Bring Leased IPv4 to AWS: BYOIP Requirements, Steps, Costs
There is a documented way to stop paying that bill, and Amazon covers the mechanics of it in depth: Bring Your Own IP (BYOIP).
Artem Kohanevich
Co-Founder & CEO at IPbnb
Last updated
Table of Contents
item
If you run anything on AWS, you are paying rent on every public IPv4 address you touch. Since 1 February 2024, Amazon charges $0.005 per hour for every public IPv4 address in your account - attached or idle, whether it sits on an EC2 instance, a NAT gateway, a load balancer, or an unused Elastic IP. That works out to about $3.65 per address each month. Put 256 addresses to work and you are spending roughly $934 a month, or more than $11,000 a year, on the addresses alone.
There is a documented way to stop paying that bill, and Amazon covers the mechanics of it in depth: Bring Your Own IP (BYOIP). Addresses you bring in this way are exempt from the per-address charge. What the AWS documentation never quite answers is the question most people actually arrive with: can I bring a leased /24, or does BYOIP only work for blocks I own outright? It is also silent on the real cost comparison and on the pitfalls that trip people up.
This guide closes all three gaps.
Short answer: Yes, you can bring a leased /24 to AWS through BYOIP, and doing so removes the $0.005/hour charge on those addresses entirely. The catch is that AWS validates control of the block through your Internet registry, so a leased range needs the IP owner to authorize it. The rest of this article covers the requirements, the seven-step setup, and whether the saving is worth the effort.
Why AWS BYOIP matters in 2026: the public IPv4 charge
Before February 2024, AWS only billed you for Elastic IPs that you had reserved but left unattached. Everything else was free. That changed overnight. Today the charge is universal: every public IPv4 address is metered at $0.005 per hour, working or idle, no exceptions.
At small scale it is easy to ignore. At any real footprint it is not. Here is how the two models compare for 256 addresses - a full /24.
Amazon-provided IPv4 / Elastic IP | BYOIP range (owned or leased) | |
|---|---|---|
Per-address charge | $0.005/hr (~$3.65/mo) | $0 |
256 addresses (a /24) | ~$934/mo (~$11,213/yr) | $0 in AWS address charges |
Elastic IP allocation | Billed like any public IPv4 | Free when drawn from your BYOIP pool |
What you pay instead | Baked into your AWS bill | Your lease (nothing, if you own the block) |
The takeaway is blunt: addresses you bring in through BYOIP escape the charge, and Elastic IPs you allocate from your own pool cost nothing. For a team running a serious IPv4 footprint, the choice between "Amazon rents you the addresses" and "you bring your own" is a five-figure line item every year. You can model your own numbers against current lease rates with our IPv4 pricing calculator.
Can you bring leased IPv4 to AWS?
Yes - and because the official docs never say so directly, it is worth being precise about why.
AWS does not check whether you own a block in any legal sense. It checks whether you can prove control of it through the Regional Internet Registry. Two records establish that:
A Route Origin Authorization (ROA) in the registry's RPKI system, authorizing Amazon's ASNs to advertise the range.
RDAP records at the registry, which AWS queries to confirm the range answers to you.
Both of those live wherever the registration lives - and for a leased block, that is with the IP owner, not the renter. So a leased /24 goes into AWS BYOIP perfectly well, but only with the owner's cooperation. The ROA and any RDAP updates have to come from the registered holder.
In practice, this is exactly what a proper leasing marketplace takes off your plate. When you lease a block through IPbnb, the ROA and RDAP setup for cloud BYOIP is handled as part of the arrangement, so the block reaches you AWS-ready and you provision it like any range you own. Two things to confirm before you commit:
Your lease explicitly permits cloud BYOIP. Not every lease does - our BYOIP overview explains why.
The IP owner will create the ROA for Amazon's ASNs 16509 and 14618 and keep it valid for as long as the block lives in AWS.
Get those two right and, from Amazon's side, a leased block behaves identically to one you own.
AWS BYOIP requirements
Every requirement below is enforced at provisioning time. Miss one and your range stalls in pending-provision instead of going live.
The smallest block is a /24. You cannot bring anything more specific than a /24 for IPv4 - no /25s or /26s. For IPv6, the most specific publicly advertised prefix is a /48.
Registered with a supported registry. The block must sit with ARIN, RIPE, or APNIC, and be registered to a business or institutional entity - never to an individual.
