AWS ip-ranges.json service codes explained

AMAZON — Service not disclosed

Umbrella: covers many services

The catch-all tag. Every address AWS publishes is also covered by an AMAZON entry, on the same range or a larger one, so on its own it only says the address is used by AWS. When AMAZON is the only tag, AWS uses the range but doesn't say for what: AWS infrastructure and API endpoints, a service AWS doesn't publish separately, or space not in use yet.

AMAZON-only ranges come in two shapes: standalone ranges, and small carve-outs nested inside EC2 blocks. In our tests, many of AWS's own regional API endpoints (STS, SQS, SNS, KMS, IAM, CloudWatch and others) sat in such carve-outs. That is an observation, not documented behaviour; lookups label these ranges "Undisclosed service, carved out of EC2 space". Much of the AMAZON-only space isn't announced on the internet at all.

If this IP contacts your server: The traffic comes from AWS itself or from a service AWS doesn't name, not necessarily from a customer's server. AWS's data can't say which service, and reverse DNS rarely helps for these ranges.

AWS documentation: Syntax for AWS IP address range JSON

EC2 — EC2 address space

Umbrella: covers many services

Public addresses from Amazon EC2's pool. That covers EC2 instances and many services built on EC2: Elastic IPs, load balancers, NAT gateways, Lambda and Fargate outbound traffic, regional API Gateway endpoints, Lambda function URLs and some AWS endpoints. AWS's data can't tell these apart, so EC2 means the address space, not necessarily an instance.

AWS itself warns that blocking EC2 address space also blocks the non-EC2 services built on it. Amazon's own web crawler, Amazonbot, uses EC2 addresses too. Reverse DNS doesn't settle it either: names like ec2-3-18-1-10.us-east-2.compute.amazonaws.com appear for load balancers and AWS endpoints as well as instances.

If this IP contacts your server: It came from something running on AWS: a customer's server, container or function, or an AWS service that uses EC2 addresses. The address is rented from AWS, so it doesn't identify the customer, and it may be someone else's tomorrow.

AWS documentation: AWS IP address ranges: egress control

S3 — Amazon S3

Inbound: clients connect to it

Amazon S3 storage endpoints: the addresses clients connect to when they read or write S3 buckets, including static websites hosted on S3. Content in a bucket belongs to the customer who owns the bucket, not to AWS.

Many S3 ranges are also tagged EC2; AWS says such ranges are used only by S3. If your servers in a VPC talk to S3 in the same region, a gateway VPC endpoint keeps that traffic off the internet and out of NAT gateway charges.

If this IP contacts your server: S3 endpoints answer requests rather than start connections. Traffic from these addresses is normally a reply to a request made from your side, such as a download from a bucket.

AWS documentation: Syntax for AWS IP address range JSON: range overlaps

CLOUDFRONT — Amazon CloudFront

Inbound: clients connect to it

CloudFront, AWS's content delivery network. Most CLOUDFRONT ranges are tagged GLOBAL: they are edge servers around the world that visitors connect to, serving websites and files for AWS customers. Some ranges carry a region instead: CloudFront's own IP list calls these regional edge caches (CLOUDFRONT_REGIONAL_EDGE_IP_LIST).

The reverse DNS name of an edge server, such as server-1-2-3-4.bud50.r.cloudfront.net, names the edge location (bud is Budapest). More in the CloudFront IP ranges guide.

If this IP contacts your server: Edge servers mostly receive visitors' requests. When CloudFront contacts a server, it is usually fetching content because some CloudFront distribution uses that server as its origin; AWS publishes those origin-facing servers as CLOUDFRONT_ORIGIN_FACING.

AWS documentation: Locations and IP address ranges of CloudFront edge servers

DYNAMODB — Amazon DynamoDB

Inbound: clients connect to it

Endpoints of Amazon DynamoDB, AWS's NoSQL database: the addresses applications connect to when they call the DynamoDB API. AWS notes that they don't cover DynamoDB Streams or DynamoDB Accelerator (DAX).

As with S3, a gateway VPC endpoint keeps traffic from your VPC to DynamoDB off the internet.

If this IP contacts your server: DynamoDB endpoints answer API requests; they don't open connections to other servers. Traffic from these addresses is a reply to a request made from your side.

AWS documentation: Accessing DynamoDB: IP address ranges

EBS — Amazon EBS direct APIs

Inbound: clients connect to it Not documented by AWS

AWS doesn't describe this code. When we checked, the endpoints of the EBS direct APIs (such as ebs.us-east-1.amazonaws.com, used to read and write snapshot data) resolved into these ranges, so they are most likely API endpoints that clients connect to.

AWS added this code in May 2021.

If this IP contacts your server: These look like API endpoints, which answer requests rather than start them. Traffic from them is most likely a reply to a request made from your side.

