Cannot delete requester-managed VPC endpoints blocking VPC and Elastic IP deletion in eu-west-3

Hi Davide,

This is expected behavior — requester-managed VPC endpoints cannot be deleted directly by users, even with the CLI (delete-vpc-endpoints) or --force. There is no force-delete flag for this endpoint type. They are created and owned by the AWS service (in your case, AWS Copilot / ECS via PrivateLink), and the only supported way to remove them is to delete the resource that created them, after which the service automatically detaches the ENIs and deletes the endpoint.

The catch in your situation: you've already deleted the CloudFormation stacks and ECS clusters, so the "owning" resource appears gone — but the endpoint is now orphaned. Copilot environments create these interface endpoints (e.g. for ECR, Secrets Manager, CloudWatch Logs, or a service-to-service PrivateLink) as part of the environment stack. If a stack was deleted out-of-order or partially, the endpoint can be left behind with no owner you can act on. When that happens, you cannot clean it up yourself — AWS Support has to remove it from the backend.

Recommended steps

1. Confirm what created the endpoints (CloudTrail)

In CloudTrail → Event history, filter by Resource name = vpce-0c01f97d875f38692 (and the second one) and look at the CreateVpcEndpoint event. Check the userIdentity / tags to confirm it was the Copilot/ECS environment stack. This also gives you the exact identifiers Support will ask for.

2. Look for any leftover owning resource

Even if the main stacks are gone, check for:

• Any remaining CloudFormation stacks in DELETE_FAILED / REVIEW_IN_PROGRESS state (Copilot *-env stacks are the usual culprit)

• The service names vpce-svc-080a944e49e5b2f75 / vpce-svc-0893e7a34bf01cdfa — search whether they map to a load balancer / endpoint service still in the account

If you find a stuck stack, deleting it (retaining/skipping the failed resource) often makes the service tear the endpoint down automatically.

3. If the endpoints are truly orphaned → open a Support case (free)

You do not need paid support for this. This class of issue (orphaned requester-managed endpoint / requester-managed ENI blocking VPC + EIP deletion) is handled via a Technical Support case, and account/resource-cleanup requests like this are covered under Basic Support (free) through the Support Center — they are not billable troubleshooting. Open a case under Account and billing → Service: VPC, provide:

• Region: eu-west-3

• Endpoint IDs: vpce-0c01f97d875f38692, vpce-01fed3d3c2a374641

• The blocking ENIs, EIP eipalloc-072ffb72ca963bd8e, and VPC vpc-09c040c4c667bf628

Ask them to remove the orphaned requester-managed endpoints from the backend. Once they do, the ENIs detach, you can release the Elastic IP, and the default VPC delete will succeed.