ip-ranges.json has overlapping IP ranges

Question

Refer : [ip-ranges](https://ip-ranges.amazonaws.com/ip-ranges.json)

In the ip-ranges that AWS shares w.r.t. its publicly accessible IP Sets and which service and region they belong to, we have seen that service "AMAZON" have overlapping ip range with other services,

```
{
      "ip_prefix": "3.5.80.0/21",
      "region": "us-west-2",
      "service": "AMAZON",
      "network_border_group": "us-west-2"
    }
```

however I observed today that EC2 and S3 both are showing the same ip-range, 
```
{
      "ip_prefix": "3.5.80.0/21",
      "region": "us-west-2",
      "service": "S3",
      "network_border_group": "us-west-2"
    }
```
```
{
      "ip_prefix": "3.5.80.0/21",
      "region": "us-west-2",
      "service": "EC2",
      "network_border_group": "us-west-2"
    }
```

* I can see ip-range overlap between S3 and EC2 (ignoring AMAZON), is this expected ?
*  Can there be other overlaps where one is EC2 and other is a PaaS like Dynamo DB (Guess is that EC2s are used to host Dynamo DB)
*  Can there be an overlap between 2 PaaS like S3 and Dynamo DB ?

Answer

A description is available at [AWS IP address ranges](https://docs.aws.amazon.com/vpc/latest/userguide/aws-ip-ranges.html) which states

> service
>
>The subset of IP address ranges. The addresses listed for API_GATEWAY are egress only. Specify AMAZON to get all IP address ranges (meaning that every subset is also in the AMAZON subset). However, some IP address ranges are only in the AMAZON subset (meaning that they are not also available in another subset).

AMAZON will return *all* IP address ranges. 
Documentation does not state that whether IP ranges for different services may or may not overlap.

Are you able to share your use-case for using ip-ranges.json?

If this is for VPC, the [AWS-managed prefix lists](https://docs.aws.amazon.com/vpc/latest/userguide/working-with-aws-managed-prefix-lists.html#available-aws-managed-prefix-lists) may be useful.  For access to AWS services within a VPC without internet connectivity,  [AWS PrivateLink](https://docs.aws.amazon.com/vpc/latest/privatelink/what-is-privatelink.html) should help

If you are using it for third-party firewall ingress/egress control from/to AWS resources, CheckPoint has native support via [Updatable Objects](https://support.checkpoint.com/results/sk/sk131852). For other firewalls such as Fortigate/Palo Alto, the [aws-ipranges-api](https://github.com/aws-samples/aws-ipranges-api/) can help keep the ip prefixes up to date.

ip-ranges.json has overlapping IP ranges

Relevant content