Does Amazon EC2 Support Bringing Your Own IPv4 and IPv6?

Yes, Amazon EC2 and Amazon VPC support bringing your own publicly routable IPv4 and IPv6 address prefixes through a feature called Bring Your Own IP (BYOIP). However, how you assign and use these addresses inside a Virtual Private Cloud (VPC) differs significantly between IPv4 and IPv6. With IPv6, you can associate a subnet CIDR block from your BYOIP pool with your VPC and assign those IPv6 addresses directly to EC2 instances and Elastic Network Interfaces (ENIs). With IPv4, you cannot use a public BYOIP prefix as the primary private CIDR block of a VPC or assign those addresses directly to instance network interfaces as private IPs; instead, you allocate Elastic IP addresses (EIPs) from your IPv4 BYOIP pool and associate those Elastic IPs with your EC2 instances, NAT gateways, or Network Load Balancers.

How BYOIP Works in AWS

Bring Your Own IP (BYOIP) allows you to move part or all of your publicly routable IPv4 or IPv6 address ranges from an on-premises network to your AWS account. You continue to own the address prefix while AWS advertises it on the internet via Border Gateway Protocol (BGP) using AWS Autonomous System Numbers (ASNs), or you can use Bring Your Own ASN (BYOASN) in supported configurations.

Using your own IP space in AWS is helpful when you have legacy applications, partner firewalls, or regulatory allowlists that rely on hardcoded IP addresses, or when you need to maintain consistent IP reputation for email and outbound traffic during a cloud migration.

Bringing Your Own IPv4 Addresses to EC2 and VPC

When you bring an IPv4 address prefix to AWS, the prefix is imported into an regional IPv4 address pool (managed either directly through EC2 or via AWS IP Address Manager, IPAM).

Assignment Mechanism for IPv4

In Amazon VPC, an EC2 instance's network interface always receives a primary private IPv4 address from the VPC subnet range (typically RFC 1918 private space, though non-RFC 1918 CIDRs can be used internally within a VPC). However, if you want your BYOIP IPv4 range to be publicly advertised and reachable over the internet, you do not assign the BYOIP prefix directly to the VPC as a subnet CIDR for direct instance interface binding. Instead, you follow the Elastic IP model:

1. You provision the publicly routable IPv4 CIDR block into your AWS account as an IPv4 pool.
2. You allocate Elastic IP addresses from that BYOIP pool.
3. You associate those Elastic IP addresses with your EC2 instances (specifically, mapped to the primary or secondary private IPv4 address of an Elastic Network Interface), NAT Gateways, or Network Load Balancers inside your VPC.
4. When traffic reaches the Internet Gateway of the VPC, AWS performs a 1:1 Network Address Translation (NAT) between your public BYOIP Elastic IP and the instance's private IPv4 address.

Prefix Size Requirements for IPv4

For publicly advertised IPv4 BYOIP prefixes, the most specific prefix you can bring to AWS is a /24 CIDR block (which provides \(2^{32 - 24} = 256\) total IPv4 addresses), and the least specific is typically a /8.

Bringing Your Own IPv6 Addresses to EC2 and VPC

IPv6 in Amazon VPC operates without Network Address Translation for public traffic; IPv6 addresses assigned to instances are globally unique and publicly routable (or privately routable if non-advertised). Because of this architecture, BYOIP for IPv6 works much more directly inside a VPC than IPv4.

Assignment Mechanism for IPv6

When you bring an IPv6 prefix to AWS, you can assign slices of that pool directly to your VPCs and subnets:

1. You import your IPv6 prefix into an IPv6 address pool in AWS (via EC2 or AWS IPAM).
2. You associate a /56 CIDR block from your IPv6 pool with your Amazon VPC.
3. You assign /64 CIDR blocks from that VPC /56 block to individual subnets within the VPC.
4. EC2 instances launched into those subnets receive IPv6 addresses directly on their Elastic Network Interfaces from your BYOIP /64 subnet ranges.

Unlike IPv4, there is no 1:1 NAT at the Internet Gateway for IPv6. The EC2 instance operating system sees the exact public IPv6 address from your BYOIP range directly on its network interface.

Prefix Size Requirements for IPv6

The prefix size limits for IPv6 depend on whether AWS advertises the range on the public internet:

• Publicly advertised IPv6 pools: The most specific prefix you can bring is a /48 CIDR block, and you can bring prefixes up to a /24 (or larger with special approval). From a /48 pool, you can allocate up to \(2^{56 - 48} = 256\) individual /56 VPC CIDR blocks.
• Non-advertised (private) IPv6 pools: Through AWS IPAM, you can also bring your own IPv6 addresses that are not advertised by AWS to the public internet (for example, to route privately over AWS Direct Connect or AWS Transit Gateway). For non-advertised ranges, you can bring prefixes as small as a /56.

Requirements for Onboarding BYOIP Prefixes

Before you can provision either an IPv4 or IPv6 prefix in AWS, your address space must meet several administrative and cryptographic requirements:

• RIR Registration: The IP prefix must be registered with a recognized Regional Internet Registry (RIR) such as ARIN, RIPE, APNIC, LACNIC, or AFRINIC.
• ROA (Route Origin Authorization): You must create a Resource Public Key Infrastructure (RPKI) ROA record with your RIR authorizing Amazon's ASN (such as AS16509 or AS14618) to advertise your IP prefix.
• RDAP / WHOIS Verification: You must generate a self-signed X.509 certificate, place the public key in the descriptive comments field of your RIR WHOIS/RDAP record, and sign an authorization message with your private key when calling the provision-byoip-cidr API or configuring the pool in AWS IPAM.
• Clean History: The IP range must not be currently advertised from another network when AWS begins advertising it, and it must pass AWS reputation and security checks.

Summary Comparison of IPv4 and IPv6 BYOIP in VPC