Amazon Web Services IP Ranges

Known IP ranges

The blocks below are the major address allocations associated with Amazon Web Services. A network of this size deaggregates heavily, so an individual route in the global routing table is usually more specific than the block shown. Prefix sets change over time — use WHOIS Lookup for the authoritative current record for any specific IP.

3.0.0.0/8 (partial)
18.0.0.0/8 (partial)
52.0.0.0/8 (partial)
54.0.0.0/8 (partial)
13.32.0.0/15
99.77.0.0/16

What does an Amazon Web Services IP mean in a privacy test?

An AWS IP as your visible exit almost certainly means your VPN provider hosts its servers on AWS infrastructure. Many commercial VPNs use AWS for some or all of their server fleet.

Where AWS publishes its own IP list

AWS publishes the ranges behind the services customers commonly filter on as a single JSON file at https://ip-ranges.amazonaws.com/ip-ranges.json. Each entry has four fields: ip_prefix, region (an AWS region code such as eu-west-1, or GLOBAL), network_border_group, and service. The header carries syncToken, the publication time as a Unix timestamp, and createDate in UTC; AWS documents comparing those against a saved copy as the way to tell whether anything moved, and publishes an SNS topic that notifies on change.

Two limits are worth knowing before treating the file as complete. AWS states that it does not publish ranges for every service, only the ones customers commonly use for egress filtering, and addresses customers bring to AWS under BYOIP are not in the file at all — so an address missing from ip-ranges.json is not evidence that it is not AWS. A listed prefix may also be announced to the routing table in smaller pieces than the file shows; AWS gives 96.127.0.0/17 as an example of one entry advertised as four more specific routes. There is a separate RFC 8805 geolocation feed at https://ip-ranges.amazonaws.com/geo-ip-feed.csv, which is the one that places Local Zones away from their parent region.

Which AWS service is behind an address

The service field answers the question behind most AWS address lookups: is this Amazon, or is it somebody renting from Amazon. Every prefix is listed under AMAZON, and the narrower codes name the subset. EC2 is customer compute — a machine rented by the hour, which is what a VPN exit, a crawler and a small production site all look like from outside. CLOUDFRONT and CLOUDFRONT_ORIGIN_FACING are Amazon's own CDN, ROUTE53_HEALTHCHECKS is Amazon's health-check probes arriving at an origin on a schedule its owner set, and S3, DYNAMODB and API_GATEWAY are managed services. AWS documents one trap in reading these: S3 runs on EC2 resources, so some ranges are returned under both codes, and the ranges used exclusively by EC2 are the ones under EC2 but not under S3.

What a match does not give you is a who. An address in AWS space is a machine in an Amazon data centre, and in the EC2 subset that machine belongs to a tenant the file does not name; WHOIS returns Amazon for every tenant on the range. AS16509 carries the bulk of that space. A second Amazon network, AS14618, registered as AMAZON-AES, announces well over a thousand prefixes of its own, so an AWS address that does not look up as AS16509 has usually landed there.

Related tools

Frequently asked questions