{"id":22874414,"url":"https://github.com/thesurlydev/aws-poller","last_synced_at":"2026-04-30T03:32:21.374Z","repository":{"id":105883453,"uuid":"144406816","full_name":"thesurlydev/aws-poller","owner":"thesurlydev","description":"An experiment to determine IP addresses associated with an AWS service over time.","archived":false,"fork":false,"pushed_at":"2018-08-11T19:45:42.000Z","size":20,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"master","last_synced_at":"2025-07-02T13:52:29.630Z","etag":null,"topics":["aws","bash","cloudwatch-logs","dig","ec2","flowlogs"],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/thesurlydev.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null}},"created_at":"2018-08-11T17:53:06.000Z","updated_at":"2018-08-11T19:45:43.000Z","dependencies_parsed_at":"2023-04-11T04:47:31.536Z","dependency_job_id":null,"html_url":"https://github.com/thesurlydev/aws-poller","commit_stats":null,"previous_names":["thesurlydev/aws-poller"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/thesurlydev/aws-poller","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thesurlydev%2Faws-poller","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thesurlydev%2Faws-poller/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thesurlydev%2Faws-poller/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thesurlydev%2Faws-poller/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/thesurlydev","download_url":"https://codeload.github.com/thesurlydev/aws-poller/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/thesurlydev%2Faws-poller/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":32453746,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-29T22:27:22.272Z","status":"online","status_checked_at":"2026-04-30T02:00:05.929Z","response_time":57,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws","bash","cloudwatch-logs","dig","ec2","flowlogs"],"created_at":"2024-12-13T14:36:06.257Z","updated_at":"2026-04-30T03:32:16.365Z","avatar_url":"https://github.com/thesurlydev.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# aws-poller\nThe following describes the setup for an experiment to determine the IP addresses of a specific AWS service over time. \n\nIn this case, I'd like to know the IP addresses associated with DynamoDB in the us-east-1 region. A shell script runs on an EC2 instance in an endless loop. For each iteration of the loop, we call `dig` and combine the result with various other metadata we're interested in. We then persist in a DynamoDB table to be queried later and perhaps do things like cross-reference the IP address and timestamp with Flow Log records.\n\nAlthough this is a crude implementation, there are no dependencies outside of an EC2 instance and an attached IAM role which should have permissions to update the DynamoDB table.\n\n\n## Create DynamoDB Table\n\nUse the follow aws cli command to create the table\n\n```\naws dynamodb create-table --table-name aws.dynamodb.ips \\\n --key-schema '[{\"AttributeName\":\"id\",\"KeyType\":\"HASH\"},{\"AttributeName\":\"dt\",\"KeyType\":\"RANGE\"}]' \\\n --attribute-definitions '[{\"AttributeName\":\"dt\",\"AttributeType\":\"S\"},{\"AttributeName\":\"id\",\"AttributeType\":\"S\"}]' \\\n --provisioned-throughput ReadCapacityUnits=1,WriteCapacityUnits=1\n``` \n\nOr, use the following CloudFormation (JSON) resource snippet:\n\n```\n{\n  \"Type\" : \"AWS::DynamoDB::Table\",\n  \"Properties\" : {\n    \"TableName\" : \"aws.dynamodb.ips\",\n    \"AttributeDefinitions\" : [ {\n      \"AttributeName\" : \"dt\",\n      \"AttributeType\" : \"S\"\n    }, {\n      \"AttributeName\" : \"id\",\n      \"AttributeType\" : \"S\"\n    } ],\n    \"KeySchema\" : [ {\n      \"AttributeName\" : \"id\",\n      \"KeyType\" : \"HASH\"\n    }, {\n      \"AttributeName\" : \"dt\",\n      \"KeyType\" : \"RANGE\"\n    } ],\n    \"ProvisionedThroughput\" : {\n      \"ReadCapacityUnits\" : 1,\n      \"WriteCapacityUnits\" : 1\n    }\n  }\n}\n```\nOr, use the following CloudFormation (YAML) resource snippet:\n\n```\nType: \"AWS::DynamoDB::Table\"\nProperties:\n  TableName: \"aws.dynamodb.ips\"\n  AttributeDefinitions:\n  - AttributeName: \"dt\"\n    AttributeType: \"S\"\n  - AttributeName: \"id\"\n    AttributeType: \"S\"\n  KeySchema:\n  - AttributeName: \"id\"\n    KeyType: \"HASH\"\n  - AttributeName: \"dt\"\n    KeyType: \"RANGE\"\n  ProvisionedThroughput:\n    ReadCapacityUnits: 1\n    WriteCapacityUnits: 1\n```    \n\n## dig.sh\n\nCreate `/home/ec2-user/dig.sh` with the following:\n```\n#!/usr/bin/env bash\n\nset -e\n\nTBL=\"aws.dynamodb.ips\"\nSVC=\"dynamodb\"\nREG=\"us-east-1\"\nENDPOINT=\"${SVC}.${REG}.amazonaws.com\"\nMAC=$(curl -s http://169.254.169.254/latest/meta-data/network/interfaces/macs/)\nVPC=$(curl -s http://169.254.169.254/latest/meta-data/network/interfaces/macs/${MAC}/vpc-id/)\n\nwhile [ 1 ]\ndo\n  ID=$(uuidgen)\n  DT=$(date -u +\"%Y-%m-%dT%H:%M:%SZ\")\n  # TODO combine these\n  IP=$(dig +nocmd +noall +answer ${ENDPOINT} @169.254.169.253 | awk '{print $5}' \u0026)\n  TTL=$(dig +nocmd +noall +answer ${ENDPOINT} @169.254.169.253 | awk '{print $2}' \u0026)\n  wait\n\n  SECONDS=0\n  AWS_CMD=$(aws dynamodb update-item --table-name 'aws.dynamodb.ips' \\\n  --key \"{ \\\"id\\\": {\\\"S\\\":\\\"${ID}\\\"},\\\"dt\\\": {\\\"S\\\":\\\"${DT}\\\"}}\" \\\n  --update-expression \"SET #ip = :ip, #svc = :svc, #reg = :reg, #vpc = :vpc\" \\\n  --expression-attribute-names \"{\\\"#ip\\\":\\\"ip\\\", \\\"#svc\\\": \\\"svc\\\", \\\"#reg\\\": \\\"reg\\\", \\\"#vpc\\\": \\\"vpc\\\"}\" \\\n  --expression-attribute-values \"{\\\":ip\\\":{\\\"S\\\":\\\"${IP}\\\"}, \\\":svc\\\":{\\\"S\\\":\\\"${SVC}\\\"}, \\\":reg\\\":{\\\"S\\\":\\\"${REG}\\\"}, \\\":vpc\\\":{\\\"S\\\":\\\"${VPC}\\\"}}\" \\\n  --return-values ALL_NEW --region us-west-2 \u003e\u003e dig.log)\n  SLEEP_PERIOD=$(expr $TTL - $SECONDS)\n  sleep $SLEEP_PERIOD\ndone\n```\nMake it executable: `chmod +x dig.sh`\n\n## Install and Configure CloudWatch Logs Agent\n\nFor observability, you can optionally pipe the response of the `update-item` requests to CloudWatch logs.\n\nFor install instructions, follow: https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/QuickStartEC2Instance.html\n\nTo configure, update `/etc/awslogs/awslogs/conf` with something like:\n\n```\n[/home/ec2-user/dig]\ndatetime_format = %b %d %H:%M:%S\nfile = /home/ec2-user/dig.log\nbuffer_duration = 5000\nlog_stream_name = {instance_id}\ninitial_position = start_of_file\nlog_group_name = /home/ec2-user/dig\nregion=us-west-2\n```\nIf you want to send CW logs to a region other than us-east-1 (the default), then update `/etc/awslogs/awscli.conf`:\n\n```\n[plugins]\ncwlogs = cwlogs\n[default]\nregion = us-west-2\n```\n\nTo restart awslogs on Amazon Linux 2: `sudo systemctl start awslogsd`\n\n## TODO\n- Add DynamoDB conditional update expression to prevent duplicate IPs within the same predetermined time period.\n- Parameterize the aws service and region.\n- Run in parallel from multiple regions and availability zones for more comphrehensive data.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fthesurlydev%2Faws-poller","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fthesurlydev%2Faws-poller","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fthesurlydev%2Faws-poller/lists"}