public IPv4 is charged even when it is attached

"""Count every charged public IPv4 address and total the monthly cost.

Since 1 February 2024 AWS charges for ALL public IPv4 addresses, attached or not,
so counting only the unassociated ones -- which is what most published advice
tells you to do -- misses the majority of the bill.
"""
import argparse
import logging
import sys

import boto3

logging.basicConfig(level=logging.INFO, format="%(asctime)s %(levelname)s %(message)s")
log = logging.getLogger("public_ipv4_audit")

# Charged since 2024-02-01 for every public IPv4 address, in use or idle.
HOURLY_USD = 0.005
MONTHLY_USD = HOURLY_USD * 24 * 30


def summarise(elastic_ips, interface_ips):
    """Pure decision function over two lists of addresses.

    Splits the total into what you can release today and what needs an
    architectural change, because those are different pieces of work.
    """
    releasable = [a for a in elastic_ips if not a.get("AssociationId")]
    attached_eip = [a for a in elastic_ips if a.get("AssociationId")]
    total = len(elastic_ips) + len(interface_ips)
    return {
        "total": total,
        "monthly_usd": total * MONTHLY_USD,
        "releasable_now": releasable,
        "attached_elastic": len(attached_eip),
        "service_allocated": len(interface_ips),
    }


def main():
    ap = argparse.ArgumentParser()
    ap.add_argument("--region", default="us-east-1")
    ap.add_argument("--release", help="allocation id of an unassociated address")
    ap.add_argument("--apply", action="store_true")
    args = ap.parse_args()

    ec2 = boto3.client("ec2", region_name=args.region)

    eips = ec2.describe_addresses()["Addresses"]
    # Addresses other services allocated: ALBs, NAT Gateways, public RDS, EKS nodes.
    enis = [n for n in ec2.describe_network_interfaces()["NetworkInterfaces"]
            if n.get("Association", {}).get("PublicIp")
            and not n.get("Association", {}).get("AllocationId")]

    s = summarise(eips, enis)
    log.info("%d public IPv4 addresses -- about $%.2f/month",
             s["total"], s["monthly_usd"])
    log.info("  %d Elastic IPs attached to something", s["attached_elastic"])
    log.info("  %d allocated by other services (ALB, NAT, RDS, EKS)",
             s["service_allocated"])
    for a in s["releasable_now"]:
        log.warning("  RELEASABLE %s (allocation %s) -- $%.2f/month",
                    a["PublicIp"], a.get("AllocationId"), MONTHLY_USD)

    if not s["releasable_now"]:
        log.info("nothing is unassociated; the saving here is architectural, "
                 "not a cleanup -- fewer public addresses, not fewer idle ones")

    if args.release:
        if args.apply:
            ec2.release_address(AllocationId=args.release)
            log.info("released %s", args.release)
        else:
            log.info("WOULD release %s -- pass --apply", args.release)
    return 0


if __name__ == "__main__":
    sys.exit(main())

/**
 * Count every charged public IPv4 address and total the monthly cost.
 *
 * Since 1 February 2024 AWS charges for ALL public IPv4 addresses, attached or
 * not, so counting only the unassociated ones -- which is what most published
 * advice tells you to do -- misses the majority of the bill.
 */
import {
  EC2Client,
  DescribeAddressesCommand,
  DescribeNetworkInterfacesCommand,
  ReleaseAddressCommand,
} from '@aws-sdk/client-ec2';

// Charged since 2024-02-01 for every public IPv4 address, in use or idle.
const HOURLY_USD = 0.005;
const MONTHLY_USD = HOURLY_USD * 24 * 30;

