title: Identify AWS service from Interface Internal IP in VPC Flowlogs
body: <p>I am reading AWS VPC Flowlogs data (published to S3) which has internal IP of interfaces.</p>
  
  <p>We can create flow logs for network interfaces that are created by other AWS services, such as:</p>
  
  <ul>
  <li><p>Elastic Load Balancing</p></li>
  <li><p>Amazon RDS</p></li>
  <li><p>Amazon ElastiCache</p></li>
  <li><p>Amazon Redshift</p></li>
  <li><p>Amazon WorkSpaces</p></li>
  <li><p>NAT gateways</p></li>
  <li><p>Transit gateways
  ...etc.</p></li>
  </ul>
  
  <p>How can we get type of service used in Flowlog record?</p>
  
  <p>In <code>describe-network-interfaces</code> response</p>
  
  <pre><code>"InterfaceType": "interface",
              "Ipv6Addresses": [],
              "MacAddress": "0e:fa:f9:2d:95:8e",
              "NetworkInterfaceId": "eni-02eb12a4080c84b00",
              "OwnerId": "123412341234",
              "PrivateDnsName": "ip-10-3-1-44.ec2.internal",
              "PrivateIpAddress": "10.3.1.44",
  </code></pre>
  
  <p>I thought to use <code>PrivateDnsName</code> suffix but it takes the form <strong>ip-private-ipv4-address.ec2.internal</strong> for the <strong>us-east-1</strong> Region, and <strong>ip-private-ipv4-address.region.compute.internal</strong> for other Regions and it looks it is same for all aws services.</p>
  
  <p>Is there any way to get AWS service type from private IP address?  </p>