Lecture 29: Bring Your Own IP
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：06:49
- 来源：Udemy Lecture 28781404
- Slide 数量：3
- 画面切换：02:49、05:45
扫描说明
按 Udemy Transcript 的 94 个时间点逐一定位并比较视频画面，确认 BYOIP 用途、前置条件和补充限制共 3 个 Slide。同页项目逐步出现视为动画构建，截图选取最终稳定状态。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. Why Bring Your Own IP to AWS
时间范围：00:00–02:49
总结 / Summary
中文
自带 IP（Bring Your Own IP, BYOIP）允许把自己拥有、可在公网路由的 IPv4 或 IPv6 地址段迁移到 AWS，并分配给 AWS 资源。主要动机包括保留长期建立的 IP 信誉（IP Reputation）、避免合作方修改防火墙白名单（Allowlist）、保持硬编码地址不变，以及把 AWS 作为热备用站点（Hot Standby Site）时快速切换而不改变客户端地址。
English
Bring Your Own IP (BYOIP) lets an organization migrate its owned, publicly routable IPv4 or IPv6 ranges to AWS and assign addresses to AWS resources. Common motivations are preserving established IP reputation, avoiding partner firewall allowlist changes, keeping hard-coded addresses stable, and enabling a hot-standby AWS site without changing client-visible addresses.
Transcript
00:00 Hello and welcome to this lecture.
00:01 So relatively this will be very quick and small lecture.
00:04 But it's again important.
00:06 Now AWS also offers you to bring your own public IPS to AWS.
00:13 That means you can migrate your publicly routable IPv4 or IPv6 addresses to AWS.
00:19 So if you own these addresses, you can bring in those to AWS, and you can then assign these public
00:25 IP addresses to your resources inside your AWS account.
00:29 But the question comes, why do you need to do this right?
00:32 So of course there are multiple reasons.
00:34 And the most important is maybe you want to make sure that your IP keeps the reputation that it has
00:41 built over the time.
00:43 So in the internet world, it is important that the IP is well reputed.
00:48 That means, uh, it is not blacklisted anywhere.
00:51 It has good reputation when third party applications connect to your servers.
00:56 So over the time this credibility is built.
00:58 Right.
00:59 And as you move your applications to the AWS, you don't want to start building the reputation again,
01:04 but rather you want to leverage your existing IP reputations.
01:07 And that's where you want to reuse your existing public IP addresses.
01:11 So that's the first reason for which you can bring your own IP address to the AWS.
01:15 Second, you want to avoid changes to IP address whitelisting because you have published your IP addresses
01:22 to maybe your customers or third party applications, and your customers or partners already whitelisted
01:29 your IP addresses into their firewall.
01:31 Now, if you move to AWS with new IP addresses, you would have to again provide these IP addresses
01:35 to them.
01:36 And if you want to avoid this kind of change, their third, you want to move your application without
01:42 changing the IP addresses.
01:43 Now this is more related to suppose there are multiple applications and they communicate with each other
01:48 over the public IPS.
01:49 And then on the client side maybe you have hard coded the IP addresses.
01:54 Now if you move all these applications to the AWS, and if this IP address is changed, you would have
02:00 to make that change in your client side as well wherever you have done the hard coding.
02:04 So again, there is a considerable change and you do not know how the applications will be impacted
02:10 by this.
02:12 And the fourth, you want to use AWS as a hot standby site, which means that you are operating on premises.
02:19 But in case something happens to your data center, you want to just start using the AWS instead.
02:25 Then you can complete the process of bring your own IP and move your IP addresses from on premises to
02:31 AWS, and start allocating the same IPS to the machines inside AWS.
02:35 And your application then doesn't see any change, right?
02:39 So those are the primary reasons for which you can, you know, bring your own IP to the AWS and understand
02:45 that you can bring both IPv4 and IPv6 IP addresses.
2. BYOIP Prerequisites and Route Authorization
时间范围：02:49–05:45
总结 / Summary
中文
地址段必须登记在受支持的区域互联网注册机构（Regional Internet Registry, RIR），视频列出 ARIN、RIPE NCC 和 APNIC；地址历史需干净，AWS 可拒绝存在恶意或黑名单记录的范围。IPv4 可带入的最具体前缀是 /24；公开通告的 IPv6 最具体为 /48，不向公网通告的 IPv6 可为 /56，并仍可通过 AWS Direct Connect 访问。所有者需创建路由起源授权（Route Origin Authorization, ROA），允许 AWS 使用 ASN 16509 或 14618 对外通告前缀。
English
The range must be registered with a supported Regional Internet Registry (RIR); the lecture lists ARIN, RIPE NCC, and APNIC. It must have a clean history, and AWS may reject malicious or blacklisted space. The most-specific IPv4 range is /24; publicly advertised IPv6 may be as specific as /48, while non-publicly advertised IPv6 may be /56 and remain reachable through AWS Direct Connect. The owner creates a Route Origin Authorization (ROA) permitting AWS ASNs 16509 or 14618 to advertise the prefix.
