Start free
FREE TOOL

AWS IP Address Lookup

Check if an IP address belongs to AWS and find its Region, service and network border group, or list AWS IP ranges by service and Region.

  • Your data never leaves your browser: everything is calculated by JavaScript on this page, not on a server.
  • Nothing you enter is uploaded, processed on a server or stored. Check it in your browser's developer tools (Network tab).
  • Once the page has loaded, the tool works without an internet connection.

IP addresses

One or more IPv4 or IPv6 addresses - or paste a log line, a CloudTrail event or an EC2 host name and the addresses in it are found.

List ranges by service →How AWS IP ranges work →
See result ↓

AWS IP ranges by service and Region

46 RANGES

For a security group or a route table, reference the AWS-managed prefix list com.amazonaws.global.cloudfront.origin-facing instead of copying the ranges: AWS keeps it up to date. 

130.176.88.0/21
54.239.134.0/23
52.82.134.0/23
130.176.86.0/23
130.176.140.0/22
130.176.0.0/18
54.239.204.0/22
130.176.160.0/19
70.132.0.0/18
15.158.0.0/16
130.176.136.0/23
54.239.170.0/23
130.176.96.0/19
54.182.184.0/22
204.246.166.0/24
130.176.64.0/21
54.182.172.0/22
205.251.218.0/24
130.176.144.0/20
54.182.176.0/21
130.176.78.0/23
54.182.248.0/22
64.252.128.0/18
54.182.154.0/23
64.252.64.0/18
54.182.144.0/21
54.182.224.0/21
130.176.128.0/21
52.46.0.0/18
3.172.64.0/18
52.82.128.0/23
18.68.0.0/16
54.182.156.0/22
54.182.160.0/21
54.182.240.0/21
130.176.192.0/19
130.176.76.0/24
54.239.208.0/21
54.182.188.0/23
24.110.128.0/17
3.172.0.0/18
130.176.80.0/22
54.182.128.0/20
130.176.72.0/22
13.124.199.0/24
3.29.57.0/26
curl -s https://ip-ranges.amazonaws.com/ip-ranges.json | jq -r '.prefixes[] | select(.service=="CLOUDFRONT_ORIGIN_FACING") | .ip_prefix'

The same list from a shell, for a script that keeps a firewall or an allow list current.

IP addressing, prefix lists and edge networking are AWS Advanced Networking Specialty topicsTry free ANS-C01 practice questions with answers and explanations.ANS-C01 questions →

How AWS publishes its IP address ranges

AWS publishes its public IP address ranges in one JSON file, https://ip-ranges.amazonaws.com/ip-ranges.json, updated whenever they change. It covers the services customers commonly filter traffic by - not every service, and not the addresses customers bring to AWS (BYOIP). Each range has four fields:

FieldWhat it says
ip_prefix / ipv6_prefixThe range, in CIDR notation. AWS may announce it on the internet in smaller pieces.
regionThe AWS Region, or GLOBAL for services served from edge locations, such as CloudFront and Global Accelerator.
serviceThe subset the range belongs to: EC2, S3, CLOUDFRONT, ROUTE53_HEALTHCHECKS and so on, or AMAZON.
network_border_groupThe Availability Zones or Local Zones AWS announces the range from - the Region itself, or a Local Zone such as us-east-1-dfw-2.

The same range is often listed several times. Every range is in AMAZON, so an address listed for AMAZON only is Amazon's but not assigned to a service AWS names. And a service built on EC2 lists its ranges under EC2 too: an address listed for both S3 and EC2 is used by S3 alone. That is why the lookup names the service that is not EC2.

What a lookup tells, and what it does not

A match says the address is AWS's, in which Region and for which service. It does not say whose it is: an address in the EC2 ranges can be any customer's instance, load balancer or NAT gateway. Seeing an AWS address in your logs means the traffic came from something running on AWS, not from AWS itself. To report abuse from an AWS address, use the AWS abuse form; only AWS can tell who used it.

Private addresses such as 10.0.1.25 are never in the file: they belong to your VPC. Neither is 169.254.169.254, the instance metadata service every EC2 instance reaches locally.

Allowing AWS services through a firewall

To allowService in ip-ranges.jsonAWS-managed prefix list
CloudFront to your origin onlyCLOUDFRONT_ORIGIN_FACINGcom.amazonaws.global.cloudfront.origin-facing
EC2 Instance Connect from the consoleEC2_INSTANCE_CONNECTcom.amazonaws.<region>.ec2-instance-connect
Route 53 health checkersROUTE53_HEALTHCHECKScom.amazonaws.<region>.route53-healthchecks
S3 or DynamoDB, through a gateway endpointS3, DYNAMODBcom.amazonaws.<region>.s3, .dynamodb
Calls from API Gateway to your backendAPI_GATEWAY (outbound addresses)None

Inside AWS, reference a prefix list rather than copying ranges: AWS keeps it current, and a security group rule with it stays one rule. Mind its weight - the CloudFront list counts as 55 rules against the security group's quota of 60. Outside AWS, refresh the ranges from the file on a schedule; AWS announces every change on the SNS topic arn:aws:sns:us-east-1:806199016981:AmazonIpSpaceChanged.

Frequently asked questions

How do I check if an IP address belongs to AWS?

Look it up in AWS's ip-ranges.json, as this tool does. If it is in a range, it is AWS's, and the range says the Region and service. If it is not, it is most likely not AWS's - though AWS does not publish the ranges of every service, nor the addresses customers bring to AWS.

Can I find which AWS account an IP address belongs to?

Not from outside. The ranges say only Region and service. Within your own accounts, find an address with aws ec2 describe-network-interfaces --filters Name=addresses.association.public-ip,Values=<ip> in each Region.

What are CloudFront's IP ranges?

CLOUDFRONT lists the edge servers viewers connect to; CLOUDFRONT_ORIGIN_FACING lists only the servers that connect to your origin, which is the list to allow on an origin's firewall. Pick either above.

Is anything I paste sent anywhere?

No. The page downloads AWS's file straight from AWS and looks the addresses up in your browser: nothing you enter is uploaded or stored. It only counts how many addresses were AWS's and which ranges were listed, never the addresses.

References

AWS IP address ranges
Syntax for AWS IP address range JSON
AWS-managed prefix lists
Locations and IP address ranges of CloudFront edge servers