Using your public IP for AWS and Amazon Connect work
Your public IP is the address the internet, and AWS, sees when you connect. It is usually your router's or your company's outbound address, not the private address (such as 192.168.x.x or 10.x.x.x) shown on your laptop. Knowing it is the first step for many everyday cloud tasks.
Common reasons you need it
- Security group rules: allowing SSH or RDP to an EC2 instance only from your address, written as
203.0.113.25/32. A/32means exactly one IPv4 address. - IAM and bucket policy conditions: restricting access with
"Condition": {"IpAddress": {"aws:SourceIp": "203.0.113.0/24"}}. Build and check these with the IAM Policy Generator and the S3 Policy Validator. - Amazon Connect IP address restrictions: security profiles can limit which IP ranges agents and admins may sign in from. Before switching this on, collect the outbound IPs of every office and VPN, or remote agents will be locked out.
- Allowlisting: partners and third-party APIs often ask for "your IP" to allow your traffic. Give them the NAT gateway or office egress address, not a laptop's.
- Investigating logs: matching the
sourceIPAddressin a CloudTrail event to a known office or VPN. See the CloudTrail Log Analyzer.
Why your IP may change, or look wrong
- Dynamic addresses: most home connections get a new public IP after a router restart or every few days. A security group rule that worked yesterday may not work today.
- CGNAT: many mobile and some broadband providers put customers behind shared addresses, so your "public" IP is used by others too. Never use it as the only access control.
- VPN and proxy: with a VPN on, sites see the VPN's exit address. Check with it both on and off if a rule isn't matching.
- IPv4 vs IPv6: if your network has IPv6, some services see that address instead. An IPv4-only rule then won't match. Plan ranges with the IPv4 and IPv6 subnet calculators.
How accurate is IP location?
The location, ISP and ASN details come from IP databases, not GPS. The country is usually right. The city can be off by tens of kilometres or show the ISP's hub instead of your town. Corporate traffic often appears where the company's internet breakout is, which can be a different country from the user. For contact centres, this matters when a system routes or restricts by geography. Test it from the actual agent location rather than relying on the lookup.
Checklist before enabling IP restrictions
- List every egress IP: offices, VPN gateways, VDI and cloud desktop egress, and NAT gateways.
- Ask your providers whether these addresses are static. Get static IPs for anything you will allowlist.
- Write them as CIDR ranges and double-check the boundaries with the subnet calculator.
- Keep a break-glass admin path that isn't IP-restricted, so a wrong range can't lock everyone out.
- Test from each location after the change, and confirm remote agents can still reach the CCP with the Agent Workstation Validator.
Privacy
Your IP address is visible to every website you visit. This page only shows you what they already see, and the lookup isn't stored by kloudmint. If you need to hide your IP, use a reputable VPN, but remember that this also changes what your AWS rules see.