Default VPC Cleanup Script

Remove Default VPCs Safely Across Every Region

Default VPCs are a security anti-pattern. They exist in every region with public subnets, an internet gateway, and permissive default security groups — even regions you've never intentionally used. This script removes them all, with a dry-run mode so you see exactly what will be deleted before anything is touched.

What It Does

• Enumerates all enabled regions in your account
• Identifies default VPCs and all dependent resources (subnets, IGW, route tables, security groups)
• Dry-run mode prints a full deletion plan without making any changes
• Deletion mode removes resources in dependency order to avoid API errors
• Progress output shows region-by-region status
• Summary report at the end listing what was removed

Usage

# See what would be deleted (safe)
./cleanup-default-vpcs.sh --dry-run

# Actually delete
./cleanup-default-vpcs.sh --execute

Rollback

Default VPCs cannot be restored via CLI — AWS only allows one default VPC per region and recreation requires a support ticket or Console action. The README documents the exact steps to recreate a default VPC if needed.

Included Files

• cleanup-default-vpcs.sh — main cleanup script
• README.md — usage, rollback steps, and AWS permission requirements