AWS vpc documentation change
Summary
Updated documentation to add IPv6 support and dual-stack configuration guidance for Bring Your Own IP to CloudFront using IPAM, including updated prerequisites, CLI commands, and references to IPv6 CIDR blocks.
Security assessment
The changes are feature enhancements adding IPv6 support to existing BYOIP functionality. There is no mention of security vulnerabilities, incidents, or patches. The update includes standard operational guidance like ROA (Route Origin Authorization) configuration, which is a normal BGP security practice for prefix ownership validation, not a response to a specific security issue.
Diff
diff --git a/vpc/latest/ipam/tutorials-byoip-cloudfront.md b/vpc/latest/ipam/tutorials-byoip-cloudfront.md index f42c06f04..cab4fed55 100644 --- a//vpc/latest/ipam/tutorials-byoip-cloudfront.md +++ b//vpc/latest/ipam/tutorials-byoip-cloudfront.md @@ -7 +7,15 @@ Why use this feature?Who should use this feature?When to use this feature?Prereq -# Bring your own IP to CloudFront using IPAM +# Bring your own IP to CloudFront using IPAM (supports IPv4 and IPv6) + +IPAM's BYOIP for global services lets you use your own IPv4 and IPv6 addresses with AWS global services like CloudFront. Unlike regional BYOIP, your IP addresses are advertised from multiple edge locations simultaneously through anycast routing. + +This tutorial covers: + + * Creating global IPAM pools for IPv4 (/24) and/or IPv6 (/48) address ranges + + * Provisioning Anycast Static IP lists with your own IP addresses + + * Advertising your CIDRs globally through CloudFront edge locations + + * Dual-stack configurations using separate IPv4 and IPv6 IPAM pools + + @@ -9 +22,0 @@ Why use this feature?Who should use this feature?When to use this feature?Prereq -IPAM's BYOIP for global services lets you use your own IPv4 addresses with AWS global services like CloudFront. Unlike regional BYOIP, your IP addresses are advertised from multiple edge locations simultaneously through anycast routing. @@ -18,0 +32,2 @@ IPAM's BYOIP for global services lets you use your own IPv4 addresses with AWS g + * **IPv6 readiness** – Support modern dual-stack architectures with both IPv4 and IPv6 + @@ -31,0 +47,2 @@ Organizations that need their own IP addresses with global content delivery: + * Enterprises requiring dual-stack (IPv4/IPv6) configurations for global reach + @@ -44,0 +62,2 @@ Use BYOIP for global services when you need to: + * Deploy dual-stack architectures supporting both IPv4 and IPv6 clients + @@ -50 +69 @@ Use BYOIP for global services when you need to: -Requires /24 IPv4 CIDR blocks. Currently available for CloudFront only. +Requires /24 CIDR blocks for IPv4. Dual-stack (IPv4 and IPv6) requires /24 IPv4 and /48 IPv6 CIDR blocks. Currently available for CloudFront only. @@ -60 +79,3 @@ Complete these steps before starting: - * **Create top-level pool** – Follow steps 1-2 in [Bring your own IPv4 CIDR to IPAM](./tutorials-byoip-ipam-console-ipv4.html) + * **Create top-level pool(s)** – Follow steps 1-2 in [Bring your own IPv4 CIDR to IPAM](./tutorials-byoip-ipam-console-ipv4.html) and/or [Bring your own IPv6 CIDR to IPAM](./tutorials-byoip-ipam-console-ipv6.html) + + * **ROA (Route Origin Authorization)** – Ensure ROAs are configured for both IPv4 (/24) and IPv6 (/48) prefixes if deploying dual-stack @@ -67 +88 @@ Complete these steps before starting: -The following steps differ from the standard regional BYOIP process and establish the pattern for global services: +The following steps differ from the standard regional BYOIP process and establish the pattern for global services. For dual-stack deployments, you'll create separate pools for IPv4 and IPv6, then provision both to CloudFront. @@ -69 +90 @@ The following steps differ from the standard regional BYOIP process and establis -### Step 1: Create a global pool for