{"id":7188,"date":"2021-01-29T18:47:31","date_gmt":"2021-01-29T18:47:31","guid":{"rendered":"https:\/\/rax-stg-wp-aws.com\/blogs\/how-to-use-the-aws-cli-to-find-untagged-instances\/"},"modified":"2026-11-03T19:28:11","modified_gmt":"2026-11-03T19:28:11","slug":"how-to-use-the-aws-cli-to-find-untagged-instances","status":"publish","type":"blogs","link":"https:\/\/www.rackspace.com\/de\/blogs\/how-to-use-the-aws-cli-to-find-untagged-instances\/","title":{"rendered":"How to use the AWS CLI to find untagged instances"},"content":{"rendered":"

Originally published in Feb 2017, at the Onica blog here<\/a>.<\/strong><\/em><\/p>\n

I often need to find AWS EC2 instances without a particular tag. Usually, it’s the Name<\/strong> tag, but other tags come up from time to time (we use a tag of Owner<\/em> quite
\na bit). <\/p>\n

Use the AWS CLI to find instances without a Name<\/em> tag<\/p>\n

After coming across this Reddit post<\/a> and this Stack Overflow question<\/a>, we made it our mission to figure out how to get instances that were missing a tag through the AWS command line interface (CLI) instead of using external tools like jq or python.<\/p>\n

The –Query Parameter, JMESPath, and filtering<\/strong><\/p>\n

JMESPath <\/a>is the engine behind the –query<\/strong> parameter in AWS CLI. In its most basic form, it helps you filter out or traverse JSON. AWS has some nice documentation<\/a>
\ndescribing how to use it at a basic level. In this post, we focus on the filtering ability of JMESPath.<\/p>\n

Using the bracket and a question mark triggers the JMESPath filter: [? … ]<\/em><\/p>\n

Find an instance with a specific tag<\/strong>
\nFor example, many people want to get the instance Name<\/strong> tag and the InstanceId<\/strong>. You can do this by using the filter for the Tags -> Key==’Name<\/em>`, as shown in the following example:<\/p>\n

    aws ec2 describe-instances \\
\n     –output text \\
\n     –query Reservations[].Instances[].[Tags[?Key==`Name`].Value|[0],InstanceId]<\/em><\/p>\n

Find an instance without a tag<\/strong><\/p>\n

While this is useful, we want to do the opposite. So, we start by diving down into each instance:<\/p>\n

aws ec2 describe-instances \\
\n     –query Reservations[].Instances[]<\/p>\n

This operation spits out each of the instances. Then, we create a filter on each of these where the Name<\/strong> tag doesn’t exist. A tag that exists would look similar to the following example:<\/p>\n

    aws ec2 describe-instances \\
\n     –query ‘Reservations[].Instances[?Tags[?Key != `Name`]]’<\/em><\/p>\n

The problem with this filter is that as we loop through the Tags<\/strong> array, we’ll most likely hit an instance with more than one tag. That instance registers true<\/em> because the
\nfirst tag may have `”Key:” “SomeTag”` (but the second could be `”Key:” “Name”`). So we want to look for the object with the Name<\/strong> key but with no value (aka null<\/em>).<\/p>\n

Solution<\/strong><\/p>\n

First, let’s get the value from the Name<\/strong> tag:<\/p>\n

    aws ec2 describe-instances \\
\n     –query ‘Reservations[].Instances[].Tags[?Key == `Name`].Value’<\/em><\/p>\n

Now we can use the JMESPath not_null<\/strong>()function to filter for ones that exist:<\/p>\n

    aws ec2 describe-instances \\
\n     –query ‘Reservations[].Instances[?not_null(Tags[?Key == `Name`].Value)]’<\/em><\/p>\n

The problem is that this still captures anything with<\/em> a Name <\/strong>tag. So we negate it. That is, we want anything that isn’t<\/em> not_null<\/em> [aka not not null]!<\/p>\n

    aws ec2 describe-instances \\
\n     –query ‘Reservations[].Instances[?!not_null(Tags[?Key == `Name`].Value)]’<\/em>
\n <\/p>\n

