How AWS publishes its IP address ranges
AWS publishes its public IP address ranges in one JSON file, https://ip-ranges.amazonaws.com/ip-ranges.json, updated whenever they change. It covers the services customers commonly filter traffic by - not every service, and not the addresses customers bring to AWS (BYOIP). Each range has four fields:
| Field | What it says |
|---|---|
ip_prefix / ipv6_prefix | The range, in CIDR notation. AWS may announce it on the internet in smaller pieces. |
region | The AWS Region, or GLOBAL for services served from edge locations, such as CloudFront and Global Accelerator. |
service | The subset the range belongs to: EC2, S3, CLOUDFRONT, ROUTE53_HEALTHCHECKS and so on, or AMAZON. |
network_border_group | The Availability Zones or Local Zones AWS announces the range from - the Region itself, or a Local Zone such as us-east-1-dfw-2. |
The same range is often listed several times. Every range is in AMAZON, so an address listed for AMAZON only is Amazon's but not assigned to a service AWS names. And a service built on EC2 lists its ranges under EC2 too: an address listed for both S3 and EC2 is used by S3 alone. That is why the lookup names the service that is not EC2.
What a lookup tells, and what it does not
A match says the address is AWS's, in which Region and for which service. It does not say whose it is: an address in the EC2 ranges can be any customer's instance, load balancer or NAT gateway. Seeing an AWS address in your logs means the traffic came from something running on AWS, not from AWS itself. To report abuse from an AWS address, use the AWS abuse form; only AWS can tell who used it.
Private addresses such as 10.0.1.25 are never in the file: they belong to your VPC. Neither is 169.254.169.254, the instance metadata service every EC2 instance reaches locally.
Allowing AWS services through a firewall
| To allow | Service in ip-ranges.json | AWS-managed prefix list |
|---|---|---|
| CloudFront to your origin only | CLOUDFRONT_ORIGIN_FACING | com.amazonaws.global.cloudfront.origin-facing |
| EC2 Instance Connect from the console | EC2_INSTANCE_CONNECT | com.amazonaws.<region>.ec2-instance-connect |
| Route 53 health checkers | ROUTE53_HEALTHCHECKS | com.amazonaws.<region>.route53-healthchecks |
| S3 or DynamoDB, through a gateway endpoint | S3, DYNAMODB | com.amazonaws.<region>.s3, .dynamodb |
| Calls from API Gateway to your backend | API_GATEWAY (outbound addresses) | None |
Inside AWS, reference a prefix list rather than copying ranges: AWS keeps it current, and a security group rule with it stays one rule. Mind its weight - the CloudFront list counts as 55 rules against the security group's quota of 60. Outside AWS, refresh the ranges from the file on a schedule; AWS announces every change on the SNS topic arn:aws:sns:us-east-1:806199016981:AmazonIpSpaceChanged.
Region and location codes in AWS logs, headers and bills
| Code | Where it shows up | What it names |
|---|---|---|
IAD89-C1, DFW3 | X-Amz-Cf-Pop header, x-edge-location in CloudFront logs | The CloudFront edge location that served the request: an airport's IATA code and a number |
eu-central-1 | ARNs, endpoints, ip-ranges.json | A Region |
EUC1, EU | Usage types, Cost and Usage Reports, bills | A Region's short code: APE1-USE1-AWS-In-Bytes names Hong Kong and N. Virginia |
use1-az4 | Subnets, capacity reservations, RAM shares | An Availability Zone, the same one in every account |
us-east-1a | The console, most APIs | An Availability Zone as your account names it |
us-east-1-bos-1a, us-east-1-bos-1 | Subnets, network_border_group in ip-ranges.json | A Local Zone and its network border group |
The codes for one Region are not built the same way. Asia Pacific (Mumbai) is APS3 in usage types but its AZ IDs start with aps1, while APS1 in usage types is Singapore, whose AZ IDs start with apse1. And CloudFront's usage types use their own two-letter areas: its EU means edge locations in Europe and Israel, not the Europe (Ireland) Region that EU stands for elsewhere.
An AZ name such as us-east-1a can be a different physical zone in another account: in the oldest Regions, accounts created before November 2025 each got their own mapping. To line up subnets across accounts, compare AZ IDs - aws ec2 describe-availability-zones lists both.
AWS does not publish a list of CloudFront's edge location codes. It says only that the three letters typically are the IATA code of an airport near the edge location, and that the codes may change - so the lookup names that airport, from the public-domain OurAirports list.
Frequently asked questions
How do I check if an IP address belongs to AWS?
Look it up in AWS's ip-ranges.json, as this tool does. If it is in a range, it is AWS's, and the range says the Region and service. If it is not, it is most likely not AWS's - though AWS does not publish the ranges of every service, nor the addresses customers bring to AWS.
Can I find which AWS account an IP address belongs to?
Not from outside. The ranges say only Region and service. Within your own accounts, find an address with aws ec2 describe-network-interfaces --filters Name=addresses.association.public-ip,Values=<ip> in each Region.
What are CloudFront's IP ranges?
CLOUDFRONT lists the edge servers viewers connect to; CLOUDFRONT_ORIGIN_FACING lists only the servers that connect to your origin, which is the list to allow on an origin's firewall. Pick either above.
What does X-Amz-Cf-Pop mean?
It names the CloudFront edge location that handled the request. IAD89-C1 is an edge location near Washington Dulles International Airport (IAD), and 89 is a number AWS assigns to it. CloudFront logs the same code in x-edge-location.
What is the difference between an AZ ID and an AZ name?
An AZ ID such as use1-az4 is the same physical Availability Zone in every account. An AZ name such as us-east-1a is what your account calls a zone, and in the oldest Regions it can point to a different zone in another account.
Is anything I paste sent anywhere?
No. The page downloads AWS's file straight from AWS and looks the addresses up in your browser: nothing you enter is uploaded or stored. It only counts how many addresses were AWS's, which ranges were listed and which kind of code was looked up, never the addresses or codes.
References
AWS IP address ranges
Syntax for AWS IP address range JSON
AWS-managed prefix lists
Locations and IP address ranges of CloudFront edge servers
CloudFront standard logging reference (x-edge-location)
AWS Regions
AWS Region billing codes
AWS Availability Zones
AZ IDs
Available Local Zones
CloudFront usage types
OurAirports open data (IATA airport codes)