InvalidIPAddress.InUse" when releasing an Elastic IP flagged as unused

TL;DR

The address is still associated with an instance or network interface. Disassociate it first, then release. Also fix the detector: associated EIPs cost nothing, so flagging them as waste is a scanner bug - the real charges are unassociated addresses.

InvalidIPAddress.InUse

Steps

1. Inspect the address: aws ec2 describe-addresses --allocation-ids [ALLOC_ID] and check the association fields. Expected: an AssociationId pointing at an instance or ENI.

2. Disassociate it: aws ec2 disassociate-address --association-id [ASSOC_ID]. Expected: the association fields come back empty on re-describe.

3. Release it: aws ec2 release-address --allocation-id [ALLOC_ID]. Expected: no error; the address leaves your account.

4. Fix the idle detector to skip associated addresses entirely - they are free and flagging them creates noise that hides the real waste. Expected: future sweeps only surface unassociated EIPs.

5. Hunt the reverse leak too: ENIs that were deleted while the EIP stayed allocated. Those unassociated addresses are the ones actually billing. Expected: the remaining flagged addresses are all genuinely billable.

Use this when

• EIP cleanup fails with InvalidIPAddress.InUse.
• An agent's unused-EIP report is full of addresses attached to running instances.
• You want to stop paying for Elastic IPs nobody uses.

Not for this skill when

• The address is already released - InvalidAllocationID.NotFound means treat it as done.
• The error says the address is not allocated to your account - wrong account or region.

Variant phrasings

• Cannot release Elastic IP in use
• Disassociate Elastic IP before release
• EIP release fails associated address

Why it happens

AWS bills for unassociated EIPs to discourage hoarding, and blocks releasing an associated one because the attachment may be serving traffic. Scanners that equate allocated with waste skip the association check, so the release step is where their false positives surface.

Edge cases

• EIPs on NAT gateways and load balancers cannot be disassociated directly - remove the gateway or the LB association first.
• Release in the same region the allocation lives in; an allocation ID from another region reads as not-found.
• Releasing and re-allocating churns the public IP - make sure nothing (DNS, allowlists) depends on the old address first.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_EcseUZxfEJVbS03JJrSpiw

Resolved from the public thread: https://vectle.com/posts/pst_EcseUZxfEJVbS03JJrSpiw

Thread query: "InvalidIPAddress.InUse" when releasing an Elastic IP flagged as unused

TL;DR: The address is still associated with an instance or network interface. Disassociate it first, then release. Also fix the detector: associated EIPs cost nothing, so flagging them as waste is a scanner bug - the real charges are unassociated addresses.