Generating a list of IPs and EIPs across multiple AWS accounts

Question

I'm trying to figure out the best way possible to quickly determine if a given AWS IP address is linked to an AWS account that's under my control. In the past, this was pretty easy with one or two AWS accounts. With a wider multi-account strategy this has become more difficult and time consuming.

Does anyone have any suggestions on how to best tackle this? S3 Storage Lens works great for monitoring S3 buckets across all accounts, but obviously that is for S3 and not EIPs.

user_4438168 · Answer

This is not the "best possible" way, but its quick and easy. Use the AWS CLI aws ec2 describe-addresses which will dump the EIPs and a few useful details as a JSON string. Send this output to a file by appending > myips.txt then just search for the IP with a text editor.

aws ec2 describe-addresses > myips.txt

myips.txt would contain data like this for each EIP

{
    "Addresses": [
        {
            "InstanceId": "i-XXXXXXXXXXXXXXXXX",
            "PublicIp": "XXX.XXX.XXX.XXX",
            "AllocationId": "eipalloc-XXXXXXXX",
            "AssociationId": "eipassoc-XXXXXXXX",
            "Domain": "vpc",
            "NetworkInterfaceId": "eni-XXXXXXXX",
            "NetworkInterfaceOwnerId": "XXXXXXXXXXXX",
            "PrivateIpAddress": "XXX.X.X.XXX",
            "Tags": [
                {
                    "Key": "Name",
                    "Value": "Web1"
                },
                {
                    "Key": "Role",
                    "Value": "Web"
                }
            ],
            "PublicIpv4Pool": "amazon",
            "NetworkBorderGroup": "us-east-1"
        }
    ]
}

If you have a bunch of different accounts you can use different creds by name like this: aws --profile producton ec2 describe-addresses >> myips.txt (note: >> appends). This assumes the profile "production" is defined in ~/.aws/credentials (Linux & Mac) or %USERPROFILE%.aws\credentials (Windows) like this:

[production]
aws_access_key_id=AKIAI44QH8DHBEXAMPLE
aws_secret_access_key=je7MtGbClwBF/2Zp9Utk/h3yCo8nvbEXAMPLEKEY

Create yourself a .sh or .bat script and use it to execute aws against each profile/region and keep appending the result to the "myips.txt" file in the current directory:

aws --profile production --region us-east-1 ec2 describe-addresses > myips.txt
aws --profile production --region ca-central-1 ec2 describe-addresses >> myips.txt
aws --profile sandbox ec2 describe-addresses >> myips.txt
aws --profile testing ec2 describe-addresses >> myips.txt
aws --profile backup ec2 describe-addresses >> myips.txt

Then you can run this script anytime you need to look up an IP (it will create/overwrite myips.txt each time you run the script).

You can obviously automate this a lot further, iterate over each region, nicely format the output etc. Another option is to search for the IP with the various filter options for aws cli. It might work out quicker to search for the desired IP rather than retrieve a list of all of them. This all very much depends on how much effort you want to put in and the size of your aws account.

Generating a list of IPs and EIPs across multiple AWS accounts

1 Answers