AMA: Find AWS Instances by their Private IP Addresses

[Deleted User]
edited March 2022 in Security Operations
How would I construct a query that finds AWS instances by their private IP addresses that return public IPs, AMIs, Accounts, Instance IDs and any tags associated with each?


  • The following pre-supposes you are using the tagging feature in your AWS integration, just replace the IP_ADDRESS with the real IP. Please note that I'm not aware of a way to return all tags. I believe you would have to enumerate the tags you want to include (e.g. using i.tag.<name_of_tag> in the RETURN clause).

    FIND aws_instance WITH privateIpAddress = "" AS i
    i.publicIpAddressAS PublicIP,
    i.imageId AS AMI,
    i.tag.AccoutnName AS AccountName, AS InstanceId

    You can  format this query to accept multiple IP addresses.

    FIND aws_instance 
    WITH privateIpAddress = ("x.x.x.x" or "x.y.x.y")

     You can find the original article to this AMA on the JupiterOne blog

This Month's Leaders