How to identify when an EBS volume is detached from the Instance ?

Greetings!

When an Amazon Elastic Block Store (EBS) volume is detached from an EC2 instance, you can determine the exact time and date of the detachment by checking the AWS CloudTrail logs. AWS CloudTrail provides a record of actions made on your account, including EBS volume attachment and detachment events.

Here's how you can find the exact time and date when an EBS volume was detached:

Open the AWS Management Console and navigate to the CloudTrail service.

In the CloudTrail dashboard, click on Event history.

Use the filter options to narrow down the events. For the Event name filter, select DetachVolume. You can also filter by the specific volume ID if you know it.

Review the events listed. For each event, you can see details like the event time, source IP, user, and more. Click on the specific event to see more details.

In the event details, you should see the volume ID and the exact time and date when the volume was detached.

If you don't have CloudTrail set up or if the logs have expired (CloudTrail retains event history for 90 days for the free tier), then it might be challenging to determine the exact detachment time. In such cases, you might need to rely on any monitoring or logging solutions you have in place, or any manual records you might have kept.

In the future, if you anticipate needing to track such events, ensure that CloudTrail is enabled and properly configured to capture and store logs for the desired duration. You might also consider setting up Amazon CloudWatch Alarms or Events to notify you of specific activities, such as EBS volume detachments.

Please let me know if I answered your question :)

There is no direct way to get this, as there are only notifications sent by EBS to Event Bridge for:

1. attachVolume
2. deleteVolume
3. createVolume

This means that to find detachVolume events you need to either use CloudTrail or you need to use AWS Config (if you have it enabled). For CloudTrail you can then create a Metric Filter and an Alarm to notify you when detachVolume was called. Using this alarm you can invoke a lambda function that uses the describeVolumes API to see when the volume becomes available after the detachVolume call.

Hey, AWS CloudTrail logs should have this information. You can filter by the event name DetachVolume to see when exactly the EBS volume was detached. It should give you both the time and date when the Metric Filter and an Alarm volume changed to an available state.

Hi, you can do this automatically via an advanced solution like this one: https://aws.amazon.com/blogs/mt/controlling-your-aws-costs-by-deleting-unused-amazon-ebs-volumes/

In this solution, the lambda decides to notify and then delete the unused volume after snaphotting it for recovery (if needed)

So, you can follow same path and remove the parts that you don't want (deletion, etc.)

Best,

Didier