │ 'standard' │ '<= $25.00' │ 'pre-migration backup db-01'                │
│ 2       │ 'us-east-1' │ 'snap-0e2d3c4b5a6978801' │ 'vol-0b8c7d6e5f4031229' │ '2026-02-17' │ 200     │ 'standard' │ '<= $10.00' │ ''                                          │
│ 3       │ 'us-east-1' │ 'snap-0d3c4b5a697880112' │ 'vol-0e6f5a4b3c2d10987' │ '2026-04-02' │ 100     │ 'standard' │ '<= $5.00'  │ 'copy of reports volume for eu-west-1 test' │
└─────────┴─────────────┴──────────────────────────┴─────────────────────────┴──────────────┴─────────┴────────────┴─────────────┴─────────────────────────────────────────────┘
4 orphaned snapshots older than 30 days, 1800 GiB of source volume size.
At most $52.50 per month at us-east-1 rates (snapshots are incremental; the billed size is usually lower).
Report only: nothing was deleted. Re-run with --apply (or --apply --archive).

$ AWS_PROFILE=cleanup npx tsx find-orphaned-ebs-snapshots.ts --regions us-east-1 --days 30 --apply --archive --max 3
(same table)
archiving snap-0f1e2d3c4b5a69788 (us-east-1)
archiving snap-0e2d3c4b5a6978801 (us-east-1)
archiving snap-0d3c4b5a697880112 (us-east-1)
4 orphaned snapshots older than 30 days, 1800 GiB of source volume size.
At most $52.50 per month at us-east-1 rates (snapshots are incremental; the billed size is usually lower).
Archive requested for 3 snapshots (limit --max 3).