AWS Public IP vs Elastic IP: Common Mistakes and Best Practices 2025

┌─────────────────────────────────────────────────┐
│                  Internet                       │
└──────────────────┬──────────────────────────────┘
                   │
           ┌───────▼────────┐
           │ Internet Gateway│
           └───────┬────────┘
                   │
┌──────────────────▼──────────────────────────────┐
│              VPC (10.0.0.0/16)                  │
│  ┌──────────────────────────────────────────┐  │
│  │   Public Subnet (10.0.1.0/24)            │  │
│  │                                           │  │
│  │   ┌─────────────────────────┐            │  │
│  │   │  EC2 Instance           │            │  │
│  │   │  Private IP: 10.0.1.45  │            │  │
│  │   │  Public IP: 54.x.x.x    │            │  │
│  │   └─────────────────────────┘            │  │
│  └──────────────────────────────────────────┘  │
└─────────────────────────────────────────────────┘

# Describe instances and view public IP
aws ec2 describe-instances \
  --instance-ids i-1234567890abcdef0 \
  --query 'Reservations[0].Instances[0].{PrivateIP:PrivateIpAddress,PublicIP:PublicIpAddress,State:State.Name}' \
  --output table

# Output example:
# -----------------------------------------
# |          DescribeInstances            |
# +-------------+--------------+----------+
# |  PrivateIP  |   PublicIP   |  State   |
# +-------------+--------------+----------+
# |  10.0.1.45  |  54.123.45.67|  running |
# +-------------+--------------+----------+

# Check if auto-assign public IP is enabled for a subnet
aws ec2 describe-subnets \
  --subnet-ids subnet-12345678 \
  --query 'Subnets[0].MapPublicIpOnLaunch'

# Allocate an Elastic IP in VPC
aws ec2 allocate-address --domain vpc

# Output:
# {
#     "PublicIp": "203.0.113.25",
#     "AllocationId": "eipalloc-abc123def456",
#     "Domain": "vpc",
#     "NetworkBorderGroup": "us-east-1"
# }

# Allocate with tags for better management
aws ec2 allocate-address \
  --domain vpc \
  --tag-specifications 'ResourceType=elastic-ip,Tags=[{Key=Name,Value=prod-web-server},{Key=Environment,Value=production}]'

# Associate EIP with an EC2 instance
aws ec2 associate-address \
  --instance-id i-1234567890abcdef0 \
  --allocation-id eipalloc-abc123def456

# Output:
# {
#     "AssociationId": "eipassoc-xyz789"
# }

# Associate EIP with a specific network interface
aws ec2 associate-address \
  --network-interface-id eni-11223344 \
  --allocation-id eipalloc-abc123def456 \
  --private-ip-address 10.0.1.45

# List all Elastic IPs in your account
aws ec2 describe-addresses \
  --query 'Addresses[*].{IP:PublicIp,AllocationId:AllocationId,AssociatedInstance:InstanceId,State:Association.PublicIp}' \
  --output table

# Find unattached (orphaned) Elastic IPs
aws ec2 describe-addresses \
  --query 'Addresses[?AssociationId==null].{IP:PublicIp,AllocationId:AllocationId}' \
  --output table

# Disassociate an Elastic IP
aws ec2 disassociate-address \
  --association-id eipassoc-xyz789

# Release an Elastic IP (returns it to AWS)
aws ec2 release-address \
  --allocation-id eipalloc-abc123def456

# Move EIP from failed instance to backup instance
aws ec2 associate-address \
  --instance-id i-backup-instance-id \
  --allocation-id eipalloc-abc123def456 \
  --allow-reassociation

# Allocate an Elastic IP
resource "aws_eip" "web_server" {
  domain = "vpc"

  tags = {
    Name        = "prod-web-server-eip"
    Environment = "production"
    ManagedBy   = "terraform"
  }
}

# Associate EIP with an EC2 instance
resource "aws_eip_association" "web_server" {
  instance_id   = aws_instance.web_server.id
  allocation_id = aws_eip.web_server.id
}

# Example EC2 instance
resource "aws_instance" "web_server" {
  ami           = "ami-0c55b159cbfafe1f0"
  instance_type = "t3.medium"
  subnet_id     = aws_subnet.public.id

  tags = {
    Name = "prod-web-server"
  }
}

# Output the Elastic IP address
output "elastic_ip" {
  value       = aws_eip.web_server.public_ip
  description = "The Elastic IP assigned to the web server"
}

AWSTemplateFormatVersion: '2010-09-09'
Description: 'EC2 instance with Elastic IP'

Resources:
  WebServerEIP:
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc
      Tags:
        - Key: Name
          Value: prod-web-server-eip
        - Key: Environment
          Value: production

  WebServerEIPAssociation:
    Type: AWS::EC2::EIPAssociation
    Properties:
      InstanceId: !Ref WebServerInstance
      EIP: !Ref WebServerEIP

  WebServerInstance:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: ami-0c55b159cbfafe1f0
      InstanceType: t3.medium
      SubnetId: !Ref PublicSubnet
      Tags:
        - Key: Name
          Value: prod-web-server

