​
More Info:

Your account should not reach the limit set by AWS for the number of allocated Elastic IPs.

​
Risk Level

Low

​
Address

Operational Maturity

​
Compliance Standards

HIPAA, AWSWAF

​
Remediation

​
Using Console

Sure, here are the step by step instructions to remediate the EC2-Classic Elastic IP Address Limit Should Not Be Reached misconfiguration in AWS using AWS console:

  1. Open the AWS Management Console and sign in to your AWS account.
  2. Navigate to the EC2 dashboard.
  3. In the left-hand menu, select “Elastic IPs”.
  4. Check the “Limit” column to see how many Elastic IPs you have already allocated.
  5. If you have reached the limit, you will need to release some of the Elastic IPs that are not currently in use. To do this, select the Elastic IP that you want to release and click on the “Release addresses” button.
  6. If you need to increase the limit, you can request a limit increase by clicking on the “Request limit increase” button.
  7. In the “Request to increase limit” dialog box, fill in the required information such as the new limit and the reason for the increase.
  8. Click on the “Submit” button to submit your request.
  9. AWS will review your request and respond to you via email within a few business days.

That’s it! By following these steps, you should be able to remediate the EC2-Classic Elastic IP Address Limit Should Not Be Reached misconfiguration in AWS using AWS console.

​
Using CLI

To remediate the EC2-Classic Elastic IP Address Limit Should Not Be Reached misconfiguration for AWS using AWS CLI, you can follow the below steps:

  1. Open your terminal or command prompt and ensure that you have AWS CLI installed and configured with your AWS account credentials.

  2. Run the following command to check the current limit of Elastic IP addresses in your AWS account:

aws ec2 describe-account-attributes --attribute-names max-elastic-ips

  1. If the output of the above command shows that the limit has been reached, you can request an increase in the limit by submitting a support ticket to AWS.

  2. Once the limit has been increased, you can release any unused Elastic IP addresses using the following command:

aws ec2 release-address --public-ip <public-ip-address>

Replace <public-ip-address> with the Elastic IP address that you want to release.

  1. You can also associate Elastic IP addresses with running instances using the following command:
aws ec2 associate-address --instance-id <instance-id> --public-ip <public-ip-address>

Replace <instance-id> with the ID of the instance that you want to associate the Elastic IP address with, and <public-ip-address> with the Elastic IP address that you want to associate.

  1. Repeat steps 4 and 5 for all unused Elastic IP addresses until you are within the new limit set by AWS support.

  2. Finally, you can monitor your Elastic IP addresses usage and limit using the following command:

aws ec2 describe-account-attributes --attribute-names max-elastic-ips --query 'AccountAttributes[0].AttributeValues[0]'

This will show you the current limit of Elastic IP addresses in your AWS account.

​
Using Python

To remediate the EC2-Classic Elastic IP Address Limit Should Not Be Reached issue in AWS using Python, you can follow these steps:

  1. First, you need to identify the regions where the Elastic IP address limit has been reached. You can use the Boto3 library in Python to list all the regions and check the Elastic IP address limits for each region.
import boto3

ec2 = boto3.client('ec2')

for region in ec2.describe_regions()['Regions']:
    print("Region:", region['RegionName'])
    ec2 = boto3.client('ec2', region_name=region['RegionName'])
    response = ec2.describe_account_attributes(AttributeNames=['max-elastic-ips'])
    for attribute in response['AccountAttributes']:
        if attribute['AttributeName'] == 'max-elastic-ips':
            print("Max Elastic IPs:", attribute['AttributeValues'][0]['AttributeValue'])
  1. Once you have identified the regions where the Elastic IP address limit has been reached, you can release the unused Elastic IP addresses in those regions. You can use the Boto3 library in Python to list all the Elastic IP addresses in a region and release the ones that are not associated with any instance.
import boto3

ec2 = boto3.client('ec2', region_name='us-east-1')

response = ec2.describe_addresses()

for address in response['Addresses']:
    if 'InstanceId' not in address:
        print("Releasing Elastic IP address:", address['PublicIp'])
        ec2.release_address(AllocationId=address['AllocationId'])
  1. Finally, you can increase the Elastic IP address limit for the regions where it has been reached. You can use the Boto3 library in Python to modify the Elastic IP address limit for a region.
import boto3

ec2 = boto3.client('ec2', region_name='us-east-1')

response = ec2.modify_account_attribute(
    AttributeName='max-elastic-ips',
    AttributeValue='5'
)

print("New Max Elastic IPs:", response['AccountAttributes'][0]['AttributeValues'][0]['AttributeValue'])

Note: In the above code, the Elastic IP address limit has been increased to 5. You can replace this value with the desired limit.

​
Additional Reading: