Missing Ec2, trying to locate it

When an EC2 instance appears to be missing but is still running (as you've verified by the IP), there are several steps you can take to locate it:

1. Check all AWS regions: Even though you know the region, double-check by using EC2 Global View, which shows all your EC2 resources across all regions. This can help locate instances that might be in unexpected regions.

2. Verify you're using the correct AWS account: Since you've already checked multiple root accounts, ensure you're not missing any other accounts that might have been used to create this instance.

3. Check for filters in the EC2 console: Make sure no filters are applied in the EC2 dashboard that might be hiding your instance.

4. Review CloudTrail logs: Look for any "RunInstances" events across your accounts that might indicate when and where the instance was created. This can provide information about which account and user created the instance.

5. Check IAM permissions: Ensure your IAM user has the necessary permissions to view EC2 instances in the AWS Management Console.

6. Use AWS Config: If enabled, AWS Config might have records of your EC2 resources over time, which could help identify the account.

7. Review AWS Billing: Check billing information across accounts for charges related to EC2 instances in the region you know the instance is running in.

8. Network tracing: Since you know the IP address, you might be able to trace network connections to determine which VPC and account the instance belongs to.

If you've exhausted all these options and still can't locate the instance, consider contacting AWS Support. They may be able to help identify which account owns the IP address in question, especially if you can provide evidence that you're authorized to manage this resource.
Sources
EC2 Instance has disappeared | AWS re:Post
Issue: EC2 Instance Missing or Terminated Without Clear Cause | AWS re:Post
EC2 Instance is not visible | AWS re:Post

Another effective approach is to use AWS Config Aggregator with Advanced Queries to locate the EC2 instance in single or multiple accounts. For Single account search : Go to the AWS Config service in the AWS Console >Advance query

SELECT 
  resourceId, 
  accountId, 
  awsRegion, 
  configuration.privateIpAddress, 
  configuration.publicIpAddress 
WHERE 
  resourceType = 'AWS::EC2::Instance' 
  AND (configuration.privateIpAddress = '10.0.0.5' 
       OR configuration.publicIpAddress = '203.0.113.10')

For multiple account search : If you're using AWS Control Tower and have set up AWS Config with an aggregator (e.g., aws-control-tower-aggregator), you can query across your entire AWS Organization to find resources.

Here’s how to do it: Steps: Go to the AWS Config service in the AWS Console.

Select your aggregator (usually named aws-control-tower-aggregator if set up by Control Tower).

Use Advanced query with SQL-like syntax to search for the instance by IP. Example Query (Public or Private IP):

SELECT 
  resourceId, 
  accountId, 
  awsRegion, 
  configuration.privateIpAddress, 
  configuration.publicIpAddress 
WHERE 
  resourceType = 'AWS::EC2::Instance' 
  AND (configuration.privateIpAddress = '10.0.0.5' 
       OR configuration.publicIpAddress = '203.0.113.10')

Replace the IPs with the ones you’re trying to trace.

This will return the instance ID, account ID, and region, helping you pinpoint exactly where the EC2 instance resides across your multi-account setup. Reference - https://docs.aws.amazon.com/config/latest/developerguide/example-query.html