Outputs:
  ElasticIP:
    Description: The Elastic IP address
    Value: !Ref WebServerEIP
    Export:
      Name: !Sub '${AWS::StackName}-EIP'

# Find and calculate cost of orphaned EIPs
aws ec2 describe-addresses \
  --query 'Addresses[?AssociationId==null]' \
  --output json | jq 'length as $count | "Orphaned EIPs: \($count), Monthly cost: $\($count * 3.60)"'

# Launch dev instance with auto-assigned public IP
aws ec2 run-instances \
  --image-id ami-0c55b159cbfafe1f0 \
  --instance-type t3.micro \
  --subnet-id subnet-12345678 \
  --associate-public-ip-address \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=dev-test-server},{Key=Environment,Value=development}]'

# Production setup with Elastic IP
ALLOCATION=$(aws ec2 allocate-address --domain vpc --query 'AllocationId' --output text)
INSTANCE=$(aws ec2 run-instances --image-id ami-0c55b159cbfafe1f0 --instance-type t3.medium --subnet-id subnet-12345678 --query 'Instances[0].InstanceId' --output text)
aws ec2 associate-address --instance-id $INSTANCE --allocation-id $ALLOCATION

#!/bin/bash
# Failover script: Move EIP from failed primary to standby

PRIMARY_INSTANCE="i-primary123"
STANDBY_INSTANCE="i-standby456"
EIP_ALLOCATION="eipalloc-abc123"

# Check primary instance health
INSTANCE_STATE=$(aws ec2 describe-instances --instance-ids $PRIMARY_INSTANCE --query 'Reservations[0].Instances[0].State.Name' --output text)

if [ "$INSTANCE_STATE" != "running" ]; then
  echo "Primary instance failed. Failing over to standby..."
  aws ec2 associate-address \
    --instance-id $STANDBY_INSTANCE \
    --allocation-id $EIP_ALLOCATION \
    --allow-reassociation
  echo "Failover complete. EIP now points to standby instance."
fi

# Terraform: Instances behind ALB don't need EIPs
resource "aws_instance" "app_server" {
  count         = 3
  ami           = "ami-0c55b159cbfafe1f0"
  instance_type = "t3.medium"
  subnet_id     = element(aws_subnet.private.*.id, count.index)
  
  # No public IP needed - traffic comes through ALB
  associate_public_ip_address = false

  tags = {
    Name = "app-server-${count.index + 1}"
  }
}

resource "aws_lb" "app" {
  name               = "app-alb"
  internal           = false
  load_balancer_type = "application"
  subnets            = aws_subnet.public.*.id
}

# Create NAT Gateway with Elastic IP
ALLOCATION=$(aws ec2 allocate-address --domain vpc --query 'AllocationId' --output text)
aws ec2 create-nat-gateway \
  --subnet-id subnet-12345678 \
  --allocation-id $ALLOCATION \
  --tag-specifications 'ResourceType=natgateway,Tags=[{Key=Name,Value=prod-nat-gateway}]'

Do you need a public IP at all?
├─ No (private subnet with NAT Gateway) → Best option
└─ Yes
   └─ Is the instance behind a load balancer?
      ├─ Yes → Use public IP or no public IP
      └─ No
         └─ Do you need DNS to point to this IP?
            ├─ Yes → Use Elastic IP
            └─ No
               └─ Is this production?
                  ├─ Yes → Use Elastic IP (for failover flexibility)
                  └─ No → Use public IP

# Script to find and alert on orphaned EIPs
#!/bin/bash
ORPHANED=$(aws ec2 describe-addresses --query 'Addresses[?AssociationId==null].AllocationId' --output text)

if [ -n "$ORPHANED" ]; then
  echo "WARNING: Orphaned Elastic IPs found:"
  echo "$ORPHANED"
  COST=$(echo "$ORPHANED" | wc -w | awk '{print $1 * 3.60}')
  echo "Monthly cost: \$$COST"
  
  # Option: Automatically release after confirmation
  # for alloc in $ORPHANED; do
  #   aws ec2 release-address --allocation-id $alloc
  # done
fi

# Bad: DNS pointing to auto-assigned public IP
# www.example.com → 54.123.45.67 (changes on restart)

# Better: DNS pointing to Elastic IP
# www.example.com → 203.0.113.25 (stable)

# Best: Route 53 alias to Application Load Balancer
# www.example.com → ALIAS myalb-123456.us-east-1.elb.amazonaws.com

# Bad: Hardcoded IP
DATABASE_HOST = "203.0.113.25"

# Better: Environment variable
import os
DATABASE_HOST = os.environ.get('DATABASE_HOST')

# Best: Service discovery or DNS
import boto3
ssm = boto3.client('ssm')
param = ssm.get_parameter(Name='/prod/database/endpoint')
DATABASE_HOST = param['Parameter']['Value']

