AWS vpc: BYOASN tutorial: add ASPA publishing recommendation and RIR definition
Summary
Expands the 'Regional Internet Registry (RIR)' acronym on first use and adds a new bullet recommending that customers publish an Autonomous System Provider Authorization (ASPA) object for their ASN listing Amazon ASNs 16509/14618 (8987 for GovCloud, 16509/214101 for AWS European Sovereign Cloud), warning that routes fail ASPA validation otherwise.
Security assessment
ASPA (RPKI-based Autonomous System Provider Authorization) is a routing-security control that validates authorized upstream providers for a customer ASN, mitigating BGP route hijacking/leakage; the added guidance tells customers exactly which Amazon ASNs to authorize and warns that routes fail ASPA validation otherwise. It is best-practice routing security documentation rather than a fix for a specific disclosed vulnerability or incident.
Evidence
+ * We recommend that you publish an Autonomous System Provider Authorization (ASPA) object for your ASN in your RIR. The ASPA object authorizes AWS to readvertise route announcements that originate from your ASN. Include the Amazon ASNs 16509 and 14618. For the AWS GovCloud (US) Regions, use ASN 8987. For the AWS European Sovereign Cloud, use ASNs 16509 and 214101. If an ASPA object already exists for your ASN, you must add these Amazon ASNs to it. Otherwise, routes that AWS readvertises from your ASN fail ASPA validation.
Diff
diff --git a/vpc/latest/ipam/tutorials-byoasn.md b/vpc/latest/ipam/tutorials-byoasn.md index cb9755119..fa81ba153 100644 --- a//vpc/latest/ipam/tutorials-byoasn.md +++ b//vpc/latest/ipam/tutorials-byoasn.md @@ -38 +38 @@ You will need the following to complete this tutorial: - * When you bring an IPv4 or IPv6 address range to AWS with [Tutorial: Bring your IP addresses to IPAM](./tutorials-byoip-ipam.html), you [create an X.509 certificate](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-byoip.html#byoip-add-certificate) and [upload the X.509 certificate to the RDAP record in your RIR](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-byoip.html#byoip-add-certificate). You must upload the same certificate you created to the RDAP record in your RIR for the ASN. Be sure to include the `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----` strings before and after the encoded portion. All of this content must be on a single, long line. The procedure for updating RDAP depends on your RIR: + * When you bring an IPv4 or IPv6 address range to AWS with [Tutorial: Bring your IP addresses to IPAM](./tutorials-byoip-ipam.html), you [create an X.509 certificate](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-byoip.html#byoip-add-certificate) and [upload the X.509 certificate to the RDAP record in your Regional Internet Registry (RIR)](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-byoip.html#byoip-add-certificate). You must upload the same certificate you created to the RDAP record in your RIR for the ASN. Be sure to include the `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----` strings before and after the encoded portion. All of this content must be on a single, long line. The procedure for updating RDAP depends on your RIR: @@ -49,0 +50,2 @@ You will need the following to complete this tutorial: + * We recommend that you publish an Autonomous System Provider Authorization (ASPA) object for your ASN in your RIR. The ASPA object authorizes AWS to readvertise route announcements that originate from your ASN. Include the Amazon ASNs 16509 and 14618. For the AWS GovCloud (US) Regions, use ASN 8987. For the AWS European Sovereign Cloud, use ASNs 16509 and 214101. If an ASPA object already exists for your ASN, you must add these Amazon ASNs to it. Otherwise, routes that AWS readvertises from your ASN fail ASPA validation. +