You already own your IP addresses. Here's why that matters in the cloud.
You run a company with servers in three places: your own data center, a colocated facility, and now AWS. Your servers have used the same block of public IP addresses for years. Clients, partners, firewall allowlists, and DNS records all point at those IPs.
Then you launch an EC2 instance and AWS hands you a fresh IP from its own pool. Fine for most workloads. But what if you could keep using the IPs you already own, just routed through AWS instead? That is BYOIP, short for Bring Your Own IP.
This matters more than it sounds. BYOIP is the bridge between traditional networking and cloud infrastructure. To see how it works, you need a few networking concepts first: not every gritty detail, just the parts that make BYOIP click.
What you already know about addresses in AWS
When you create a VPC, AWS gives you a range of private IP addresses to use inside it, like 10.0.0.0/16. Those are reserved for internal use and are not routable on the public internet.
Every instance can also get a public IP address, the one used to reach it from outside your VPC. AWS owns huge blocks of public IPs and hands out chunks to regions, zones, and customers. Those addresses are globally routable: traffic can find your instance from anywhere.
Here is the catch. AWS owns those public IPs, not you. Shut down the instance and AWS reclaims the address; tomorrow it may belong to someone else. For most applications that is fine. You point DNS at whatever IP AWS gives you and move on.
But large organizations often own their own public IP blocks. They registered them with a Regional Internet Registry, a public authority that manages IP allocation. They want to keep using those exact IPs even after moving workloads into the cloud. That is the gap BYOIP fills.
IP blocks and who owns them
Public IP addresses are not handed out one at a time. They come in blocks: contiguous ranges written in CIDR notation like 203.0.113.0/24, which is 256 addresses in sequence.
When your organization needs address space, you apply to a Regional Internet Registry for a block sized /24, /23, /22, and so on. The smaller the number after the slash, the larger the block. These registries are the governing bodies: ARIN for North America, RIPE for Europe, APNIC for Asia-Pacific, and others by region. They maintain the authoritative "who owns what" database for the entire internet.
Once you own a block, it is tied to your organization and to your ASN.
An ASN, or Autonomous System Number, is a unique identifier for your organization's network. Think of it as a business registration number, but for networking. It tells the rest of the internet: this is our network, we control it, and here are the addresses we own. Your ASN might be AS64512. AWS's is AS16509. Google's is AS15169.
This matters because when you announce an IP block to the internet, you announce it under an ASN. You are effectively saying: I own this block, I am AS64512, send traffic for these addresses to me. The global routing system listens to those announcements and builds a map of where every block lives.
How the internet finds your IPs: BGP in action
The internet is a network of networks. Each one, whether it is AWS, your company, or an ISP, is an Autonomous System. These systems do not fling traffic at each other randomly. They coordinate using a protocol called BGP, the Border Gateway Protocol.
BGP is how routers at the edges of networks share which IP blocks they own and how to reach them. Picture routers constantly announcing: I am AS16509 and I own these blocks, so send their traffic to me. Other routers listen and build a routing table. When someone's browser reaches out to your IP, their traffic follows the trail those announcements laid down.
Here is the piece that makes BYOIP possible. For your block to work inside AWS, AWS has to announce it to the internet as if the traffic should come to AWS. But the routing system should not blindly trust that announcement, because if it did, anyone could announce anyone's block and hijack the traffic.
The safeguard is RPKI, short for Resource Public Key Infrastructure. RPKI is a cryptographic certificate that says: I, the real owner, authorize AS16509 to announce my block. You sign that authorization, AWS presents it, and routers verify the signature before they trust the announcement. Without it, a bogus announcement gets rejected.
The BYOIP workflow, step by step
Here is what actually happens when you set up BYOIP in AWS.
First, you already own a block, say 203.0.113.0/24, registered to your ASN AS64512 with a Regional Internet Registry. That ownership is a prerequisite, not something AWS grants you.
Second, you create an RPKI authorization: a signed certificate stating that AS16509 is allowed to announce your block. You publish it in your RPKI repository at your registry.
Third, you tell AWS you want to bring 203.0.113.0/24 into your account. AWS validates two things: that you control the block, and that the RPKI authorization exists and checks out. It also asks you to prove control by adding a signed message you generate, so nobody can bring in a block they do not own.
Fourth, once validation passes, AWS provisions the block in your account and begins announcing it to the internet over BGP under its own ASN. From that point, addresses from your block can be assigned to your EC2 instances, NAT gateways, Network Load Balancers, and Elastic IPs.
From the internet's point of view, AWS is announcing your block. But you still legally own it. You can withdraw it later, move it to another cloud, or bring it back on-premises: just update the RPKI authorization to point at whoever should announce it next.
Where BYOIP earns its keep
Migration without changing IPs. You are moving a fleet from your data center into AWS. Clients connect straight to the IPs, not just to DNS names, and some of those clients are third parties with the addresses baked into firewall allowlists. BYOIP lets you keep the exact same addresses and point them at AWS resources. No allowlist churn, no waiting on DNS caches to expire.
Email sender reputation. If you send mail at scale, your deliverability is tied to the reputation of your IP block, built up slowly over years. Moving to AWS's shared pool would reset that reputation and risk your mail landing in spam folders. BYOIP carries your established reputation with you.
Regulatory or contractual requirements. Some industries and contracts require you to retain control of your own IP space. BYOIP lets you satisfy that while still running the workloads in AWS. You own the addresses; AWS just routes to them.
Portability and leverage. Because the block is yours, you are not locked in. If you renegotiate with a provider or adopt a second cloud, the same addresses can follow you. That optionality is itself a reason some organizations insist on owning their space.
What BYOIP does not do
It does not let you claim arbitrary addresses. You must already own the block through a legitimate registry, and you must prove it. You cannot pick a random range and assert it is yours.
It does not touch private addressing. Your VPC subnets still use the standard RFC 1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16). BYOIP is only about public, internet-routable space.
It is not free of operational overhead. You manage RPKI records, coordinate the onboarding, and mind the routing. There are also constraints on the smallest block AWS will accept and how blocks can be split across regions. For many small and mid-sized teams the AWS-provided pool is simpler and perfectly adequate. BYOIP is a tool for the cases where owning the addresses genuinely pays off.
Summary
BYOIP lets you bring an IP block you already own into AWS and have AWS announce it to the internet for you. The whole thing rests on a layered trust model: a Regional Internet Registry records that your ASN owns the block, you sign an RPKI authorization permitting AWS to announce it, and internet routers verify that signature before they route traffic toward AWS. The ASN is your network's identity, RPKI is the proof of permission, and BGP is the mechanism that carries the announcement. Understand those three and BYOIP stops looking like magic: it is simply ownership staying with you while the routing moves to the cloud. That is why it fits migrations, email reputation, regulated environments, and anyone who wants their addresses to remain portable rather than borrowed.
Part of the Explained series — concepts in tech, clearly.