Automate AWS Resource Cleanup

This skill automates the identification and removal of unused AWS resources to eliminate waste. It targets storage (unattached EBS volumes, EBS snapshots older than 90 days, incomplete multipart S3 uploads, old S3 object versions), compute (EC2 instances stopped over 30 days, unused AMIs and their snapshots, unused Elastic IPs), and networking (unused load balancers, unused NAT gateways, orphaned ENIs).

Its cleanup scripts default to dry-run: a representative example lists unattached EBS volumes and prints what would be deleted, with the actual delete-volume call commented out until explicitly enabled:

#!/bin/bash
### cleanup-unused-ebs.sh

echo "Finding unattached EBS volumes..."
VOLUMES=$(aws ec2 describe-volumes \
  --filters Name=status,Values=available \
  --query 'Volumes[*].VolumeId' \
  --output text)

for vol in $VOLUMES; do
  echo "Would delete: $vol"
  # Uncomment to actually delete:
  # aws ec2 delete-volume --volume-id $vol
done

The same pattern covers old-snapshot cleanup and releasing unused Elastic IPs, plus an S3 lifecycle policy that transitions objects to Standard-IA at 90 days and Glacier at 180, expires noncurrent versions after 30 days, and aborts incomplete multipart uploads after 7. A cost-impact calculator estimates monthly and annual savings from unattached EBS volumes and unused Elastic IPs using current per-GB and per-hour rates, and an automated cleanup Lambda deletes volumes unattached for over 7 days on a schedule. It also covers multi-account cleanup via AWS Organizations, a CloudWatch billing-anomaly alarm, and optional Kiro CLI chat commands to trigger analysis, script generation, or scheduled cleanup.

The cleanup workflow runs four phases: a read-only discovery phase (run describe commands, generate a cost-impact report, review with the team), a validation phase (verify resources are truly unused, check dependencies, notify resource owners), an execution phase (dry-run first, review proposed changes, then execute), and a verification phase (confirm deletions, monitor for issues, document savings). An eight-item safety checklist backs this up: dry-run first, verify no dependencies, check ownership tags, notify stakeholders, snapshot critical data, test in non-production first, keep a rollback plan ready, and document all deletions.

Use it to find and calculate savings from unused AWS resources, and to execute cleanup only after the discovery and validation phases confirm a resource is genuinely unused. Risk mitigation is explicit and resource-specific: deleting unattached volumes needs confirmation there's no planned reattachment, removing old snapshots needs a compliance check, and releasing Elastic IPs needs a DNS-record check - and regardless of resource type, cleanup should always maintain 30-day backup retention, use AWS Backup for critical resources, and have tested restore procedures before any deletion runs for real.

Input is AWS credentials/profile with describe and delete permissions across the target resource types. Output is a discovery report of candidate resources with estimated cost savings, dry-run cleanup scripts for review, and (once approved) executed deletions with a documented audit trail.

It uses the AWS CLI and boto3 across EC2, S3, CloudWatch, and AWS Organizations, and optionally the Kiro CLI for chat-driven cleanup commands.

Cloud engineers and FinOps teams reducing AWS waste who need automated discovery and cost-impact calculation paired with a dry-run-first, checklist-backed execution process rather than ad hoc resource deletion.