AMA: Find AWS Instances by their Private IP Addresses


AMA is an ongoing series published each Thursday, highlighting questions the community has asked in our support and how-to channels on Slack. If you haven't already done so, please join us on Slack

J1_Ambassador Apollo @2x


"How would I construct a query that finds AWS instances by their private IP addresses that return public IPs, AMIs, Accounts, Instance IDs and any tags associated with each?"

--Question from Javier on the J1 Community Slack


Answer from JupiterOne Community Member, Adam

Hi Javier. The following pre-supposes you are using the tagging feature in your AWS integration, just replace the IP_ADDRESS with the real IP. Please note that I'm not aware of a way to return all tags. I believe you would have to enumerate the tags you want to include (e.g. using i.tag.<name_of_tag> in the RETURN clause).

FIND aws_instance WITH privateIpAddress = "" AS i
i.publicIpAddressAS PublicIP,
i.imageId AS AMI,
i.tag.AccoutnName AS AccountName, AS InstanceId


You can  format this query to accept multiple IP addresses.

FIND aws_instance 
WITH privateIpAddress = ("x.x.x.x" or "x.y.x.y")


Thanks to Adam, George, and Erkang for the responses to Javier's question.

Articles in this Series

  1. AMA: JupiterOne and PagerDuty WebHooks
  2. AMA: Export YAML Files for Vendors Pulled from SSO Providers
  3. AMA: Map Controls and Frameworks Relationships
  4. AMA: How to Track Professional Associations, Security Forums, and Threat Intel Sources
  5. AMA: Find AWS Instances by their Private IP Address
  6. AMA: SSO Integrated Authentication, Move to Another Role
  7. AMA: send-mail action to map two properties
  8. AMA: Setup the Policy Accept Button
  9. AMA: Match a blank field in J1QL
  10. AMA: Track and Alert Using Firewall Rules Matrix
  11. AMA: AWS Roles not used for 90 days, and date related queries
  12. AMA: Manage Alerts for Jira through J1 Terraform Provider
  13. AMA: Filter Results from Specific AWS Accounts
  14. AMA: Iterate and return total count of iam users per account
  15. AMA: Search for security groups by tag

Resources for this AMA


Modern Visibility in Cyberseccurity




Posted By JupiterOne Team

The JupiterOne Team is a diverse set of engineers and developers who are working on the next generation of cyber asset visibility and monitoring.

To hear more from the JupiterOne Team, get our newsletter. No spam, just the good stuff once or twice a month. Sign up below.


cyber-security 1

Ad Title Placeholder

Lorem ipsum dolor sit amet, consectetur adipiscing elit.