anycast services +### Step 1: Create global pool(s) for anycast services @@ -91 +112 @@ To create a global pool using the console: - 8. **CIDRs to provision** : Specify your /24 CIDR range + 8. **CIDRs to provision** : Specify your /24 CIDR range (for IPv4) or /48 CIDR range (for IPv6) @@ -100 +121,8 @@ To create a global pool using the console: -Use `aws ec2 create-ipam-pool` with locale set to "Global" and address family "ipv4". +For IPv4: + + + aws ec2 create-ipam-pool \ + --ipam-scope-id scope-id \ + --locale None \ + --address-family ipv4 \ + --source-ipam-pool-id top-level-pool-id @@ -102 +130,16 @@ Use `aws ec2 create-ipam-pool` with locale set to "Global" and address family "i -Then provision the CIDR using `aws ec2 provision-ipam-pool-cidr`. + aws ec2 provision-ipam-pool-cidr \ + --ipam-pool-id global-pool-id \ + --cidr your-ipv4-/24 + +For IPv6: + + + aws ec2 create-ipam-pool \ + --ipam-scope-id scope-id \ + --locale None \ + --address-family ipv6 \ + --source-ipam-pool-id top-level-pool-id + + aws ec2 provision-ipam-pool-cidr \ + --ipam-pool-id global-pool-id \ + --cidr your-ipv6-/48 @@ -106 +149,6 @@ Then provision the CIDR using `aws ec2 provision-ipam-pool-cidr`. -You must allocate the full /24 block to this pool. You can provision more specific ranges within this block for different uses. + * For IPv4: You must allocate the full /24 block to this pool. You can provision more specific ranges within this block for different uses. + + * For IPv6: You must allocate the full /48 block to this pool. You can provision more specific ranges within this block for different uses. + + + @@ -110 +158 @@ You must allocate the full /24 block to this pool. You can provision more specif -For CloudFront, create an anycast IP list that uses your IPAM pool. For detailed instructions, see CloudFront BYOIP documentation (link TBD). +For CloudFront, create an anycast IP list that uses your IPAM pool. For detailed instructions, see [Bring your own IP to CloudFront using IPAM](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/bring-your-own-ip-address-using-ipam.html) in the _Amazon CloudFront Developer Guide_. @@ -116 +164 @@ For CloudFront, create an anycast IP list that uses your IPAM pool. For detailed - * **IPAM pool** – Select your global pool from Step 1 + * **IPAM pool** – Select your global pool from Step 1 (IPv4 or IPv6) @@ -125 +173 @@ For CloudFront, create an anycast IP list that uses your IPAM pool. For detailed -Associate your Anycast Static IP list with a CloudFront distribution. For detailed instructions, see CloudFront BYOIP documentation (link TBD). +Associate your Anycast Static IP list with a CloudFront distribution. For detailed instructions, see [Bring your own IP to CloudFront using IPAM](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/bring-your-own-ip-address-using-ipam.html) in the _Amazon CloudFront Developer Guide_. @@ -168 +216,11 @@ To advertise the CIDR using the console: -Use `aws ec2 advertise-ipam-byoip-cidr` with your IPAM pool ID and CIDR. +For IPv4: + + + aws ec2 advertise-byoip-cidr \ + --cidr your-ipv4-/24 + +For IPv6: + + + aws ec2 advertise-byoip-cidr \ + --cidr your-ipv6-/48 @@ -174 +232 @@ Use `aws ec2 advertise-ipam-byoip-cidr` with your IPAM pool ID and CIDR. - * Update DNS records to point to CloudFront to complete the migration + * Update DNS records to point to CloudFront to complete the migration (A records for IPv4, AAAA records for IPv6) @@ -183 +241 @@ To clean up resources created in this tutorial: - * **Delete CloudFront resources** – Follow the cleanup instructions in CloudFront BYOIP documentation (link TBD) + * **Delete CloudFront resources** – Follow the cleanup instructions in [Bring your own IP to CloudFront using IPAM](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/bring-your-own-ip-address-using-ipam.html) in the _Amazon CloudFront Developer Guide_