Build: PocketAWS—Instantly Check If an IP Belongs to AWS (and Why It Matters)

Build: PocketAWS—Instantly Check If an IP Belongs to AWS (and Why It Matters)

Introduction

You’re knee-deep in log analysis. You spot an unfamiliar IP address. Is it from AWS? Some random bot? Something worse?

You need an answer — fast — but the last thing you want is to download a 600MB SDK or trudge through documentation. That’s why we built the PocketAWS IP Checker, a lightweight Python tool that does one thing and does it well.

How It Works

The IP Checker grabs the official AWS IP ranges (published in JSON) and caches them locally. When you check an IP, it instantly tells you if it matches any AWS block, and if so, what region and service it belongs to.

About Backups

When you update the AWS IP list (--update), PocketAWS automatically creates a backup of your current IP list before downloading the latest version.

The backup is saved in the same folder with a timestamped name like: 

Bash

~/.cache/aws-ip-checker/ip-ranges-20250426-143512.json   

Why? Because things happen:

• Maybe you need to compare changes later
• Maybe AWS publishes something unexpected
• Maybe the download fails halfway through

We believe your data deserves respect. You stay in control — always.

How to Use It

First, install the only external dependency:

Bash

pip install requests   

Download the Gist or save aws_ip_check.py locally.

To check an IP address: 

Bash

python3 aws_ip_check.py 3.5.140.0  

Example output: 

Bash

3.5.140.0 is an AWS IP. 
Region: ap-northeast-2 
Service: AMAZON   

To update the cached AWS IP list: 

Bash

python3 aws_ip_check.py --update   

Example output: 

Bash

Successfully updated AWS IP list. 
Backup of previous IP list created at ip-ranges-20250426-143512.json  

To check a non-AWS IP:

Bash

python3 aws_ip_check.py 8.8.8.8   

Example output: 

Bash

8.8.8.8 is NOT an AWS IP.   

Why It Matters

In a cloud-first world, knowing if an IP belongs to your own vendor — or someone unexpected — can make all the difference. Fast identification helps with:

• Incident response
• Firewall rule reviews
• Security audits
• General peace of mind

And best of all? It’s open, inspectable, and small enough to understand at a glance.

Acknowledgment

The idea of checking if an IP address belongs to AWS has been explored before — notably in Paul Santus’s GitHub project, which offers a library you can install within the AWS ecosystem.

PocketAWS builds on the spirit of these solutions but with a different goal in mind: We wanted a lightweight, portable script that could be run anywhere — inside AWS, outside AWS, or even in completely isolated environments — without needing a full installation or SDK dependencies.

Fast, transparent, and ready for real-world use wherever engineers find themselves.

Closing Thought

Think of the AWS IP list like today's tech news. It’s meant to tell you what's happening right now, not to preserve yesterday's headlines. You update it because cloud services evolve — just like the news cycle.

What's Next for PocketAWS

This is the first tool in the new PocketAWS series. Up next:

• AWS ARN Explainer: Break down confusing ARNs into readable chunks
• S3 URL Builder: Build public and private S3 links effortlessly
• IAM Policy Linter: Find weak spots in your AWS permissions
• AWS Log Keyword Watcher: Spot problems in logs before they explode

Stay tuned — or better yet, build with us!

Need AWS Expertise?

We'd love to help you with your AWS projects.  Feel free to reach out to us at info@pacificw.com.

Written by Aaron Rose, software engineer and technology writer at Tech-Reader.blog.