Offboarding

You can offboard from Outbound at any time. Done in the right order, the process mirrors onboarding in reverse and involves no egress downtime. Contact us at servicedesk@sue.nl before you start — we coordinate the cutover with you.

Order matters

The safe sequence is: restore your own egress path first, then remove Outbound’s, then revoke access. Revoking access first (deleting the CloudFormation stack) leaves gateway instances, EIPs, and routes orphaned in your account for you to untangle by hand.

1. Recreate your NAT Gateways

For each VPC Outbound manages, create an AWS NAT Gateway (or your preferred egress solution) in the public subnet, with its own Elastic IP. If you use Terraform, this is the moment to re-add the aws_nat_gateway and aws_eip resources you removed during onboarding.

Your egress IP will change

Outbound’s pooled Elastic IPs are released as part of offboarding, so egress moves to your new NAT Gateway’s IP. If external partners allowlist your egress IP, schedule their update as part of this step. If you’d like to discuss transferring specific EIPs instead, raise it with support before starting.

2. Restore the default routes

With the new NAT Gateway available, repoint each private subnet’s 0.0.0.0/0 route from the Outbound gateway to the NAT Gateway. Coordinated offboarding disables Outbound’s route reconciliation first so nothing fights the change. New connections cut over immediately; existing flows through the Outbound gateway drain while it remains in place.

3. Outbound removes its resources

Once traffic is confirmed on your NAT Gateway, Outbound tears down what it created:

• Gateway EC2 instances (Name=cloudphilos-gateway)
• Gateway security groups (cloudphilos-gateway-<vpc-id>)
• All Outbound Elastic IPs, including the spare pool (do-not-delete-cloudphilos-gateway)

4. Uninstall the Kubernetes sensor (if installed)

helm uninstall outbound-k8s-sensor -n outbound-system
kubectl delete namespace outbound-system

Also delete the IRSA role (cloudphilos-outbound-k8s-sensor-role) and, if you enabled it only for Outbound, decide whether to keep AWS_VPC_K8S_CNI_EXTERNALSNAT=true — with a standard NAT Gateway either setting works, but revert it deliberately, not by accident.

5. Delete the CloudFormation stack

Deleting the onboarding stack removes the cross-account role (revoking all of Outbound’s access), the discovery Lambda and its EventBridge rules, the instance role, and the API-key secret. For multi-region deployments, delete the StackSet instances in each region.

6. Re-adopt resources into Terraform

Import the new NAT Gateways, EIPs, and default routes into your Terraform state (terraform import or import blocks), and remove any ignore_changes = [route] lifecycle rules you added for Outbound. Finish with a terraform plan that shows no changes.

What happens to your data

Your flow history remains available in the dashboard until your account is closed. On account closure, tenant data is deleted from Outbound’s platform in accordance with your agreement — talk to support if you need an export first.