How to find out who creates the ec2 instance on AWS?

Question

There are a list of EC2 instances in my organization aws account. I'd like to find out who creates these instances. These instances don't have any tag or meta data telling me who creates them.

I am using aws ec2 describe-instances which returns a list of instances information including a field OwnerId and RequesterId . Do these fields refer to the user id? How can I map these id to an user id? Or is there another way to find out who created them?

Answer 1

Amazon EC2 instances, once launched, are owned by the AWS Account. They are not associated with the user that launched it.

You can use AWS CloudTrail to view all API calls made to the account. This will include a RunInstances command that launched the instance. The CloudTrail record will include details of the user/credentials that were used to issue the command.

The fields you mentioned do not contain this information:

• OwnerId: The ID of the AWS account that owns the reservation.
• RequesterId: The ID of the requester that launched the instances on your behalf (for example, AWS Management Console or Auto Scaling).