# Always tag Elastic IPs
aws ec2 allocate-address \
  --domain vpc \
  --tag-specifications 'ResourceType=elastic-ip,Tags=[
    {Key=Name,Value=prod-api-server},
    {Key=Environment,Value=production},
    {Key=CostCenter,Value=engineering},
    {Key=Owner,Value=devops-team},
    {Key=CreatedBy,Value=terraform}
  ]'

# Modern architecture: ALB instead of Elastic IP
resource "aws_lb" "app" {
  name               = "prod-app-alb"
  internal           = false
  load_balancer_type = "application"
  security_groups    = [aws_security_group.alb.id]
  subnets            = aws_subnet.public.*.id
}

# Route 53 points to ALB, not individual instances
resource "aws_route53_record" "app" {
  zone_id = aws_route53_zone.main.zone_id
  name    = "app.example.com"
  type    = "A"

  alias {
    name                   = aws_lb.app.dns_name
    zone_id                = aws_lb.app.zone_id
    evaluate_target_health = true
  }
}

# Check current EIP usage across all regions
for region in $(aws ec2 describe-regions --query 'Regions[].RegionName' --output text); do
  count=$(aws ec2 describe-addresses --region $region --query 'length(Addresses)' --output text 2>/dev/null || echo 0)
  echo "$region: $count/5 Elastic IPs used"
done

# Generate EIP inventory report
aws ec2 describe-addresses \
  --query 'Addresses[*].{
    IP:PublicIp,
    AllocationId:AllocationId,
    Instance:InstanceId,
    NetworkInterface:NetworkInterfaceId,
    Name:Tags[?Key==`Name`].Value|[0],
    Environment:Tags[?Key==`Environment`].Value|[0]
  }' \
  --output table > eip-inventory.txt

# Terraform module for standardized EIP allocation
module "web_server_eip" {
  source = "./modules/eip"
  
  name        = "prod-web-server"
  environment = "production"
  instance_id = aws_instance.web.id
}

# Enable IPv6 for VPC and subnet
aws ec2 associate-vpc-cidr-block \
  --vpc-id vpc-12345678 \
  --amazon-provided-ipv6-cidr-block

aws ec2 associate-subnet-cidr-block \
  --subnet-id subnet-12345678 \
  --ipv6-cidr-block 2600:1234:5678:9abc::/64

# Step 1: Current state
# Old instance i-old123 has EIP 203.0.113.25
# DNS: api.fintech.com → 203.0.113.25

# Step 2: Launch new instance
NEW_INSTANCE=$(aws ec2 run-instances \
  --image-id ami-optimized123 \
  --instance-type c5.xlarge \
  --subnet-id subnet-12345678 \
  --query 'Instances[0].InstanceId' \
  --output text)

# Step 3: Configure and test new instance
# (Application setup, data sync, testing)

# Step 4: Move EIP to new instance (during maintenance window)
aws ec2 associate-address \
  --instance-id $NEW_INSTANCE \
  --allocation-id eipalloc-abc123 \
  --allow-reassociation

# Step 5: Verify and terminate old instance
aws ec2 terminate-instances --instance-ids i-old123

# Primary region (us-east-1)
resource "aws_eip" "primary" {
  provider = aws.us-east-1
  domain   = "vpc"
  tags = {
    Name = "ecommerce-primary"
  }
}

resource "aws_eip_association" "primary" {
  provider      = aws.us-east-1
  instance_id   = aws_instance.primary.id
  allocation_id = aws_eip.primary.id
}

# Route 53 health check
resource "aws_route53_health_check" "primary" {
  ip_address        = aws_eip.primary.public_ip
  port              = 443
  type              = "HTTPS"
  resource_path     = "/health"
  failure_threshold = 3
  request_interval  = 30
}

# Route 53 failover record
resource "aws_route53_record" "primary" {
  zone_id = aws_route53_zone.main.zone_id
  name    = "shop.ecommerce.com"
  type    = "A"
  ttl     = 60

  failover_routing_policy {
    type = "PRIMARY"
  }

  set_identifier  = "primary"
  health_check_id = aws_route53_health_check.primary.id
  records         = [aws_eip.primary.public_ip]
}

# Secondary region configuration (similar)

# Allocate dedicated EIPs for each hospital integration
aws ec2 allocate-address --domain vpc --tag-specifications \
  'ResourceType=elastic-ip,Tags=[
    {Key=Name,Value=hospital-xyz-integration},
    {Key=Customer,Value=XYZ-Hospital},
    {Key=ComplianceLevel,Value=HIPAA}
  ]'

# Document in compliance spreadsheet
echo "Hospital XYZ whitelist IP: 203.0.113.25" >> compliance-docs/ip-inventory.txt

# Audit revealed:
# - 25 EIPs from terminated test instances
# - 15 EIPs from moved to ALB architecture
# - 10 EIPs from former employees' experiments

# Cleanup script
for alloc in $(aws ec2 describe-addresses --query 'Addresses[?AssociationId==null].AllocationId' --output text); do
  echo "Releasing unused EIP: $alloc"
  aws ec2 release-address --allocation-id $alloc
done