AWS documentation: Use EBS direct APIs to access the contents of an EBS snapshot (doesn't cover these ranges)

ROUTE53 — Route 53 name servers

Inbound: clients connect to it

The authoritative DNS name servers of Amazon Route 53, which answer DNS queries for domains hosted on Route 53. AWS says these addresses are static.

Route 53 name servers have names like ns-123.awsdns-45.com.

If this IP contacts your server: Route 53 name servers answer DNS queries; they don't start connections. Traffic from them is a DNS response to a query from your network. A flood of responses you never asked for suggests your address is being spoofed in a DNS reflection attack.

AWS documentation: IP address ranges of Amazon Route 53 servers

AMAZON_CONNECT — Amazon Connect

Inbound: clients connect to it

Amazon Connect is AWS's cloud contact center service. These addresses carry the audio of softphone calls: agents' browsers connect to them (UDP port 3478) when they take calls in the Contact Control Panel. AWS says the ranges aren't shared with other services.

AWS says new Amazon Connect ranges appear in the file at least 30 days before the service starts using them.

If this IP contacts your server: Usually the audio of a call: someone on your network is using an Amazon Connect softphone, and this is the media stream coming back. These servers don't open connections to arbitrary hosts.

AWS documentation: Set up your network to use the Contact Control Panel

CHIME_MEETINGS — Amazon Chime SDK meetings

Inbound: clients connect to it

Media servers for meetings in apps built with the Amazon Chime SDK. The apps connect to them for audio, video and screen sharing (UDP port 3478 and TCP port 443) under the chime.aws domain.

If this IP contacts your server: Usually the media stream of a meeting that someone on your network joined in an app built on the Amazon Chime SDK. These servers answer meeting clients; they don't open connections to arbitrary hosts.

AWS documentation: Configuring your network for Amazon Chime SDK meetings

IVS_LOW_LATENCY — Amazon IVS low-latency streaming

Inbound: clients connect to it Not documented by AWS

Amazon Interactive Video Service (IVS) low-latency streaming, used for live video in apps and websites. AWS doesn't describe this range, but when we checked, IVS's global ingest endpoint, where broadcasters send their streams, resolved into it.

AWS added this code in July 2025.

If this IP contacts your server: Probably IVS servers answering a broadcaster on your network who is streaming to IVS. AWS doesn't document the range, so other traffic from it isn't explained.

AWS documentation: What is Amazon IVS Low-Latency Streaming? (doesn't cover these ranges)

IVS_REALTIME — Amazon IVS real-time streaming

Inbound: clients connect to it Not documented by AWS

Amazon IVS real-time streaming, for interactive video with many participants (IVS stages). AWS doesn't describe these ranges; when we checked, IVS's global ingest endpoint resolved into some of them, so they are probably servers that broadcasters' and participants' apps connect to.

AWS added this code in June 2024.

If this IP contacts your server: Probably IVS servers exchanging live video with an app on your network. AWS doesn't document the ranges, so other traffic from them isn't explained.

AWS documentation: What is Amazon IVS Real-Time Streaming? (doesn't cover these ranges)

WORKSPACES_GATEWAYS — Amazon WorkSpaces gateways

Inbound: clients connect to it

Streaming gateways for Amazon WorkSpaces, AWS's virtual desktops. WorkSpaces client apps on users' devices connect to them to stream the remote desktop (port 4172 for PCoIP, 4195 for DCV).

If this IP contacts your server: Usually the desktop stream of a WorkSpaces session: someone on your network is using a WorkSpace, and this is the gateway answering. The gateways don't open connections to arbitrary hosts.

AWS documentation: IP address and port requirements for WorkSpaces Personal

API_GATEWAY — Amazon API Gateway

Outbound: it connects to other servers

Outbound traffic from Amazon API Gateway, for example when an API forwards a request to a backend over HTTP. AWS documents these addresses as egress only: APIs hosted on API Gateway are not reached at them (regional APIs use EC2 address space, edge-optimized APIs use CloudFront).

An API's own hostname (<id>.execute-api.<region>.amazonaws.com) resolves into EC2 or AMAZON space for regional APIs and into CloudFront for edge-optimized ones, never into these ranges.

If this IP contacts your server: An API on API Gateway, run by some AWS customer, sent a request to your server, usually because it is configured to call your server as a backend. Anyone can set that up, and some tools use API Gateway to rotate source addresses, so treat abusive traffic like any other traffic from AWS.

AWS documentation: Syntax for AWS IP address range JSON (the service field)

CLOUDFRONT_ORIGIN_FACING — CloudFront origin-facing servers

Outbound: it connects to other servers

The CloudFront servers that connect to origins, the web servers and buckets that CloudFront fetches content from. AWS also publishes them as a managed prefix list so origin owners can accept traffic only from CloudFront.

