Can someone guide me how other teams are handelling this, I am doing a cleanup in my org, initially i thought the cleanup would be straightforward, find AWS resources with no traffic or active usage, validate them, and remove what is no longer needed. But once I got into it, it was not that simple. Some vpc's had no network traffic for long time, but still had active resources attached. A few resources did not have proper tags, so figuring out who owned them became difficult. Mainly i am worried if something still depends on it.

Yes that is tricky

I always get the messiest ticket 🙃 it doesn't have IaC, no state files, nothing. Just a resource that exists and people around can't explain why.

Sometimes what you can do, depending on the resource is either suspend it, firewall it, or otherwise cripple it without taking destructive action; wait a couple weeks. If no one complains then it must not have been too important :)

Thanks, Erik. I think that’s the only practical option left for me now. I just wish there was a tool that could help trace these dependencies more easily.

Like @Erik Osterman (Cloud Posse) said. Pull the plug and see if anyone screams. Sometimes there is no otherway 🙂

Agree with @Bipin Xavier, I used also this technique after getting a signoff or approval for non critical apps. More often than not, the resource made by someone who left the organization and no one picked it up or even knows why it was made (sadly happened to my team after I was laid off lol)