Why do I have running Amazon EC2 instances that I didn't launch?

Resolution

Determine whether another AWS service or an authorized user on your AWS account launched the EC2 instances.

Another AWS service launched the instances

You can configure some AWS services to automatically launch EC2 instances.

Amazon EC2 Auto Scaling groups launch and terminate instances based on scaling policies, scheduled actions, or capacity. If you configure an EC2 Auto Scaling group, then the Auto Scaling group might launch instances without manual intervention. To remove your Auto Scaling configuration, delete your Auto Scaling infrastructure.

AWS CloudFormation templates can launch one or more instances as part of a stack. To delete the stack and all its resources, delete the stack from the CloudFormation console.

AWS Elastic Beanstalk environments include EC2 instances and EC2 Auto Scaling rules by default. Based on its configuration, an environment's Auto Scaling rules might launch instances. To terminate an environment and all its resources, terminate an Elastic Beanstalk environment.

Amazon EMR uses clusters and nodes that are groups of EC2 instances. To terminate the instances that are associated with an Amazon EMR cluster, terminate the cluster.

Amazon Elastic Container Service (Amazon ECS) might launch EC2 instances to host containers if you use the Amazon EC2 launch type. To stop instance launches through Amazon ECS, disassociate the Auto Scaling group capacity provider from your cluster.

Amazon Elastic Kubernetes Service (Amazon EKS) might launch instances to host Kubernetes node groups. To terminate the instances that are associated with a node group, delete the managed node group.

Spot Fleet and EC2 Fleet requests with the maintain type might launch instances to adhere to your configured capacity. To terminate the instances and stop new instance launches, cancel the Spot Fleet request or delete the EC2 Fleet.

AWS Systems Manager might launch EC2 instances through the aws:runInstances action as part of runbooks for Automation, a capability of AWS Systems Manager. To stop instance launches through Automation, stop the running Automation execution. To prevent future launches, update or delete the runbook.

Authorized users launched the instances

Use AWS CloudTrail to look for the RunInstances API call and identify the user that ran it. Or, check with other authorized account users to determine whether they launched the instances. To restrict who can launch instances in your account, use AWS Identity and Access Management (IAM) policies.

For information about how to terminate active instances, see How do I remove active resources that I no longer need in my AWS account?

If you're charged for instances that you terminated, then see Why was I charged for Amazon EC2 after I terminated all my instances?

A service or user didn't launch the instances

If a service or user didn't launch the unexpected instances, then check for unauthorized activity in your account.