awho

What is this IP? Resource attribution across your AWS Organization.

An address turns up in a flow log, an ALB access log, a firewall deny or a GuardDuty finding. Working out what it is means knowing which of your hundreds of accounts to look in. awho 10.42.13.7 answers that with no database, no SQL and no per-account config, and it tells you what the thing actually is, not just that it is "an ENI".

$ awho --demo 10.42.13.7

10.42.13.7
  2 matches, best first — this address exists in more than one place
  account  111111111111  (prod-payments)
  vpc      vpc-0a1b2c3d  10.42.0.0/16  eu-west-1
  subnet   subnet-0f9e1a2b  10.42.12.0/22  eu-west-1b
  eni      eni-0c4d5e6f  in-use
  owner    VPC Endpoint  vpce-0a1b2c3d4e5f60718
  tags     team=payments  cost-center=4471
  index    demo (synthetic data, not your infrastructure)
  ...

Status: pre-alpha

Version 0.0.x only works against a built-in synthetic index (--demo). It does not talk to AWS yet. What is in place:

• ENI decoder that identifies the owner from structured signals first (InterfaceType, requester, instance attachment) and reads the description only as a last resort. The rules are data, in decode/services.json.
• Lookups by IPv4 address (including secondary private IPs) or eni-… ID.
• Every match is returned, ranked. An address that exists in two accounts is shown twice, never silently resolved to one.
• RAM-shared subnets: the ENI's account and the VPC's account are shown separately.

Coming next: awho index build (read-only sweep of every account in the Organization into a local SQLite index), awho index status, and the second hop from ENI to the load balancer, endpoint service or task behind it.

Install

pipx install awho
awho --demo 10.42.13.7

Python 3.11+.

Usage

awho [--demo] [--json] [--account ID] <ip | eni-id>

Data goes to stdout; warnings and errors go to stderr, so awho --json … | jq works. Exit codes: 0 found, 1 not found, 2 usage error, 3 index missing or unreadable.

Licence

Apache-2.0.