The one we received stated we were notified because "your account has container images stored in Amazon Elastic Container Registry (ECR)". Currently, we do not use ECR, and if there was anything using ECR, it was from a previous devs that worked on PoCs never making it to production.
I have no experience with ECR, but because of this, I've had to stop what I was doing to look into something for several hours just to CYA that unused, but undead/legacy data wasn't leaving us vulnerable. 'Cause that's how we all want to spend weekends.
I replied above, but the instance ID they sent in the email are their own internal references to your instance, and there appears to be no way of converting that internal ID to one that's useful to you. I'd raise a support case if you don't have a TAM to ask.
The notification from AWS referenced an instance we don’t have.
Some clarification from AWS would be nice. It made me wonder if it was related to an ELB or something.