# Provision your own IP range in AWS
aws ec2 provision-byoip-cidr \
  --cidr 198.51.100.0/24 \
  --cidr-authorization-context \
    Message="1|aws|198.51.100.0/24|20250101|SHA256|RSAPSS" \
    Signature="signature-from-roa"

# Advertise the range
aws ec2 advertise-byoip-cidr --cidr 198.51.100.0/24

# Allocate Elastic IP from your range
aws ec2 allocate-address \
  --domain vpc \
  --public-ipv4-pool ipv4pool-ec2-1234567890abcdef0

# Enable IPv6 for instance
aws ec2 associate-subnet-cidr-block \
  --subnet-id subnet-12345678 \
  --ipv6-cidr-block 2600:1f18:1234:5678::/64

aws ec2 run-instances \
  --image-id ami-0c55b159cbfafe1f0 \
  --instance-type t3.medium \
  --subnet-id subnet-12345678 \
  --ipv6-address-count 1

# View IPv6 address
aws ec2 describe-instances \
  --instance-ids i-1234567890abcdef0 \
  --query 'Reservations[0].Instances[0].NetworkInterfaces[0].Ipv6Addresses[0].Ipv6Address'

# Check current quota
aws service-quotas get-service-quota \
  --service-code ec2 \
  --quota-code L-0263D0A3

# Request increase (via AWS Console > Service Quotas)
# Or via support ticket

resource "aws_globalaccelerator_accelerator" "example" {
  name            = "global-app-accelerator"
  ip_address_type = "IPV4"
  enabled         = true
}

resource "aws_globalaccelerator_listener" "example" {
  accelerator_arn = aws_globalaccelerator_accelerator.example.id
  protocol        = "TCP"

  port_range {
    from_port = 80
    to_port   = 80
  }
}

# Output: Static IPs like 75.2.60.5 and 99.83.190.51

resource "aws_route53_record" "app" {
  zone_id = aws_route53_zone.main.zone_id
  name    = "app.example.com"
  type    = "A"

  alias {
    name                   = aws_lb.app.dns_name
    zone_id                = aws_lb.app.zone_id
    evaluate_target_health = true
  }
}

resource "aws_vpc_endpoint_service" "example" {
  acceptance_required        = false
  network_load_balancer_arns = [aws_lb.internal_nlb.arn]
}

# Consumers connect via VPC endpoint (no public IP needed)
resource "aws_vpc_endpoint" "example" {
  vpc_id            = aws_vpc.consumer.id
  service_name      = aws_vpc_endpoint_service.example.service_name
  vpc_endpoint_type = "Interface"
}

# From within the instance
curl http://169.254.169.254/latest/meta-data/public-ipv4
# Returns: 54.123.45.67 (auto-assigned) or EIP if associated

curl http://169.254.169.254/latest/meta-data/public-hostname
# Returns: ec2-54-123-45-67.compute-1.amazonaws.com

# Using IMDSv2 (more secure)
TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
curl -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/public-ipv4

# Allocate EIP and capture the allocation ID
aws ec2 allocate-address --domain vpc --output json > eip-allocation.json
ALLOCATION_ID=$(jq -r '.AllocationId' eip-allocation.json)
PUBLIC_IP=$(jq -r '.PublicIp' eip-allocation.json)
echo "Allocated EIP: $PUBLIC_IP (Allocation ID: $ALLOCATION_ID)"

# Associate with a running EC2 instance
aws ec2 associate-address \
  --instance-id i-1234567890abcdef0 \
  --allocation-id $ALLOCATION_ID

# Verify association
aws ec2 describe-addresses \
  --allocation-ids $ALLOCATION_ID \
  --query 'Addresses[0].{IP:PublicIp,Instance:InstanceId,AssociationId:AssociationId}'

# Check instance shows EIP in description
aws ec2 describe-instances \
  --instance-ids i-1234567890abcdef0 \
  --query 'Reservations[0].Instances[0].{PublicIP:PublicIpAddress,State:State.Name}'

# Test connectivity (replace with your EIP)
ping -c 3 $PUBLIC_IP

# Move EIP to a different instance
aws ec2 associate-address \
  --instance-id i-newinstance456 \
  --allocation-id $ALLOCATION_ID \
  --allow-reassociation

# The --allow-reassociation flag is critical for moving an already-associated EIP

# First, disassociate if currently attached
ASSOCIATION_ID=$(aws ec2 describe-addresses \
  --allocation-ids $ALLOCATION_ID \
  --query 'Addresses[0].AssociationId' \
  --output text)

if [ "$ASSOCIATION_ID" != "None" ]; then
  aws ec2 disassociate-address --association-id $ASSOCIATION_ID
fi

# Then release the EIP
aws ec2 release-address --allocation-id $ALLOCATION_ID
echo "EIP $PUBLIC_IP has been released"

# ALLOCATE ELASTIC IP
aws ec2 allocate-address --domain vpc

# ASSOCIATE TO INSTANCE
aws ec2 associate-address \
  --instance-id i-1234567890abcdef0 \
  --allocation-id eipalloc-abc123def456

