CODEWITHSUNDEEP
amazon-web-servicesamazon-ec2aws-cli
d33tah
d33tah

Reputation: 11598

Recover details about an instance that's not available through describe-instances anymore?

I'm hunting down a misbehaving EC2 instance, whose ID I found in my billing logs. I can't do describe-instances on it anymore since it died a few days ago. Is there a way to get its equivalent, i.e. does AWS log this kind of information anywhere? In this particular case, I needed to find out which SSH key it was tied to, but the more details, the merrier.

Upvotes: 0

Views: 64

Answers (2)

gdh
gdh

Reputation: 13702

It is not possible to retrieve meta data information of terminated instances.

In future, you can try some alternate approach. For ex: Use AWS Config and add a custom rule write a little lambda function which which saves the meta data of your instances and trigger the lambda function periodically.

Upvotes: 0

Parsifal
Parsifal

Reputation: 4526

You can get this information from CloudTrail, as long as it happened in the current region and last 90 days.

While you can do it with the Console, you will probably find the CloudTrail CLI easier. Start with this:

aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=RunInstances --no-paginate > /tmp/$$

This dumps all (?) of the RunInstances events to a file, which you can then open in your editor (check the docs; I think that --no-paginate will dump everything, but if you have a lot of events you might have to manually request additional pages).

A better long-term solution is to enable CloudTrail logging to an S3 bucket. This gathers events across all regions, and for a multi-account organization, all accounts. You can then use a bucket life-cycle policy to hold onto those events as long as you think you'll need them. It is, however, somewhat more challenging to query against events stored in S3.

Upvotes: 1

Related Questions