Why is my deleted EBS volume still showing as compliant or noncompliant in my AWS Config rule?

Short description

Amazon EBS volumes are durable, block-level storage devices that you can attach to Amazon Elastic Compute Cloud (Amazon EC2) instances. To delete Amazon EBS volumes:

• Stop the Amazon EC2 instance, detach the Amazon EBS volume, and then run the DeleteVolume API call.
• Set the DeleteOnTermination attribute to true, and then run the TerminateInstances API call. For more information, see Preserve data when an instance is terminated.

Resolution

Amazon EBS volumes deleted with the DeleteVolume API call

Amazon EBS volumes deleted with the DeleteVolume API call start a DescribeVolumes API call on volume. The DescribeVolumes API call returns an InvalidVolume.NotFound error code, and the Amazon EBS volume is removed from the list of resources in AWS Config. The updated volume configuration is recorded with a ResourceDeleted status, and then is delivered to an Amazon Simple Storage Service (Amazon S3) bucket.

Amazon EBS volumes deleted with the TerminateInstances API call

Terminated Amazon EC2 instances use the DeleteOnTermination attribute to determine when to delete the volume for each attached EBS volume. By default, the DeleteOnTermination attribute for the root volume of an Amazon EC2 instance is set to true. The attribute is set to false for all other volume types. Amazon EC2 deletes the Amazon EBS volume when the DeleteOnTermination attribute is set to true, but the action doesn't publish the DeleteVolume API call. The AWS Config uses the DeleteVolume API call to activate the rule, and the resource changes aren't recorded for the EBS volume. The EBS volume continues to show a compliant or noncompliant status.

AWS Config performs a baseline check every six to 24 hours for new configuration items with the ResourceDeleted status. The AWS Config rule removes the deleted EBS volumes from the evaluation results. If you choose the "Include deleted resources" check box in the baseline check, then you can disregard any deleted Amazon EBS volumes.

Note: Amazon EBS volumes associated with Amazon EC2 instances created by Auto Scaling groups use the TerminateInstances API call to terminate the instance.

Related information

Delete an Amazon EBS volume

How can I prevent my Amazon EBS volumes from being deleted when I terminate Amazon EC2 instances?