This operation returns something similar to the following:<\/p>\n

    [
\n      [
\n        {
\n            “Monitoring”: {
\n                “State”: “disabled”
\n            }, 
\n            “PublicDnsName”: “”, 
\n            “RootDeviceType”: “ebs”
\n            …
\n        }
\n      ], 
\n      [], 
\n      [], 
\n      [], 
\n      [], 
\n      [], 
\n      [], 
\n      [
\n        {
\n            “Monitoring”: {
\n                “State”: “disabled”
\n            }, 
\n            “PublicDnsName”: “”, 
\n            “RootDeviceType”: “ebs”
\n            …
\n        }
\n      ], 
\n      []
\n    ]<\/p>\n

\nWe don’t want to have these empty arrays, so we flatten the instance object with a pipe:<\/p>\n

aws ec2 describe-instances \\
\n      –query ‘Reservations[].Instances[?!not_null(Tags[?Key == `Name`].Value)] | []’<\/em><\/p>\n

And that’s it! <\/em><\/p>\n

Other Examples<\/strong><\/p>\n

If you want a few more examples of some common uses, here you go:<\/p>\n

– Display InstanceId of instances that have no Name tag:<\/p>\n

        aws ec2 describe-instances \\
\n          –output text \\
\n          –query ‘Reservations[].Instances[?!not_null(Tags[?Key == `Name`].Value)] | [].[InstanceId]’
\n 
\n– Display InstanceId of running instances that have no Owner tag:<\/p>\n

        aws ec2 describe-instances \\
\n          –output text \\
\n          –filters Name=instance-state-name,Values=running \\
\n          –query ‘Reservations[].Instances[?!not_null(Tags[?Key == `Owner`].Value)] | [].[InstanceId]’
\n 
\n– Display VolumeId and Size of volumes that have no Name tag:<\/p>\n

        aws ec2 describe-volumes \\
\n          –output text \\
\n          –query ‘Volumes[?!not_null(Tags[?Key == `Name`].Value)] | [].[VolumeId,Size]’
\n 
\n– Display SnapshotId and StartTime of my snapshots that have no CreatedBy tag:<\/p>\n

        aws ec2 describe-snapshots \\
\n          –output text \\
\n          –owner-ids self \\
\n          –query ‘Snapshots[?!not_null(Tags[?Key == `CreatedBy`].Value)] | [].[SnapshotId,StartTime]’
\n <\/p>\n

Why search for untagged instances with AWS CLI?<\/strong><\/p>\n

There are many reasons to tag instances, including automation and console organization<\/a>, but at Rackspace Technology, our biggest driver is cost<\/em>. Employing a tagging policy to help track your instances’ cost allocation is an important step in optimizing your AWS cost!<\/p>\n","protected":false},"excerpt":{"rendered":"

How to use the AWS CLI to find untagged instances<\/p>\n","protected":false},"author":2,"featured_media":7190,"menu_order":0,"comment_status":"open","ping_status":"open","template":"","format":"standard","meta":{"content-type":"","nid":"26297","content_type":"blog","created_by":"10130","authored_on":"2023-11-27T18:47:31+00:00","field_article_industries":"","tag_category":"Technical","field_blog_author_text":"By Rackspace Technical Staff ","seo_description":"Discover effective strategies to find AWS EC2 instances without specific tags. Maintain a well-structured cloud environment.\r\n","field_featured_image":"","insights_image":"\/wp-content\/uploads\/2026\/blog_technical_images\/26297-insights_image-aws-technical-blog-1-insights.png","field_partners":"","rxt_platforms":"Amazon Web Services (AWS)","product":"","publisheddate":"2021-01-29T18:47:31","rxt_solutions":"Onica by Rackspace Technology, Data","opengraph_tag":"","x_tag":"","teaser_flag":"Technical Blog","seo_titile":"Effective AWS Management Untagged EC2 | Rackspace","field_topics":"","field_slug":"how-to-use-the-aws-cli-to-find-untagged-instances","footnotes":""},"categories":[178],"tags":[204],"class_list":["post-7188","blogs","type-blogs","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-technical"],"_links":{"self":[{"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/blogs\/7188","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/blogs"}],"about":[{"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/types\/blogs"}],"author":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/comments?post=7188"}],"version-history":[{"count":1,"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/blogs\/7188\/revisions"}],"predecessor-version":[{"id":7189,"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/blogs\/7188\/revisions\/7189"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/media\/7190"}],"wp:attachment":[{"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/media?parent=7188"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/categories?post=7188"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/tags?post=7188"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}