# ASSOCIATE TO NETWORK INTERFACE
aws ec2 associate-address \
  --network-interface-id eni-11223344 \
  --allocation-id eipalloc-abc123def456

# DESCRIBE ALL ELASTIC IPs
aws ec2 describe-addresses

# DESCRIBE SPECIFIC EIP
aws ec2 describe-addresses --allocation-ids eipalloc-abc123def456

# FIND UNATTACHED (ORPHANED) EIPs
aws ec2 describe-addresses \
  --query 'Addresses[?AssociationId==null]'

# DISASSOCIATE EIP
aws ec2 disassociate-address --association-id eipassoc-xyz789

# RELEASE EIP
aws ec2 release-address --allocation-id eipalloc-abc123def456

# TAG AN ELASTIC IP
aws ec2 create-tags \
  --resources eipalloc-abc123def456 \
  --tags Key=Name,Value=prod-web-server

# CHECK INSTANCE PUBLIC IP
aws ec2 describe-instances \
  --instance-ids i-1234567890abcdef0 \
  --query 'Reservations[0].Instances[0].PublicIpAddress'

# Provider configuration
terraform {
  required_version = ">= 1.0"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

# VPC and Networking
resource "aws_vpc" "main" {
  cidr_block           = "10.0.0.0/16"
  enable_dns_hostnames = true
  enable_dns_support   = true

  tags = {
    Name = "production-vpc"
  }
}

resource "aws_subnet" "public" {
  vpc_id                  = aws_vpc.main.id
  cidr_block              = "10.0.1.0/24"
  availability_zone       = "us-east-1a"
  map_public_ip_on_launch = false # We'll use EIP instead

  tags = {
    Name = "public-subnet-1a"
  }
}

resource "aws_internet_gateway" "main" {
  vpc_id = aws_vpc.main.id

  tags = {
    Name = "main-igw"
  }
}

resource "aws_route_table" "public" {
  vpc_id = aws_vpc.main.id

  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.main.id
  }

  tags = {
    Name = "public-rt"
  }
}

resource "aws_route_table_association" "public" {
  subnet_id      = aws_subnet.public.id
  route_table_id = aws_route_table.public.id
}

# Security Group
resource "aws_security_group" "web" {
  name        = "web-server-sg"
  description = "Security group for web server"
  vpc_id      = aws_vpc.main.id

  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = {
    Name = "web-server-sg"
  }
}

# EC2 Instance
resource "aws_instance" "web" {
  ami           = "ami-0c55b159cbfafe1f0" # Update with current AMI
  instance_type = "t3.medium"
  subnet_id     = aws_subnet.public.id

  vpc_security_group_ids = [aws_security_group.web.id]

  # Don't enable auto-assign public IP - we're using EIP
  associate_public_ip_address = false

  tags = {
    Name        = "prod-web-server"
    Environment = "production"
  }
}

# Elastic IP
resource "aws_eip" "web" {
  domain = "vpc"

  tags = {
    Name        = "prod-web-server-eip"
    Environment = "production"
    ManagedBy   = "terraform"
  }

  # Ensure EIP isn't created until IGW exists
  depends_on = [aws_internet_gateway.main]
}

# Associate EIP with Instance
resource "aws_eip_association" "web" {
  instance_id   = aws_instance.web.id
  allocation_id = aws_eip.web.id
}

# Outputs
output "instance_id" {
  description = "ID of the EC2 instance"
  value       = aws_instance.web.id
}

output "elastic_ip" {
  description = "Elastic IP address of the web server"
  value       = aws_eip.web.public_ip
}

output "elastic_ip_allocation_id" {
  description = "Allocation ID of the Elastic IP"
  value       = aws_eip.web.id
}

AWSTemplateFormatVersion: '2010-09-09'
Description: 'Complete EC2 instance with Elastic IP setup'

Parameters:
  LatestAmiId:
    Type: 'AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>'
    Default: '/aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2'
  
  InstanceType:
    Type: String
    Default: t3.medium
    AllowedValues:
      - t3.micro
      - t3.small
      - t3.medium
      - t3.large
    Description: EC2 instance type

  Environment:
    Type: String
    Default: production
    AllowedValues:
      - development
      - staging
      - production
    Description: Environment name

Resources:
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.0.0.0/16
      EnableDnsHostnames: true
      EnableDnsSupport: true
      Tags:
        - Key: Name
          Value: !Sub '${Environment}-vpc'

  InternetGateway:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
        - Key: Name
          Value: !Sub '${Environment}-igw'

  AttachGateway:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref VPC
      InternetGatewayId: !Ref InternetGateway

  PublicSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.0.1.0/24
      AvailabilityZone: !Select [0, !GetAZs '']
      MapPublicIpOnLaunch: false
      Tags:
        - Key: Name
          Value: !Sub '${Environment}-public-subnet'

  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub '${Environment}-public-rt'

  PublicRoute:
    Type: AWS::EC2::Route
    DependsOn: AttachGateway
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway

  SubnetRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnet
      RouteTableId: !Ref PublicRouteTable

  WebServerSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security group for web server
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          CidrIp: 0.0.0.0/0
      SecurityGroupEgress:
        - IpProtocol: -1
          CidrIp: 0.0.0.0/0
      Tags:
        - Key: Name
          Value: !Sub '${Environment}-web-sg'

  WebServerInstance:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: !Ref LatestAmiId
      InstanceType: !Ref InstanceType
      SubnetId: !Ref PublicSubnet
      SecurityGroupIds:
        - !Ref WebServerSecurityGroup
      Tags:
        - Key: Name
          Value: !Sub '${Environment}-web-server'
        - Key: Environment
          Value: !Ref Environment

  ElasticIP:
    Type: AWS::EC2::EIP
    DependsOn: AttachGateway
    Properties:
      Domain: vpc
      Tags:
        - Key: Name
          Value: !Sub '${Environment}-web-eip'
        - Key: Environment
          Value: !Ref Environment

  EIPAssociation:
    Type: AWS::EC2::EIPAssociation
    Properties:
      InstanceId: !Ref WebServerInstance
      EIP: !Ref ElasticIP

Outputs:
  InstanceId:
    Description: Instance ID of the web server
    Value: !Ref WebServerInstance
    Export:
      Name: !Sub '${AWS::StackName}-InstanceId'

  ElasticIP:
    Description: Elastic IP address
    Value: !Ref ElasticIP
    Export:
      Name: !Sub '${AWS::StackName}-ElasticIP'

  AllocationId:
    Description: Allocation ID of the Elastic IP
    Value: !GetAtt ElasticIP.AllocationId
    Export:
      Name: !Sub '${AWS::StackName}-AllocationId'

  PublicDNS:
    Description: Public DNS name
    Value: !GetAtt WebServerInstance.PublicDnsName

┌─────────────────────────────────────────────────────────────────────┐
│                 PUBLIC IP LIFECYCLE                                 │
├─────────────────────────────────────────────────────────────────────┤
│                                                                     │
│  Launch Instance              Stop Instance         Start Instance  │
│  ┌──────────┐                ┌──────────┐           ┌──────────┐   │
│  │ Instance │  auto-assign   │ Instance │  release  │ Instance │   │
│  │ running  │──────────────> │ stopped  │────────>  │ running  │   │
│  │          │  52.10.20.30   │          │  IP gone  │          │   │
│  └──────────┘                └──────────┘           └──────────┘   │
│       │                                                    │         │
│       │                                                    │         │
│       └────────────────────────────────────────────────────┘         │
│                    NEW IP: 54.30.40.50                              │
│                                                                     │
└─────────────────────────────────────────────────────────────────────┘

┌─────────────────────────────────────────────────────────────────────┐
│                 ELASTIC IP LIFECYCLE                                │
├─────────────────────────────────────────────────────────────────────┤
│                                                                     │
│  Allocate EIP        Associate         Stop Instance  Start & Auto  │
│  ┌──────────┐       ┌──────────┐      ┌──────────┐   ┌──────────┐  │
│  │   EIP    │────>  │ Instance │────> │ Instance │──>│ Instance │  │
│  │203.0.1.1 │ link  │ running  │ keep │ stopped  │   │ running  │  │
│  └──────────┘       └──────────┘ EIP  └──────────┘   └──────────┘  │
│       │                  │               │                 │         │
│       │                  │               │                 │         │
│       └──────────────────┴───────────────┴─────────────────┘         │
│              SAME IP: 203.0.113.1 (persistent)                      │
│                                                                     │
│  Reassociate to New Instance:                                      │
│  ┌──────────┐       ┌──────────┐                                   │
│  │   EIP    │────>  │ Instance │  (instant failover)               │
│  │203.0.1.1 │ move  │   NEW    │                                   │
│  └──────────┘       └──────────┘                                   │
│                                                                     │
└─────────────────────────────────────────────────────────────────────┘

#!/bin/bash
# eip-healthcheck-failover.sh
# Monitors primary instance and fails over EIP to standby if unhealthy

set -e

# Configuration
PRIMARY_INSTANCE="i-primary123456"
STANDBY_INSTANCE="i-standby789012"
EIP_ALLOCATION="eipalloc-abc123def456"
HEALTH_CHECK_URL="https://203.0.113.1/health"
HEALTH_CHECK_RETRIES=3
SNS_TOPIC_ARN="arn:aws:sns:us-east-1:123456789012:eip-failover-alerts"

# Function to check instance health
check_health() {
    local url=$1
    local retries=$2
    
    for i in $(seq 1 $retries); do
        if curl -sf --max-time 5 "$url" > /dev/null 2>&1; then
            echo "Health check passed (attempt $i)"
            return 0
        fi
        echo "Health check failed (attempt $i)"
        sleep 10
    done
    return 1
}

# Function to get current EIP association
get_current_association() {
    aws ec2 describe-addresses \
        --allocation-ids "$EIP_ALLOCATION" \
        --query 'Addresses[0].InstanceId' \
        --output text
}

