Applications may want to know whether they run on the AWS platform or not. There are a number of ways to identify whether your application runs on AWS or not. AWS documents a numbre of them as well.

Disclaimer: The stability of the AWS APIs discussed below varies. Please use the references to the AWS documentation to verify whether the stability of the API is sufficient for your use case. 

EC2 Instance Metadata Service V1

The hypervisor of any EC instance is providing a range of information which is available to a given EC instance only. The information is provided through a number of web pages which are accessible through http://169.254.169.254. The AWS page "Instance MetaData and User Data" provides more details about the information offered through this service. This service is available independent of the AMIs operating system.

This information can be gathered by any process on any platform without increased (means root) privileges.

EC2 Instance Metadata Service V2

AWS released a version 2 with a bit more security. Please check the online documentation.

AWS Specific HTTP Header Fields of the Instance Meta Service

Each http request against a page of this service is answered with a AWS specific signature in the http response header field. The Server field contains the string EC2ws.

This field is platform independent.

Check this Field on a Linux Platform

One way to verify this field is the Linux curl command:

ec2-user@ip-w-x-y-z:~> curl -I 169.254.169.254 | grep Server
Server: EC2ws

This information can be gathered by any process on any platform without increased (means root) privileges.

Check this Field on the Windows Platform

Open a Power Shell Window with adminstrator rights and enter the following command sequence:

$url = "http://169.254.169.254"
$request = [System.Net.WebRequest]::Create($url)
$request.Method = "HEAD"
$request.Proxy = $null
$response = $request.GetResponse()
$response.Headers.Get("Server")

The last command will display the string EC2ws.

Signed AWS Dynamic Data

Every EC2 instance hosts dynamic instance specific data which got signed by AWS (see AWS Instance MetaData and User Data, section: Dynamic Data Categories).

The document http://169.254.169.254:/latest/dynamic/instance-identity/document hosts a JSON document which looks similar to this one:

{
  "instanceId" : "i-c495bb93",
  "billingProducts" : [ "bp-xxx" ],
  "accountId" : "xxx",
  "imageId" : "ami-e80xxxx",
  "instanceType" : "c3.xlarge",
  "kernelId" : "aki-825ea7eb",
  "ramdiskId" : null,
  "pendingTime" : "2015-02-24T14:38:43Z",
  "architecture" : "x86_64",
  "region" : "us-east-1",
  "version" : "2010-08-31",
  "availabilityZone" : "us-east-1c",
  "privateIp" : "w.x.y.z",
  "devpayProductCodes" : null
}

The authenticity of this document can be verified through the two documents hosted under

• http://169.254.169.254:/latest/dynamic/instance-identity/pkcs7
• http://169.254.169.254:/latest/dynamic/instance-identity/signature

This verification method is operating system independent and it doesn't require a process to have increased access privileges (beyond http access).

AWS BIOS Serial Number

EC2 instances have serial numbers which start with the string ec2. 

One way to gather this information on a Linux system is the dmidecode command:

ip-w-x-y-z:/home/ec2-user # dmidecode -s system-serial-number
ec296900-a260-8001-9a78-a0c7d06d1f58

The execution of the dmidecode command requires root privileges for security reasons.

Windows users can gather this information without administrator privileges through the command wmic:

PS C:\> wmic bios get serialnumber
SerialNumber
ec2f1d85-08d6-62f2-4382f5e8dbdb

The BIOS UUID field features the same information in upper case letters.

AWS bare Metal and KVM virtualized Instances

AWS fills certain BIOS fields in bare metal and KVM virtualized Instances. These are typically instances which have been released after Oct. 2017.

Linux allows to check the settings with the dmidecode command:

...
Base Board Information
        Manufacturer: Amazon EC2
        Product Name: Not Specified
        Version: Not Specified
        Serial Number: Not Specified
Asset Tag: i-0123456789abcdef0
        Features:
                Board is a hosting board
                Board is replaceable
        Location In Chassis: empty
        Chassis Handle: 0x0003
        Type: Motherboard
        Contained Object Handles: 0
Handle 0x0003, DMI type 3, 25 bytes
Chassis Information
        Manufacturer: Amazon EC2
        Type: Rack Mount Chassis
        Lock: Not Present
        Version: Not Specified
        Serial Number: Not Specified
Asset Tag: Amazon EC2
        Boot-up State: Safe
        Power Supply State: Safe
        Thermal State: Safe
        Security Status: None
        OEM Information: 0x00000000
        Height: Unspecified
        Number Of Power Cords: 1
        Contained Elements: 1
                <OUT OF SPEC> (0)
        SKU Number: To be filled by O.E.M
...

The asset tag in the Base Board Information contains the instance id. It can be read without super user privileges!

The asset tag in the Chassis Information contains Amazon EC2 with identifies the system to be an AWS instance. It can be read without super user privileges!