If your origin runs on AWS, reference the managed prefix list com.amazonaws.global.cloudfront.origin-facing (and its IPv6 twin) in a security group instead of copying ranges. Some ranges appear under both CLOUDFRONT and CLOUDFRONT_ORIGIN_FACING. See the CloudFront IP ranges guide for the real-client-IP headers.

If this IP contacts your server: CloudFront is fetching content from your server because a CloudFront distribution uses it as an origin. The visitor behind the request is normally in the X-Forwarded-For header. If you never put CloudFront in front of your server, someone else's distribution may be pointing at it.

AWS documentation: Use the CloudFront managed prefix list

ROUTE53_HEALTHCHECKS — Route 53 health checkers

Outbound: it connects to other servers

Route 53 health checkers. They send regular HTTP, HTTPS or TCP requests from several AWS locations to endpoints that Route 53 customers monitor.

Some health-checker ranges are tagged GLOBAL. The reverse DNS name of a checker (ec2-…<region>.compute.amazonaws.com) shows the region it really runs in.

If this IP contacts your server: A Route 53 health check is pointed at your address, usually set up by whoever runs the service on it (possibly you, or a previous user of the address). Each checker repeats every 10 or 30 seconds, so the requests are frequent but harmless; block these ranges if you don't want them.

AWS documentation: IP address ranges of Amazon Route 53 servers

EC2_INSTANCE_CONNECT — EC2 Instance Connect

Outbound: it connects to other servers

The browser-based SSH client in the Amazon EC2 console. When someone connects to an instance from the console, the SSH connection to the instance comes from these addresses, which are separate for each region.

AWS also publishes these ranges as managed prefix lists named com.amazonaws.<region>.ec2-instance-connect. Connecting with your own SSH client or the AWS CLI comes from your own address instead.

If this IP contacts your server: Someone used EC2 Instance Connect in the AWS console to open an SSH session to this address, normally the owner of an instance connecting to their own server. Connections from these ranges to port 22 are expected on instances that allow console SSH.

AWS documentation: Prerequisites for EC2 Instance Connect

CODEBUILD — AWS CodeBuild

Outbound: it connects to other servers Not documented by AWS

AWS CodeBuild runs build and test jobs for AWS customers. AWS doesn't spell out what these ranges are for; they are most likely the outbound addresses of builds that don't run inside the customer's own VPC, for example when a build downloads code or packages.

Builds that run inside a customer's VPC use that VPC's own addresses, for example a NAT gateway in EC2 address space, rather than these ranges.

If this IP contacts your server: Most likely a CodeBuild job run by some AWS customer, such as a build fetching code or dependencies from your server. Builds run customer-supplied code, so the traffic can be anything; treat abusive traffic like any other traffic from AWS.

AWS documentation: What is AWS CodeBuild? (doesn't cover these ranges)

AMAZON_APPFLOW — Amazon AppFlow

Outbound: it connects to other servers

Amazon AppFlow moves data between SaaS applications (such as Salesforce), databases and AWS. AWS says AppFlow operates from these ranges, so they are the addresses it connects from when it reads from or writes to those applications.

If this IP contacts your server: An AppFlow flow set up by some AWS customer is connecting to your application or API, usually with credentials that customer was given. If you run the application, check which integration or connected account the traffic belongs to.

AWS documentation: General information for Amazon AppFlow flows

CLOUD9 — AWS Cloud9

Outbound: it connects to other servers

AWS Cloud9, a browser-based code editor that is no longer available to new customers. It connects over SSH from these addresses to the servers its users set up as SSH environments.

For Cloud9 environments on EC2, AWS adds these ranges to the instance's security group automatically.

If this IP contacts your server: A Cloud9 user set up your server as an SSH development environment, or tried to. The connection only works if the SSH key that Cloud9 generated is installed on your server.

AWS documentation: Inbound SSH IP address ranges for AWS Cloud9

GLOBALACCELERATOR — AWS Global Accelerator

Both directions

Global Accelerator gives AWS customers static anycast addresses (each one answered from many locations at once) that carry users' traffic to their applications over AWS's network. Ranges tagged GLOBAL are those static addresses; ranges tagged with a region are the points of presence that pass traffic on to the customers' endpoints.

The reverse DNS name of an accelerator address (a1234567890abcdef.awsglobalaccelerator.com) identifies the exact accelerator.

If this IP contacts your server: A regional Global Accelerator address means an accelerator is forwarding users' traffic to your server as one of its endpoints; depending on its settings, you see Global Accelerator's address instead of the user's. GLOBAL addresses are accelerators' entry points, which receive traffic rather than send it.