# Function to perform failover
perform_failover() {
    local target_instance=$1
    
    echo "$(date): Performing failover to $target_instance"
    
    aws ec2 associate-address \
        --instance-id "$target_instance" \
        --allocation-id "$EIP_ALLOCATION" \
        --allow-reassociation
    
    # Send SNS notification
    aws sns publish \
        --topic-arn "$SNS_TOPIC_ARN" \
        --subject "EIP Failover Alert" \
        --message "EIP $EIP_ALLOCATION failed over to instance $target_instance at $(date)"
    
    echo "$(date): Failover complete"
}

# Main logic
echo "$(date): Starting health check for $PRIMARY_INSTANCE"

if ! check_health "$HEALTH_CHECK_URL" "$HEALTH_CHECK_RETRIES"; then
    echo "$(date): Primary instance unhealthy, initiating failover"
    
    current_instance=$(get_current_association)
    
    if [ "$current_instance" == "$PRIMARY_INSTANCE" ]; then
        perform_failover "$STANDBY_INSTANCE"
    else
        echo "$(date): EIP already on standby instance, checking standby health"
        if ! check_health "$HEALTH_CHECK_URL" "$HEALTH_CHECK_RETRIES"; then
            echo "$(date): CRITICAL: Both instances unhealthy!"
            aws sns publish \
                --topic-arn "$SNS_TOPIC_ARN" \
                --subject "CRITICAL: Both EIP Targets Unhealthy" \
                --message "Both primary and standby instances are unhealthy at $(date)"
            exit 1
        fi
    fi
else
    echo "$(date): Primary instance healthy"
    
    # Optionally fail back to primary if currently on standby
    current_instance=$(get_current_association)
    if [ "$current_instance" == "$STANDBY_INSTANCE" ]; then
        echo "$(date): Currently on standby, considering failback to primary"
        # Add your failback logic here if desired
    fi
fi

echo "$(date): Health check complete"

# lambda_eip_cleanup.py
# AWS Lambda function to identify and optionally release orphaned EIPs

import boto3
import json
from datetime import datetime, timedelta
from typing import List, Dict

ec2_client = boto3.client('ec2')
sns_client = boto3.client('sns')

# Configuration
ORPHAN_THRESHOLD_HOURS = 24
SNS_TOPIC_ARN = 'arn:aws:sns:us-east-1:123456789012:eip-cleanup-alerts'
DRY_RUN = True  # Set to False to actually release EIPs
PROTECTED_TAGS = ['production', 'critical']  # Don't auto-release these

def get_orphaned_eips() -> List[Dict]:
    """Find all unattached Elastic IPs"""
    response = ec2_client.describe_addresses()
    
    orphaned = []
    for address in response['Addresses']:
        if 'AssociationId' not in address:
            # EIP is not associated with any instance
            tags = {tag['Key']: tag['Value'] for tag in address.get('Tags', [])}
            
            orphaned.append({
                'AllocationId': address['AllocationId'],
                'PublicIp': address['PublicIp'],
                'Tags': tags
            })
    
    return orphaned

def is_protected(eip: Dict) -> bool:
    """Check if EIP has protected tags"""
    tags = eip.get('Tags', {})
    
    for key, value in tags.items():
        if key.lower() == 'environment' and value.lower() in PROTECTED_TAGS:
            return True
        if key.lower() == 'protected' and value.lower() == 'true':
            return True
    
    return False

def release_eip(allocation_id: str, public_ip: str) -> bool:
    """Release an Elastic IP"""
    try:
        if not DRY_RUN:
            ec2_client.release_address(AllocationId=allocation_id)
            print(f"Released EIP: {public_ip} ({allocation_id})")
            return True
        else:
            print(f"DRY RUN: Would release EIP: {public_ip} ({allocation_id})")
            return False
    except Exception as e:
        print(f"Error releasing EIP {public_ip}: {str(e)}")
        return False

def send_notification(orphaned_eips: List[Dict], released_eips: List[Dict]):
    """Send SNS notification about orphaned/released EIPs"""
    message_lines = [
        f"EIP Cleanup Report - {datetime.utcnow().isoformat()}",
        f"",
        f"Total orphaned EIPs found: {len(orphaned_eips)}",
        f"EIPs released: {len(released_eips)}",
        f"Monthly cost of orphaned EIPs: ${len(orphaned_eips) * 3.60:.2f}",
        f"",
        f"Orphaned EIPs:"
    ]
    
    for eip in orphaned_eips:
        protected = " [PROTECTED]" if is_protected(eip) else ""
        name = eip['Tags'].get('Name', 'Unnamed')
        message_lines.append(
            f"  - {eip['PublicIp']} ({eip['AllocationId']}) - {name}{protected}"
        )
    
    if released_eips:
        message_lines.append(f"")
        message_lines.append(f"Released EIPs:")
        for eip in released_eips:
            name = eip['Tags'].get('Name', 'Unnamed')
            message_lines.append(
                f"  - {eip['PublicIp']} ({eip['AllocationId']}) - {name}"
            )
    
    message = "\n".join(message_lines)
    
    try:
        sns_client.publish(
            TopicArn=SNS_TOPIC_ARN,
            Subject=f"EIP Cleanup Report - {len(orphaned_eips)} Orphaned EIPs",
            Message=message
        )
        print("Notification sent successfully")
    except Exception as e:
        print(f"Error sending notification: {str(e)}")

def lambda_handler(event, context):
    """Main Lambda handler"""
    print(f"Starting EIP cleanup scan at {datetime.utcnow().isoformat()}")
    print(f"DRY RUN mode: {DRY_RUN}")
    
