Metadata-Version: 2.5
Name: awho
Version: 0.0.1
Summary: What is this IP? Resource attribution across your AWS Organization.
Author: Kerim Kilic
License-Expression: Apache-2.0
License-File: LICENSE
Keywords: aws,cli,eni,networking,vpc
Classifier: Development Status :: 2 - Pre-Alpha
Classifier: Environment :: Console
Classifier: Intended Audience :: Developers
Classifier: Intended Audience :: System Administrators
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Topic :: System :: Networking
Requires-Python: >=3.11
Requires-Dist: click>=8.2
Provides-Extra: dev
Requires-Dist: pytest>=8; extra == 'dev'
Description-Content-Type: text/markdown

# awho

**What is this IP?** Resource attribution across your AWS Organization.

An address turns up in a flow log, an ALB access log, a firewall deny or a
GuardDuty finding. Working out what it is means knowing which of your hundreds
of accounts to look in. `awho 10.42.13.7` answers that with no database, no
SQL and no per-account config, and it tells you what the thing actually is, not
just that it is "an ENI".

```
$ awho --demo 10.42.13.7

10.42.13.7
  2 matches, best first — this address exists in more than one place
  account  111111111111  (prod-payments)
  vpc      vpc-0a1b2c3d  10.42.0.0/16  eu-west-1
  subnet   subnet-0f9e1a2b  10.42.12.0/22  eu-west-1b
  eni      eni-0c4d5e6f  in-use
  owner    VPC Endpoint  vpce-0a1b2c3d4e5f60718
  tags     team=payments  cost-center=4471
  index    demo (synthetic data, not your infrastructure)
  ...
```

## Status: pre-alpha

Version 0.0.x only works against a **built-in synthetic index** (`--demo`). It
does not talk to AWS yet. What is in place:

- ENI decoder that identifies the owner from structured signals first
  (`InterfaceType`, requester, instance attachment) and reads the description
  only as a last resort. The rules are data, in `decode/services.json`.
- Lookups by IPv4 address (including secondary private IPs) or `eni-…` ID.
- Every match is returned, ranked. An address that exists in two accounts is
  shown twice, never silently resolved to one.
- RAM-shared subnets: the ENI's account and the VPC's account are shown
  separately.

Coming next: `awho index build` (read-only sweep of every account in the
Organization into a local SQLite index), `awho index status`, and the second
hop from ENI to the load balancer, endpoint service or task behind it.

## Install

```
pipx install awho
awho --demo 10.42.13.7
```

Python 3.11+.

## Usage

```
awho [--demo] [--json] [--account ID] <ip | eni-id>
```

Data goes to stdout; warnings and errors go to stderr, so `awho --json … | jq`
works. Exit codes: `0` found, `1` not found, `2` usage error, `3` index missing
or unreadable.

## Licence

Apache-2.0.