Transcript
02:49 Now let's see what are the prerequisites to bring your own IP to AWS.
02:54 So very first thing is that the address range that you want to migrate to AWS, they must be registered
03:01 with the internet registries.
03:03 And there are currently three registries which are supported ARIN, Ripe and Apnic.
03:09 ARIN is for IP addresses in America, Ripe is for Middle East and Europe, and then Apnic is for Asia
03:18 Pacific.
03:19 So you have to make sure that the address range that you are bringing in are registered with the regional
03:24 internet registries.
03:26 Second, the addresses in the IP address range must have a clean history.
03:30 That means if your IP is malicious and it has been blacklisted, then AWS reserves the right to reject
03:38 such IP address ranges.
03:41 Now, if you want to bring in IPv4 addresses, the most specific Cidr range that you can bring to AWS
03:46 is slash 24.
03:48 That means you cannot bring the IP address with the range slash 25 or 26 or onwards, but you can very
03:55 well bring in 23 or 22.
03:57 Likewise, when when we say that you are bringing IPv4 addresses to AWS, these are the public IP addresses.
04:03 And as you bring in, AWS will advertise these IP addresses to the outside world.
04:08 So that internet knows that.
04:10 Now these IP addresses are with AWS and the routers will route the traffic to AWS.
04:14 In that case, now for IPv6 addresses, you have two options there.
04:19 Whether you want to publicize these IP addresses to the outside world or you don't want to do that in
04:25 case of IPv6.
04:27 So if you just want to publicly advertise the IPv6 addresses as well, then you can bring in the range
04:32 with slash 48 Sidr.
04:35 That is the most specific one.
04:36 But in case you don't want your IPv6 addresses to be publicly advertised, then you have to bring in
04:44 with the most specific address range of slash 56.
04:47 Right.
04:48 Uh, and understand that even though they are not publicly advertised.
04:52 You can still reach to these IP addresses over the Direct Connect.
04:56 So this is what are the prerequisites for bringing in the IP addresses to AWS.
05:01 Now how AWS advertised these IP addresses to the outside world for this, AWS need permissions from
05:08 you.
05:08 And when I say you, it means your internet registry because originally your IP addresses are registered
05:14 with those internet registries.
05:16 Now for that you have to create something called ROA, that is route origin authorisation.
05:21 And it allows AWS to advertise the IP addresses that you own to the outside world.
05:30 Right.
05:31 And AWS does that using the ASN 16509 and 14618.
05:37 So these are the two ASN AWS uses to advertise your IP addresses to the internet.
05:42 So overall this is how the bio IP works.
3. Ownership, Address Pools, and Regional Limits
时间范围：05:45–06:49
总结 / Summary
中文
BYOIP 不会把地址所有权转移给 AWS；客户继续拥有前缀，AWS 只是代表客户通告。成功导入后，地址在账户中显示为地址池（Address Pool），可用于 EC2、网络负载均衡器（Network Load Balancer, NLB）或 NAT 网关（NAT Gateway）。视频指出每个区域、每个账户最多可带入 5 个 IPv4/IPv6 地址范围，限制针对 CIDR 范围而不是单个 IP。
English
BYOIP does not transfer ownership to AWS; the customer retains the prefix and AWS advertises it on the customer's behalf. After import, the addresses appear as an account address pool and can be used with EC2, Network Load Balancers (NLBs), or NAT Gateways. The lecture states a limit of five IPv4/IPv6 address ranges per account per Region, applying to CIDR ranges rather than individual addresses.
Transcript
05:45 And now let's look at some of the additional things about the bring your own IP.
05:50 Now, as you bring in your IP addresses, that doesn't mean AWS owns your IP addresses.
05:55 You continue to own this address range, but then AWS advertises on behalf of you.
06:01 Now, after you bring in your own address to AWS, these addresses appear in your AWS account as an
06:07 address pool, and then you can associate these IP addresses to EC2 instances or Network Load Balancer
06:13 or the Nat gateways.
06:15 Now you can bring in the total of five IPv4 and IPv6 address ranges per region to your AWS account.
06:24 Note that we are not talking about individual IP addresses, but the address range, which should be
06:30 more specific as slash 24 or 40 8 or 56 for IPv6 addresses.
06:36 Okay, so that's it about the bring your own IP and just understand that you can bring in IPv4 and IPv6
06:44 addresses to AWS.
06:46 And thanks for watching.
整讲总结 / Overall Summary
中文
BYOIP 的核心价值是让现有公有地址身份随工作负载迁移到 AWS，从而保留信誉、白名单和客户端配置。实施前必须确认 RIR 登记、地址历史、前缀长度和 ROA 授权；导入后客户仍拥有地址，AWS 负责通告并把范围作为地址池供支持的资源使用。
English
BYOIP lets an existing public-address identity move with workloads to AWS, preserving reputation, allowlists, and client configuration. Before onboarding, verify RIR registration, address history, prefix length, and ROA authorization. The customer retains ownership, while AWS advertises the range and exposes it as an address pool for supported resources.
返回顶部 ↑