    # Get all orphaned EIPs
    orphaned_eips = get_orphaned_eips()
    print(f"Found {len(orphaned_eips)} orphaned EIPs")
    
    if not orphaned_eips:
        print("No orphaned EIPs found")
        return {
            'statusCode': 200,
            'body': json.dumps('No orphaned EIPs found')
        }
    
    # Filter out protected EIPs and release eligible ones
    released_eips = []
    for eip in orphaned_eips:
        if is_protected(eip):
            print(f"Skipping protected EIP: {eip['PublicIp']}")
            continue
        
        if release_eip(eip['AllocationId'], eip['PublicIp']):
            released_eips.append(eip)
    
    # Send notification
    send_notification(orphaned_eips, released_eips)
    
    return {
        'statusCode': 200,
        'body': json.dumps({
            'orphaned_count': len(orphaned_eips),
            'released_count': len(released_eips),
            'monthly_cost_savings': len(released_eips) * 3.60
        })
    }

# modules/managed-eip/main.tf
# Reusable Terraform module for Elastic IP with monitoring and tagging

terraform {
  required_version = ">= 1.0"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

variable "name" {
  description = "Name of the EIP resource"
  type        = string
}

variable "environment" {
  description = "Environment (dev, staging, production)"
  type        = string
  
  validation {
    condition     = contains(["dev", "staging", "production"], var.environment)
    error_message = "Environment must be dev, staging, or production."
  }
}

variable "instance_id" {
  description = "EC2 instance ID to associate with"
  type        = string
  default     = null
}

variable "cost_center" {
  description = "Cost center for billing"
  type        = string
  default     = "engineering"
}

variable "enable_cloudwatch_alarm" {
  description = "Enable CloudWatch alarm for unattached EIP"
  type        = bool
  default     = true
}

variable "alarm_sns_topic_arn" {
  description = "SNS topic ARN for EIP alarms"
  type        = string
  default     = ""
}

locals {
  common_tags = {
    Name        = var.name
    Environment = var.environment
    CostCenter  = var.cost_center
    ManagedBy   = "terraform"
    CreatedAt   = timestamp()
  }
}

# Allocate Elastic IP
resource "aws_eip" "this" {
  domain = "vpc"
  tags   = local.common_tags
}

# Associate with instance if provided
resource "aws_eip_association" "this" {
  count = var.instance_id != null ? 1 : 0
  
  instance_id   = var.instance_id
  allocation_id = aws_eip.this.id
}

# CloudWatch metric for monitoring
resource "aws_cloudwatch_log_metric_filter" "eip_unattached" {
  count = var.enable_cloudwatch_alarm ? 1 : 0
  
  name           = "${var.name}-eip-unattached"
  log_group_name = "/aws/lambda/eip-monitor"
  pattern        = "[time, request_id, event_type = DISASSOCIATE, allocation_id = ${aws_eip.this.id}*]"
  
  metric_transformation {
    name      = "EIPUnattached"
    namespace = "CustomMetrics/EIP"
    value     = "1"
    dimensions = {
      AllocationId = aws_eip.this.id
    }
  }
}

# CloudWatch alarm for unattached EIP (cost alert)
resource "aws_cloudwatch_metric_alarm" "eip_unattached" {
  count = var.enable_cloudwatch_alarm && var.alarm_sns_topic_arn != "" ? 1 : 0
  
  alarm_name          = "${var.name}-eip-unattached"
  comparison_operator = "GreaterThanThreshold"
  evaluation_periods  = "1"
  metric_name         = "EIPUnattached"
  namespace           = "CustomMetrics/EIP"
  period              = "3600"  # 1 hour
  statistic           = "Sum"
  threshold           = "0"
  alarm_description   = "Alert when EIP ${aws_eip.this.public_ip} is unattached for >1 hour"
  alarm_actions       = [var.alarm_sns_topic_arn]
  
  dimensions = {
    AllocationId = aws_eip.this.id
  }
}

# Outputs
output "public_ip" {
  description = "The Elastic IP address"
  value       = aws_eip.this.public_ip
}

output "allocation_id" {
  description = "The allocation ID of the Elastic IP"
  value       = aws_eip.this.id
}

output "association_id" {
  description = "The association ID (if associated)"
  value       = var.instance_id != null ? aws_eip_association.this[0].id : null
}

output "tags" {
  description = "Tags applied to the EIP"
  value       = aws_eip.this.tags_all
}