Amazon AWS: How to get details of terminated EC2 instance from instance id

Question

One of our EC2 instance went missing from running instance list, probably it got terminated accidentally by someone.

In cloudtrail events, I can see some terminate instance events along with event time, user and instance id's which got terminated.

Problems is, as instances are already terminated I am not able to find more details of those instances using instance id.

I am interested in more details such as ami, key pair, tags.

Is there a way to get these details for terminated instance?

Answer 1

You can use CloudTrail to get that kind of information.

1. For instances that were started within the last 90 days, you should be able to get the information directly from the CloudTrail dashboard.

2. If it has been more than 90 days since the instances were started and you had enables Cloudtrail and configured it to write to S3, then you can find this information on Cloudtrail log. Find the RunInstances even for your instance ID in the log and you will get all the information about that instance from that event onward.