JA EN
shiichan

VPC IPAM now automates ROA management for BYOIP prefixes!

AWS What's New ★★★ View Markdown
#aws#security#infrastructure

Hi everyone, it's Shii! Today I've got AWS news that's great if you manage BYOIP network prefixes, so let's dive right in!

AWS What's New aws.amazon.com

What was announced?

According to AWS What's New, Amazon VPC's IP Address Manager (IPAM) now supports BGP route protection monitoring and delegated RPKI management for BYOIP (Bring Your Own IP) prefixes.

With BGP route protection monitoring, you can check RPKI validation status, ROA (Route Origin Authorization) strength, and route overlap across all your BYOIP prefixes, spanning multiple accounts and regions, from a single dashboard. You can spot prefixes with invalid or missing ROAs, detect route overlaps that might signal a hijack, and tell whether an ROA is configured as strict or permissive.

With delegated RPKI, you do a one-time setup with your Regional Internet Registry (RIR) - ARIN, RIPE, APNIC, or LACNIC - and after that, IPAM automatically creates ROAs when you provision BYOIP, renews them before they expire, and manages ROAs for your on-premises prefixes too.

The story so far

Before this, you had to manually create and renew ROAs directly with your RIR, verify ownership through WHOIS or DNS records, and lean on third-party tools to monitor route security. As the number of prefixes and accounts grew, all that manual work added up.

What changes

  • You can monitor BYOIP prefixes across multiple accounts and regions from one dashboard
  • ROA creation and renewal are automated, cutting the risk of an ROA lapsing because someone forgot to renew it
  • Route overlap detection helps you catch signs of a hijack earlier
  • You rely less on manual WHOIS/DNS checks and third-party monitoring tools

If you're a network or security admin running BYOIP, this is a quiet but genuinely welcome change.

Dive Deep

It's available in all commercial AWS Regions, excluding AWS GovCloud (US) and the China Regions (Beijing, operated by Sinnet, and Ningxia, operated by NWCD). To use delegated RPKI, keep in mind you'll need to do a one-time setup with your RIR first. For setup details, check the BGP route protection documentation, and for pricing, see the IPAM tab on the Amazon VPC Pricing Page.

Wrap-up

  • Amazon VPC IPAM now supports BGP route protection monitoring and delegated RPKI management for BYOIP
  • The dashboard lets you check RPKI validation status, ROA strength, and route overlap in one place
  • A one-time RIR setup automates ROA creation, renewal, and management
  • Available in all commercial AWS Regions (excluding GovCloud (US) and the China Regions)

If you run BYOIP prefixes, this one's especially worth a look!

Related posts