My amazon aws ec2 instance disappeared or got replaced

0

Hello, up to few days ago i had a t3.xlarge instance at Stoccolma that i started every now and then... suddently today when i tried to start it, i saw that my instance had no name and its type was changed to t3.micro. Its operative system was also changed from windows to Linux. What happened? Has anyone entered my account and deleted my instance? Can you please help me restore it as it was ? I tried to enter this linux machine and i saw its empty, there is nothing in it, there is no sign of my old t3.xlarge. I have received no infos via mail from amazon.

asked a year ago1K views
1 Answer
1
Accepted Answer

Hello.

Is it possible to find the event in which that EC2 instance was created from CloudTrail's event history?
You should be able to find a "RunInstances" event in CloudTrail's event history if it was created within the last 90 days.
I think the event also includes information such as which IAM user created it.
https://docs.aws.amazon.com/awscloudtrail/latest/userguide/view-cloudtrail-events-console.html
a

You can also search for EC2 deletion events using the "TerminateInstances" event.
a

If these operations are being performed by a user you do not know, there is a possibility that unauthorized access is being performed, so please delete the IAM user in question.
https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_manage.html#id_users_deleting

Or please deactivate the IAM user.
https://docs.aws.amazon.com/IAM/latest/UserGuide/id_users_manage.html#id_users_deactivating

You may be looking at a different region, so try searching for EC2 in global view from the URL below.
https://us-east-1.console.aws.amazon.com/ec2globalview/home?region=us-east-1#

If EC2 has been deleted, if a backup of EC2 such as a snapshot remains, it is possible to restore data up to the time period when the snapshot was created.
However, please note that you will not be able to restore if there are no snapshots left.
https://docs.aws.amazon.com/prescriptive-guidance/latest/backup-recovery/restore.html

profile picture
EXPERT
answered a year ago
profile pictureAWS
EXPERT
reviewed a year ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions