AWS AWSEC2 documentation change
Summary
Restructured IP address documentation to separate tasks for assigning public/private IPv4 addresses and viewing addresses via console/CLI/metadata. Added detailed instructions for IMDSv2 usage and private IP assignment.
Security assessment
Added explicit guidance for IMDSv2 (token-based metadata retrieval), which is a security best practice. However, there is no evidence this change addresses a specific vulnerability or security incident. The restructuring improves clarity but doesn't directly mitigate a known risk.
Diff
diff --git a/AWSEC2/latest/UserGuide/working-with-ip-addresses.md b/AWSEC2/latest/UserGuide/working-with-ip-addresses.md index 19d6c37a3..3e37bf651 100644 --- a//AWSEC2/latest/UserGuide/working-with-ip-addresses.md +++ b//AWSEC2/latest/UserGuide/working-with-ip-addresses.md @@ -5 +5 @@ -View the IPv4 addressesAssign a public IPv4 address during instance launch +Assign a public IPv4 address at launchAssign a private IPv4 address at launchView the primary IPv4 addressView the IPv4 addresses using instance metadata @@ -11 +11 @@ You can assign a public IPv4 address to your instance when you launch it. You ca -###### Contents +###### Tasks @@ -13 +13 @@ You can assign a public IPv4 address to your instance when you launch it. You ca - * View the IPv4 addresses + * Assign a public IPv4 address at launch @@ -15 +15 @@ You can assign a public IPv4 address to your instance when you launch it. You ca - * Assign a public IPv4 address during instance launch + * Assign a private IPv4 address at launch @@ -16,0 +17 @@ You can assign a public IPv4 address to your instance when you launch it. You ca + * View the primary IPv4 address @@ -17,0 +19 @@ You can assign a public IPv4 address to your instance when you launch it. You ca + * View the IPv4 addresses using instance metadata @@ -20 +21,0 @@ You can assign a public IPv4 address to your instance when you launch it. You ca -## View the IPv4 addresses @@ -22 +22,0 @@ You can assign a public IPv4 address to your instance when you launch it. You ca -You can use the Amazon EC2 console to view the public and private IPv4 addresses of your instances. You can also determine the public IPv4 and private IPv4 addresses of your instance from within your instance by using instance metadata. For more information, see [Use instance metadata to manage your EC2 instance](./ec2-instance-metadata.html). @@ -24 +24 @@ You can use the Amazon EC2 console to view the public and private IPv4 addresses -The public IPv4 address is displayed as a property of the network interface in the console, but it's mapped to the primary private IPv4 address through NAT. Therefore, if you inspect the properties of your network interface on your instance, for example, through `ifconfig` (Linux) or `ipconfig` (Windows), the public IPv4 address is not displayed. To determine your instance's public IPv4 address from an instance, use instance metadata. +## Assign a public IPv4 address at launch @@ -26 +26 @@ The public IPv4 address is displayed as a property of the network interface in t -###### To view the IPv4 addresses for an instance using the command line +Each subnet has an attribute that determines whether instances launched into that subnet are assigned a public IP address. By default, nondefault subnets have this attribute set to false, and default subnets have this attribute set to true. When you launch an instance, a public IPv4 addressing feature is also available for you to control whether your instance is assigned a public IPv4 address; you can override the default behavior of the subnet's IP addressing attribute. The public IPv4 address is assigned from Amazon's pool of public IPv4 addresses, and is assigned to the network interface with the device index of 0. This feature depends on certain conditions at the time you launch your instance. @@ -28 +28 @@ The public IPv4 address is displayed as a property of the network interface in t -You can use one of the following commands. For more information about these command line interfaces, see [Access Amazon EC2](./concepts.html#access-ec2). +###### Considerations @@ -30 +30 @@ You can use one of the following commands. For more information about these comm - * [describe-instances](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/describe-instances.html) (AWS CLI) + * You can unassign the public IP address from your instance after launch by [managing the IP addresses associated with a network interface](./managing-network-interface-ip-addresses.html). For more information about public IPv4 addresses, see [Public IPv4 addresses](./using-instance-addressing.html#concepts-public-addresses). @@ -32 +32 @@ You can use one of the following commands. For more information about these comm - * [Get-EC2Instance](https://docs.aws.amazon.com/powershell/latest/reference/items/Get-EC2Instance.html) (AWS Tools for Windows PowerShell). + * You can't auto-assign a public IP address if you specify more than one network interface. Additionally, you cannot override the subnet setting using the auto-assign public IP feature if you specify an existing network interface for device index 0. @@ -33,0 +34 @@ You can use one of the following commands. For more information about these comm + * Whether you assign a public IP address to your instance during launch or not, you can associate an Elastic IP address with your instance after it's launched. For more information, see [Elastic IP addresses](./elastic-ip-addresses-eip.html). You can also modify your subnet's public IPv4 addressing behavior. For more information, see [Modify the public IPv4 addressing attribute for your subnet](https://docs.aws.amazon.com/vpc/latest/userguide/subnet-public-ip.html). @@ -37 +37,0 @@ You can use one of the following commands. For more information about these comm -###### To determine your instance's IPv4 addresses using instance metadata @@ -39 +39 @@ You can use one of the following commands. For more information about these comm - 1. Connect to your instance. For more information, see [Connect to your EC2 instance](./connect.html). +Console @@ -41 +40,0 @@ You can use one of the following commands. For more information about these comm - 2. Use the following command to access the private IP address. @@ -43 +42 @@ You can use one of the following commands. For more information about these comm -IMDSv2 +###### To assign a public IPv4 address at launch @@ -44,0 +44 @@ IMDSv2 +Follow the procedure to [launch an instance](./ec2-launch-instance-wizard.html), and when you configure [Network Settings](./ec2-instance-launch-parameters.html#liw-network-settings), choose the option to **Auto-assign Public IP**. @@ -46,2 +46 @@ IMDSv2 - [ec2-user ~]$ TOKEN=`curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600"` \ - && curl -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/local-ipv4 +AWS CLI @@ -49 +47,0 @@ IMDSv2 -IMDSv1 @@ -50,0 +49 @@ IMDSv1 +###### To assign a public IPv4 address at launch @@ -52 +51,4 @@ IMDSv1 - [ec2-user ~]$ curl http://169.254.169.254/latest/meta-data/local-ipv4 +Use the [run-instances](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/run-instances.html) command with the `--associate-public-ip-address` option. + + + --associate-public-ip-address @@ -57 +59 @@ PowerShell - PS C:\> Invoke-RestMethod http://169.254.169.254/latest/meta-data/local-ipv4 +###### To assign a public IPv4 address at launch @@ -59 +61 @@ PowerShell - 3. Use the following command to access the public IP address. If an Elastic IP address is associated with the instance, the value returned is that of the Elastic IP address. +Use the [New-EC2Instance](https://docs.aws.amazon.com/powershell/latest/reference/items/New-EC2Instance.html) cmdlet with the `-AssociatePublicIp` parameter. @@ -61 +62,0 @@ PowerShell -IMDSv2 @@ -62,0 +64 @@ IMDSv2 + -AssociatePublicIp $true @@ -64,2 +66 @@ IMDSv2 - [ec2-user ~]$ TOKEN=`curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600"` \ - && curl -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/public-ipv4 +## Assign a private IPv4 address at launch @@ -67 +68 @@ IMDSv2 -IMDSv1 +You can specify a private IPv4 address from the IPv4 address range of the subnet, or let Amazon EC2 chose one for you. This address is assigned to the primary network interface. @@ -68,0 +70 @@ IMDSv1 +To assign IPv4 addresses after launch, see [Assign secondary IP addresses to an instance](./instance-secondary-ip-addresses.html#assign-secondary-ip-address). @@ -70 +72 @@ IMDSv1 - [ec2-user ~]$ curl http://169.254.169.254/latest/meta-data/public-ipv4 +Console @@ -72 +73,0 @@ IMDSv1 -PowerShell @@ -73,0 +75 @@ PowerShell +###### To assign a private IPv4 address at launch @@ -75 +77 @@ PowerShell - PS C:\> Invoke-RestMethod http://169.254.169.254/latest/meta-data/public-ipv4 +Follow the procedure to [launch an instance](./ec2-launch-instance-wizard.html). When you configure [Network Settings](./ec2-instance-launch-parameters.html#liw-network-settings), expand **Advanced network configuration** and enter a value for **Primary IP**. @@ -76,0 +79 @@ PowerShell +AWS CLI @@ -78,0 +82 @@ PowerShell +###### To assign a private IPv4 address at launch @@ -80 +84 @@ PowerShell -## Assign a public IPv4 address during instance launch +Use the [run-instances](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/run-instances.html) command with the `--private-ip-address` option. @@ -82 +85,0 @@ PowerShell -Each subnet has an attribute that determines whether instances launched into that subnet are assigned a public IP address. By default, nondefault subnets have this attribute set to false, and default subnets have this attribute set to true. When you launch an instance, a public IPv4 addressing feature is also available for you to control whether your instance is assigned a public IPv4 address; you can override the default behavior of the subnet's IP addressing attribute. The public IPv4 address is assigned from Amazon's pool of public IPv4 addresses, and is assigned to the network interface with the device index of 0. This feature depends on certain conditions at the time you launch your instance. @@ -84 +87 @@ Each subnet has an attribute that determines whether instances launched into tha -###### Considerations + --private-ip-addresses 10.251.50.12 @@ -86 +89 @@ Each subnet has an attribute that determines whether instances launched into tha - * You can unassign the public IP address from your instance after launch by [managing the IP addresses associated with a network interface](./managing-network-interface-ip-addresses.html). For more information about public IPv4 addresses, see [Public IPv4 addresses](./using-instance-addressing.html#concepts-public-addresses). +To let Amazon EC2 choose the IP address, omit this option. @@ -88 +91 @@ Each subnet has an attribute that determines whether instances launched into tha - * You can't auto-assign a public IP address if you specify more than one network interface. Additionally, you cannot override the subnet setting using the auto-assign public IP feature if you specify an existing network interface for device index 0. +PowerShell @@ -90 +93,4 @@ Each subnet has an attribute that determines whether instances launched into tha - * Whether you assign a public IP address to your instance during launch or not, you can associate an Elastic IP address with your instance after it's launched. For more information, see [Elastic IP addresses](./elastic-ip-addresses-eip.html). You can also modify your subnet's public IPv4 addressing behavior. For more information, see [Modify the public IPv4 addressing attribute for your subnet](https://docs.aws.amazon.com/vpc/latest/userguide/subnet-public-ip.html). + +###### To assign a private IPv4 address at launch + +Use the [New-EC2Instance](https://docs.aws.amazon.com/powershell/latest/reference/items/New-EC2Instance.html) cmdlet with the `-PrivateIpAddress` parameter. @@ -92,0 +99 @@ Each subnet has an attribute that determines whether instances launched into tha + -PrivateIpAddress 10.251.50.12 @@ -93,0 +101,5 @@ Each subnet has an attribute that determines whether instances launched into tha +To let Amazon EC2 choose the IP address, omit this parameter. + +## View the primary IPv4 address + +The public IPv4 address is displayed as a property of the network interface in the console, but it's mapped to the primary private IPv4 address through NAT. Therefore, if you inspect the properties of your network interface on your instance, for example, through `ifconfig` (Linux) or `ipconfig` (Windows), the public IPv4 address is not displayed. @@ -98 +110,13 @@ Console -###### To assign a public IPv4 address during instance launch +###### To view the IPv4 addresses for an instance + + 1. Open the Amazon EC2 console at [https://console.aws.amazon.com/ec2/](https://console.aws.amazon.com/ec2/). + + 2. In the navigation pane, choose **Instances**. + + 3. Select the instance. + + 4. On the **Networking** tab, find **Public IPv4 address** and **Private IPv4 addresses**. + + 5. (Optional) The **Networking** tab also contains the network interfaces and Elastic IP addresses for the instance. + + @@ -100 +123,0 @@ Console -Follow the procedure to [launch an instance](./ec2-launch-instance-wizard.html), and when you configure [Network Settings](./ec2-instance-launch-parameters.html#liw-network-settings), choose the option to **Auto-assign Public IP**. @@ -105 +128 @@ AWS CLI -###### To assign a public IPv4 address during instance launch +###### To view the primary IPv4 address for an instance @@ -107 +130 @@ AWS CLI -Use the [run-instances](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/run-instances.html) command with the `--associate-public-ip-address` option. +Use the [describe-instances](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/describe-instances.html) command. @@ -110 +133,9 @@ Use the [run-instances](https://awscli.amazonaws.com/v2/documentation/api/latest - --associate-public-ip-address + aws ec2 describe-instances \ + --instance-ids i-1234567890abcdef0 \ + --query "Reservations[].Instances[].PrivateIpAddress" \ + --output text + +The following is example output. + + + 10.251.50.12 @@ -115 +146,94 @@ PowerShell -###### To assign a public IPv4 address during instance launch +###### To view the primary IPv4 address for an instance + +Use the [Get-EC2Instance](https://docs.aws.amazon.com/powershell/latest/reference/items/Get-EC2Instance.html) cmdlet. + + + (Get-EC2Instance ` + -InstanceId i-1234567890abcdef0).Instances.PrivateIpAddress + +The following is example output. + + + 10.251.50.12 + +## View the IPv4 addresses using instance metadata + +You can get the IPv4 addresses for your instance by retrieving instance metadata. For more information, see [Use instance metadata to manage your EC2 instance](./ec2-instance-metadata.html). + +###### To view the IPv4 addresses using instance metadata + + 1. Connect to your instance. For more information, see [Connect to your EC2 instance](./connect.html). + + 2. Run one of the following commands. + +IMDSv2 + + +###### Linux + +Run the following command from your Linux instance. + + TOKEN=`curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600"` \ + && curl -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/local-ipv4 + +###### Windows + +Run the following command from your Windows instance.