Analyze Elastic IP utilization historical past utilizing Amazon Athena and AWS CloudTrail

An AWS Elastic IP (EIP) tackle is a static, public, and distinctive IPv4 tackle. Allotted solely to your AWS account, the EIP stays underneath your management till you determine to launch it. It may be allotted to your Amazon Elastic Compute Cloud (Amazon EC2) occasion or different AWS sources equivalent to load balancers.

EIP addresses are designed for dynamic cloud computing as a result of they are often re-mapped to a different occasion to masks any disruptions. These EIPs are additionally used for functions that should make exterior requests to companies that require a constant tackle for enable listed inbound connections. As your software utilization varies, these EIPs may see sporadic use over weeks and even months, resulting in potential accumulation of unused EIPs which will inadvertently inflate your AWS expenditure.

On this publish, we present you find out how to analyze EIP utilization historical past utilizing AWS CloudTrail and Amazon Athena to have a greater perception of your EIP utilization sample in your AWS account. You should utilize this answer often as a part of your cost-optimization efforts to soundly take away unused EIPs to cut back your prices.

Answer overview

This answer makes use of exercise logs from CloudTrail and the ability of Athena to conduct a complete evaluation of historic EIP attachment exercise inside your AWS account. CloudTrail, a vital AWS service, meticulously logs API exercise inside an AWS account.

Athena is an interactive question service that simplifies information evaluation in Amazon Easy Storage Service (Amazon S3) utilizing customary SQL. It’s a serverless service, eliminating the necessity for infrastructure administration and costing you just for the queries you run.

By extracting detailed info from CloudTrail and querying it utilizing Athena, this answer streamlines the method of information assortment, evaluation, and reporting of EIP utilization inside an AWS account.

To assemble EIP utilization reporting, this answer compares snapshots of the present EIPs, specializing in their most up-to-date attachment inside a customizable 3-month interval. It then determines the frequency of EIP attachments to sources. An attachment depend better than zero means that the EIPs are actively in use. In distinction, an attachment depend of zero signifies that these EIPs are idle and may be launched, aiding in figuring out potential areas for value discount.

Within the following sections, we present you find out how to deploy the answer utilizing AWS CloudFormation after which run an evaluation.

Conditions

Full the next prerequisite steps:

1. In case your account doesn’t have CloudTrail enabled, create a path, then seize the S3 bucket title to make use of later within the implementation steps.
2. Obtain the CloudFormation template from the repository. You want this template.yaml file for the implementation steps.

Deploy the answer

On this part, you utilize AWS CloudFormation to create the required sources. AWS CloudFormation is a service that helps you mannequin and arrange your AWS sources so that you could spend much less time managing these sources and extra time focusing in your functions that run in AWS.

The CloudFormation template creates Athena views and a desk to go looking previous AssociateAddress occasions in CloudTrail, an AWS Lambda perform to gather snapshots of present EIPs, and an S3 bucket to retailer the evaluation outcomes.

Full the next steps:

1. On the AWS CloudFormation console, select on Create stack and select With new sources (customary).
2. Within the Specify Template part, select an present template and add the template.yaml file downloaded from the stipulations.
3. Within the Specify stack particulars part, enter your most well-liked stack title and the prevailing CloudTrail S3 location, and keep the default settings for the opposite parameters.
4. On the backside of the Evaluation and create web page, choose the acknowledgement examine field, then select Submit.

Watch for the stack to be created. It ought to take a couple of minutes to finish. You’ll be able to open the AWS CloudFormation console to view the stack creation course of.

Run an evaluation

You have got configured the answer to run your EIP attachments evaluation. Full the next steps to research your EIP attachment historical past. Should you’re utilizing Athena for the primary time in your account, you have to arrange a question consequence location in Amazon S3.

1. On the Athena console, navigate to the question editor.
2. For Database, select default.
3. Enter the next question and select Run question:

choose 
eip.publicip,
eip.allocationid,
eip.area,
eip.accountid,
eip.associationid, 
eip.PublicIpv4Pool,
max(associate_ip_event.eventtime) as latest_attachment,
depend(associate_ip_event.associationid) as attachmentCount
from eip LEFT JOIN associate_ip_event on associate_ip_event.allocationid = eip.allocationid 
group by 1,2,3,4,5,6

All of the required tables are created underneath the default database.

Now you can run a question on the CloudTrail logs to look again in time for the EIP attachment. This question supplies you with higher perception to soundly launch idle EIPs with a purpose to scale back prices by displaying how continuously every particular EIP was beforehand connected to any sources.

This report will present the next info:

• Public IP
• Allocation ID (the ID that AWS assigns to signify the allocation of the EIP tackle to be used with situations in a VPC)
• Area
• Account ID
• latest_attachment date (the final time EIP was connected to a useful resource)
• attachmentCount (variety of attachments)
• The affiliation ID for the tackle (if this discipline is empty, the EIP is idle and never connected to any sources)

The next screenshot reveals the question outcomes.

Clear up

To optimize value, clear up the sources you deployed for this publish by finishing the next steps:

1. Delete the contents in your S3 buckets (eip-analyzer-eipsnapshot-* and eip-analyzer-athenaresulteipanalyzer-*).
2. Delete the S3 buckets.
3. On the AWS CloudFormation console, delete the stack you created.

Conclusion

This publish demonstrated how one can analyze Elastic IP utilization historical past to have a greater perception of EIP attachment patterns utilizing Athena and CloudTrail. Take a look at the GitHub repo to often run this evaluation as a part of your cost-optimization technique to determine and launch inactive EIPs to cut back prices.

You may also use Athena to research logs from different AWS companies; for extra info, see Querying AWS service logs.

Moreover, you’ll be able to analyze exercise logs with AWS CloudTrail Lake and Amazon Athena. AWS CloudTrail Lake is a managed information lake that permits organizations to combination, immutably retailer, and question occasions recorded by CloudTrail for auditing, safety investigation, and operational troubleshooting. AWS CloudTrail Lake helps the gathering of occasions from a number of AWS areas and AWS accounts. For CloudTrail Lake, you pay for information ingestion, retention, and evaluation. Discuss with AWS CloudTrail Lake pricing web page for pricing particulars.

In regards to the Creator

Aidin Khosrowshahi is a Senior Technical Account Supervisor with Amazon Internet Providers primarily based out of San Francisco. He focuses on reliability, optimization, and bettering operational mechanisms along with his clients.