AWS BYOIP — Bring Your Own IP Addresses to Amazon Web Services
Eliminate AWS public IPv4 charges by bringing your own IP addresses. Save up to 86% compared to native AWS IPv4 pricing with our comprehensive BYOIP setup guide.
What Is AWS BYOIP?
AWS BYOIP (Bring Your Own IP) is an EC2 feature that allows you to bring your own public IPv4 address ranges into your AWS account and advertise them on the internet. Since February 2024, AWS charges $0.005 per public IPv4 address per hour for all in-use and idle Elastic IPs. By using BYOIP with leased addresses, you can completely bypass this charge and dramatically reduce your cloud networking costs.
Most AWS regions support BYOIP, including US East (N. Virginia, Ohio), US West (Oregon, N. California), EU (Ireland, Frankfurt, London, Paris, Stockholm), Asia Pacific (Tokyo, Seoul, Singapore, Sydney, Mumbai), Canada (Central), and South America (São Paulo). GovCloud regions also support BYOIP with additional compliance requirements.
AWS BYOIP Requirements
Before provisioning your IP addresses in AWS, ensure you meet all of the following requirements.
Minimum /24 Prefix Size
AWS requires a minimum of a /24 prefix (256 IP addresses) for BYOIP. Smaller prefixes cannot be provisioned or advertised through EC2.
RIR Registration
Your IP address range must be registered with a Regional Internet Registry (RIR) such as ARIN, RIPE NCC, or APNIC. The registration must be current and verifiable.
ROA with AS16509
A Route Origin Authorization (ROA) must be created in your RIR account authorizing AS16509 (Amazon) to announce your prefix. The ROA must include the exact prefix length you intend to bring.
Self-Signed X.509 Certificate
You must generate an RSA 2048-bit key pair and create a self-signed X.509 certificate. This certificate is uploaded to the RDAP/Whois record of your RIR to verify ownership of the address range.
Clean IP Reputation
Your IP address range must have a clean reputation with no active blacklist entries. AWS verifies IP reputation during provisioning and may reject ranges with abuse history.
Step-by-Step AWS BYOIP Setup
Follow these steps to provision and advertise your own IP addresses in AWS.
Create RSA Key Pair
15 minGenerate a 2048-bit RSA key pair using OpenSSL. This key pair will be used to create the X.509 certificate that proves ownership of your IP range. Store the private key securely — you will need it to sign the authorization message.
Generate X.509 Certificate
15 minCreate a self-signed X.509 certificate from your RSA key pair. The certificate should have a validity period of at least 365 days. Use the OpenSSL x509 command with your key pair to generate the certificate in PEM format.
Upload Certificate to RIR
1-2 hoursAdd the X.509 certificate to the RDAP/Whois record for your IP range at your RIR (ARIN, RIPE NCC, or APNIC). For ARIN, add it to the "Public Comments" field of the network object. For RIPE, create a "descr" attribute on the inetnum object.
Create ROA with AS16509
2-4 hoursCreate a Route Origin Authorization in your RIR portal authorizing AS16509 (Amazon) to announce your prefix. Set the maximum prefix length to match your CIDR. Allow 2-4 hours for global RPKI propagation before proceeding.
Provision CIDR in AWS
1-2 hoursUse the AWS CLI command `aws ec2 provision-byoip-cidr` or the AWS Console to provision your address range. Provide the signed authorization message along with your CIDR. AWS will verify ownership and ROA validity during this step.
Advertise Address Range
1-2 hoursOnce provisioning is complete, use `aws ec2 advertise-byoip-cidr` to start advertising your IP range on the internet via AWS. After advertisement, you can allocate Elastic IPs from your BYOIP pool and assign them to EC2 instances, ELBs, or NLBs.
Total: Approximately 24 hours (including ROA propagation)
AWS BYOIP Pricing Comparison
See how much you can save by bringing your own IP addresses to AWS instead of using native public IPv4 addresses.
AWS Native Public IPv4
Since February 2024, AWS charges $0.005 per public IPv4 address per hour for all in-use and idle Elastic IPs, applying to EC2, RDS, ELB, and other services.
BYOIP with IPv4Center Lease
Lease a /24 block from IPv4Center and bring it to AWS via BYOIP. No AWS public IPv4 surcharge applies to your own addresses, so you only pay the lease cost.
Your Savings
Advantages of AWS BYOIP
Key benefits of bringing your own IP addresses to Amazon Web Services.
No AWS IPv4 Charges
Completely eliminate the $0.005/IP/hour public IPv4 surcharge introduced in February 2024. BYOIP addresses are exempt from this fee, resulting in up to 86% cost savings.
IP Reputation Preservation
Maintain your established IP reputation, sender scores, and allowlist entries when migrating to AWS. Critical for email deliverability and services relying on IP-based trust.
Multi-Region Flexibility
Advertise your BYOIP range in multiple AWS regions simultaneously. Move your addresses between regions as your infrastructure needs change without obtaining new IPs.
Global Accelerator Integration
Use your BYOIP addresses with AWS Global Accelerator for anycast routing, providing low-latency access to your applications across AWS edge locations worldwide.
EC2 / ELB / NLB Compatibility
BYOIP addresses work seamlessly with EC2 Elastic IPs, Application Load Balancers, Network Load Balancers, and NAT Gateways — no changes to your architecture required.
AWS BYOIP FAQ
Frequently asked questions about Bring Your Own IP on AWS.
Does AWS charge for BYOIP addresses?
Can I use BYOIP addresses with EC2 instances?
Which AWS regions support BYOIP?
Does AWS support IPv6 BYOIP?
Can I use BYOIP with AWS Global Accelerator?
What is the minimum prefix size for AWS BYOIP?
Ready to Bring Your IPs to AWS?
Get clean, RIR-registered IPv4 addresses ready for AWS BYOIP provisioning. Our team handles ROA creation and provides full setup support.
Free consultation — no commitment required