Subdomain Finder is a scanner that scans an entire domain to find as many subdomains as possible.
Amazon makes available a hidden API endpoint which lists the IP address ranges used for EC2.