Guides: AWS IP addresses explained
Plain-English guides for the questions people bring to an AWS IP lookup: is this address AWS, where is it, who is behind it, what should I do about it, and how do I let the right AWS ranges through my firewall.
Each guide explains what AWS's published data can tell you, where it stops, and the commands to check things yourself. None of them will pretend an IP address identifies an AWS customer, because it doesn't.
Identify an address
-
Check if an IP address belongs to AWS
Four methods, from this lookup to jq, whois and reverse DNS, and why "not listed" never proves "not AWS".
-
Find the AWS region of an IP address
Regions, network border groups, Local Zones, Wavelength Zones,
GLOBAL, and how to decodecompute-1reverse DNS names. -
Who owns this AWS IP address?
What AWS will and won't disclose, what you can learn anyway, and how to find the resource if it's in your own account.
Respond to AWS traffic
-
AWS IPs hitting my server
What an AWS source address usually means, which sources are benign, and why blocking all of AWS breaks things.
-
Report abuse from an AWS IP address
Where to send a report, what evidence to include, what happens next, and when a report would be a mistake.
Build with AWS ranges
-
Allowlist AWS IP ranges
Managed prefix lists first, jq filters when you need raw CIDRs, change notifications, and services AWS doesn't publish.
-
CloudFront IP ranges and the real client IP
CLOUDFRONTversusCLOUDFRONT_ORIGIN_FACING, locking an origin to CloudFront, and getting the viewer's IP in nginx.
Reference
For the details behind the guides, the reference section covers every service code in ip-ranges.json and the format of the file itself. How it works explains where this site's answers come from.