- Newest
- Most votes
- Most comments
I think the right answer is Data Pipeline Automation which comes and run a few scripts via AWS Glue and it get terminated after a while
Based on your CloudTrail log, it appears that an EC2 instance (i-00f009be7899edb27) was created in the us-west-2 region on June 2, 2025, through AWS Data Pipeline. However, since you can't see it in the EC2 console, there are several possible explanations and troubleshooting steps you can take:
-
Region Check: First, confirm you're looking in the correct AWS region (us-west-2). Your CloudTrail log indicates this is the region where the instance was created.
-
Instance State: The instance may have been stopped or terminated after creation. Check for stopped or terminated instances in the EC2 dashboard, as these might not appear in the default "Running instances" view.
-
EC2 Global View: Use the EC2 Global View feature to see all your EC2 resources across all regions. This can help determine if the instance exists in a different region.
-
Check CloudTrail for Termination: Look for a "TerminateInstances" event in CloudTrail that might indicate the instance was terminated shortly after creation.
-
Data Pipeline Automation: Since the instance was created by Data Pipeline (as shown by the "invokedBy": "datapipeline.amazonaws.com" in your CloudTrail log), it's possible that the pipeline was configured to terminate the instance after completing its task. This is common for temporary workloads.
-
Permissions Issue: Verify that you have the necessary IAM permissions to view EC2 instances in this account.
-
Filters in Console: Make sure no filters are applied in the EC2 dashboard that might be hiding your instance.
If you still can't locate the instance after these steps, you might want to check the Data Pipeline configuration to understand the lifecycle management of resources it creates, as it may have been programmed to terminate instances automatically after task completion.
Sources
EC2 Instance not visible on EC2 Dashboard on my account | AWS re:Post
My amazon aws ec2 instance disappeared or got replaced | AWS re:Post
EC2 Instance is not visible | AWS re:Post
answered a year ago
You have shared only part of the cloudtrail event. Does the event say "i-00f009be7899edb27" is created. Does it have any error messages - search for errorCode or errorMessages in cloudtrail event.

Yes, and they can scan CloudTrail events in the same region by the
eventNamefield valueTerminateInstancesto see when the instance was terminated and which identity requested the termination.