AWS documentation: Location and IP address ranges of Global Accelerator edge servers

CHIME_VOICECONNECTOR — Amazon Chime SDK Voice Connector

Both directions

Voice Connector is a SIP trunking service that links phone systems to the phone network. These addresses carry SIP signaling (ports 5060 and 5061) and call audio in both directions between Voice Connector and customers' phone systems.

If this IP contacts your server: SIP or call audio from these addresses means a Voice Connector is sending calls to your phone system, which its owner set up as a destination. If you don't run SIP equipment, someone may have entered your address by mistake.

AWS documentation: Network configuration for Amazon Chime SDK Voice Connector

ROUTE53_HEALTHCHECKS_PUBLISHING — Route 53 health check publishing (internal)

Internal to AWS

Addresses that Route 53 uses only internally for its health-checking system. AWS says you don't need to allow them through any firewall.

If this IP contacts your server: AWS says these ranges are used only internally, so traffic from them on the public internet isn't expected. If you really see it, AWS's documentation doesn't explain it.

AWS documentation: IP address ranges of Amazon Route 53 servers

ROUTE53_RESOLVER — Route 53 Resolver

Direction not documented Not documented by AWS

AWS doesn't document this code. Route 53 Resolver (now called Route 53 VPC Resolver) is the DNS resolver built into every VPC, so these are most likely the addresses it uses when it looks up public domain names for AWS resources. That is an inference, not something AWS states.

AWS added this code in June 2021 without describing it.

If this IP contacts your server: If your DNS servers receive queries from these addresses, that fits the likely explanation: something running in AWS is looking up a name in a zone you host. AWS's documentation doesn't explain any other traffic from these ranges.

AWS documentation: What is Route 53 VPC Resolver? (doesn't cover these ranges)

EFS — Amazon EFS

Direction not documented Not documented by AWS

Amazon Elastic File System (EFS). AWS doesn't say what these ranges are used for. EFS file systems are normally reached through mount targets with private addresses inside a VPC, so these public ranges are probably EFS service infrastructure rather than customers' file systems.

As of September 2026, EFS isn't in AWS's documented list of valid service codes, even though the file uses it.

If this IP contacts your server: AWS's documentation doesn't explain traffic from these ranges, so all that can be said is that it comes from AWS's EFS infrastructure.

AWS documentation: What is Amazon Elastic File System? (doesn't cover these ranges)

AURORA_DSQL — Amazon Aurora DSQL

Direction not documented Not documented by AWS

Aurora DSQL is AWS's serverless, PostgreSQL-compatible distributed database. AWS doesn't say what these ranges are for, and the public DSQL API endpoint itself sits in EC2 address space. They may be where clients connect to DSQL clusters, but that is a guess.

AWS added this code in May 2025.

If this IP contacts your server: AWS's documentation doesn't explain traffic from these ranges, so all that can be said is that it comes from Aurora DSQL infrastructure.

AWS documentation: What is Amazon Aurora DSQL? (doesn't cover these ranges)

KINESIS_VIDEO_STREAMS — Amazon Kinesis Video Streams

Direction not documented Not documented by AWS

Kinesis Video Streams takes in and plays back video from cameras and other devices, including two-way WebRTC connections. AWS doesn't say what these small ranges are for; its API and STUN endpoints sit in EC2 address space instead.

AWS added this code in November 2020.

If this IP contacts your server: AWS's documentation doesn't explain traffic from these ranges, so all that can be said is that it comes from Kinesis Video Streams infrastructure, possibly as part of a video session with a device on your network.

AWS documentation: What is Amazon Kinesis Video Streams? (doesn't cover these ranges)

MEDIA_PACKAGE_V2 — AWS Elemental MediaPackage v2

Direction not documented Not documented by AWS

MediaPackage prepares live video for delivery: packaging, DRM encryption and time-shifted viewing. AWS doesn't say what these small ranges are for; the MediaPackage v2 API endpoint sits in EC2 address space instead.

AWS added this code in May 2023.

If this IP contacts your server: AWS's documentation doesn't explain traffic from these ranges. MediaPackage calling a server that a customer configured, such as a DRM key server, would fit, but that is a guess.

AWS documentation: What is AWS Elemental MediaPackage? (doesn't cover these ranges)

New or unknown codes

AWS adds service codes from time to time and announces them in the release notes of its ip-ranges.json syntax page. This site never filters codes it doesn't know: a lookup that hits one shows the raw code with "no description yet" and links here.

An unknown code still tells you a lot:

• The range is AWS's, and its addresses are also covered by an AMAZON entry.
• The code's name usually names the AWS service that uses the range.
• Nothing says which way the traffic flows, so don't assume the service hosts websites or sends traffic until AWS documents it.
• As with every code, it never identifies the customer.

The check below lists the codes in AWS's current file and flags any that this page doesn't describe yet. If it flags one, please open an issue.