/**
 * Pure decision function over two lists of addresses.
 *
 * Splits the total into what you can release today and what needs an
 * architectural change, because those are different pieces of work.
 */
export function summarise(elasticIps, interfaceIps) {
  const releasable = elasticIps.filter((a) => !a.AssociationId);
  const total = elasticIps.length + interfaceIps.length;
  return {
    total,
    monthlyUsd: total * MONTHLY_USD,
    releasableNow: releasable,
    attachedElastic: elasticIps.length - releasable.length,
    serviceAllocated: interfaceIps.length,
  };
}

async function main() {
  const region = process.env.AWS_REGION ?? 'us-east-1';
  const apply = process.argv.includes('--apply');
  const release = process.argv[process.argv.indexOf('--release') + 1];
  const ec2 = new EC2Client({ region });

  const { Addresses = [] } = await ec2.send(new DescribeAddressesCommand({}));
  const { NetworkInterfaces = [] } = await ec2.send(new DescribeNetworkInterfacesCommand({}));
  const enis = NetworkInterfaces.filter(
    (n) => n.Association?.PublicIp && !n.Association?.AllocationId);

  const s = summarise(Addresses, enis);
  console.log(`${s.total} public IPv4 addresses -- about $${s.monthlyUsd.toFixed(2)}/month`);
  console.log(`  ${s.attachedElastic} Elastic IPs attached to something`);
  console.log(`  ${s.serviceAllocated} allocated by other services (ALB, NAT, RDS, EKS)`);
  for (const a of s.releasableNow) {
    console.warn(`  RELEASABLE ${a.PublicIp} (allocation ${a.AllocationId}) -- $${MONTHLY_USD.toFixed(2)}/month`);
  }
  if (!s.releasableNow.length) {
    console.log('nothing is unassociated; the saving here is architectural, not a cleanup');
  }

  if (process.argv.includes('--release')) {
    if (apply) {
      await ec2.send(new ReleaseAddressCommand({ AllocationId: release }));
      console.log(`released ${release}`);
    } else {
      console.log(`WOULD release ${release} -- pass --apply`);
    }
  }
}

if (import.meta.url === `file://${process.argv[1]}`) main();

from public_ipv4_audit import summarise, MONTHLY_USD


def test_attached_addresses_still_cost_money():
    """The heart of it: nothing is releasable, and there is still a bill."""
    eips = [{"PublicIp": "1.2.3.4", "AssociationId": "eipassoc-1"}]
    s = summarise(eips, [])
    assert s["releasable_now"] == []
    assert s["monthly_usd"] > 0


def test_service_allocated_addresses_are_counted():
    s = summarise([], [{"Association": {"PublicIp": "5.6.7.8"}}] * 3)
    assert s["total"] == 3
    assert s["service_allocated"] == 3


def test_unassociated_addresses_are_flagged():
    eips = [{"PublicIp": "1.2.3.4", "AllocationId": "eipalloc-1"}]
    s = summarise(eips, [])
    assert len(s["releasable_now"]) == 1


def test_total_cost_is_per_address():
    s = summarise([{"PublicIp": "a", "AssociationId": "x"}] * 10, [])
    assert round(s["monthly_usd"], 2) == round(10 * MONTHLY_USD, 2)


def test_empty_account_is_free():
    assert summarise([], [])["monthly_usd"] == 0

import { test } from 'node:test';
import assert from 'node:assert/strict';
import { summarise } from './public-ipv4-audit.mjs';

test('attached addresses still cost money', () => {
  const s = summarise([{ PublicIp: '1.2.3.4', AssociationId: 'eipassoc-1' }], []);
  assert.deepEqual(s.releasableNow, []);
  assert.ok(s.monthlyUsd > 0);
});

test('service-allocated addresses are counted', () => {
  const enis = Array.from({ length: 3 }, () => ({ Association: { PublicIp: '5.6.7.8' } }));
  const s = summarise([], enis);
  assert.equal(s.total, 3);
  assert.equal(s.serviceAllocated, 3);
});

test('unassociated addresses are flagged', () => {
  const s = summarise([{ PublicIp: '1.2.3.4', AllocationId: 'eipalloc-1' }], []);
  assert.equal(s.releasableNow.length, 1);
});

test('an empty account is free', () => {
  assert.equal(summarise([], []).monthlyUsd, 0);
});