A ROA authorizing Amazon's ASNs. Create a ROA that authorizes ASNs 16509 and 14618 to advertise the range (use 8987 for AWS GovCloud). Set its maximum length to /24, and allow up to 24 hours for it to propagate before AWS can see it.
RDAP control verification. AWS confirms control through your registry's RDAP records, usually with a short-lived X.509 certificate that you can remove once provisioning finishes.
Five ranges per Region. You can bring five IPv4 and IPv6 ranges per Region. Beyond that, you need a limit increase through AWS Support.
One block, one Region at a time. A given range can live in a single Region. You cannot advertise the same block from two Regions at once.
How to bring a leased /24 to AWS: 7 steps
Once the registry side is in order, the AWS side is a handful of CLI calls. Most of the elapsed time is waiting for RPKI to propagate, not hands-on work.
1. Prepare the ROA and RDAP records. Have the IP owner create the ROA authorizing ASNs 16509 and 14618, maximum length /24, and confirm the RDAP records are current. This step gates everything else, and the ROA can take up to 24 hours to reach Amazon.
2. Provision the block. Once the ROA has propagated, provision the range and create its address pool:
Provisioning runs asynchronously: the command returns straight away, but the range is not usable yet.
3. Watch the status. Wait for the state to move from pending-provision to provisioned:
If it fails instead, the status message tells you why - most often a ROA mismatch (see the note below).
4. Advertise the range. Once it reads provisioned, tell AWS to start announcing it:
5. Allocate Elastic IPs from your pool. Draw addresses from your own pool rather than Amazon's - these allocations are free:
6. Attach them to your resources. Associate those Elastic IPs with EC2 instances, NAT gateways, or Network Load Balancers, exactly as you would any Elastic IP.
7. Verify the announcement. Confirm the block is live and routing correctly through AWS before you move real traffic onto it.
How long does it take, realistically? AWS publishes no guaranteed provisioning time. Budget up to 24 hours for ROA propagation and a few business days end to end once the registry paperwork is done. Treat it as a planned migration, not a same-hour change.
A note on leased ranges and validation errors
Because a leased block's registry records sit with the owner, the two most common failures are both registry-side rather than anything you did in AWS:
pending-provisionthat never clears - usually the ROA has not propagated yet, or its maximum length was not set to /24.ROA mismatch - the ROA does not cover the exact range, or it authorizes the wrong ASNs. Check that both 16509 and 14618 are listed and that the ROA stays valid for the whole time the block is in AWS.
Which AWS services support BYOIP
Once a block is provisioned, it plugs into AWS in two main ways:
EC2 and VPC, through Elastic IP. The core case. Allocate Elastic IPs from your pool and attach them to EC2 instances, NAT gateways, and Network Load Balancers.
AWS Global Accelerator. Assign IPv4 addresses directly from your own pool to an accelerator (IPv4 only) instead of using Amazon's anycast addresses.
One more service carries the BYOIP name but works nothing like the above, and it is worth being clear so you are not caught out:
Amazon SES. SES has its own BYOIP feature for email, but it is a separate, paid mechanism - not the cost-saving path in this article. SES BYOIP is billed per address each month, with a 256-address minimum, so it does not dodge a charge the way EC2/VPC BYOIP does. Its purpose is preserving an established sending reputation, not cutting IPv4 costs. If lower AWS IPv4 bills are your goal, SES is not the service you want.
Limitations and downsides
BYOIP is the right call for a lot of teams, but it is not friction-free. The honest list:
Five ranges per Region, raised only through a Support request.
One Region at a time per block - no simultaneous multi-Region announcement of the same range.
Provisioning is not instant. Registry propagation and AWS validation make this a planned move.
You do not gain ownership. Bringing a block to AWS does not hand it to Amazon - that is the point - but a leased block equally stays the owner's. BYOIP is about routing and cost, not acquisition.
When it is not worth it. For a handful of addresses with no existing block, the setup effort outweighs the saving, and Amazon-provided addresses are simpler at that scale. BYOIP earns its keep once you are running dozens of addresses, or when IP reputation and continuity matter.
If you are weighing this against simply running elsewhere, some providers price the same block far more cheaply - our comparison of lower-cost clouds covers when moving the workload, not just the addresses, is the smarter play.
Cost math: is BYOIP worth it?
For anything at scale, the comparison is stark. Take 256 addresses - a /24 - in active use:
On Amazon-provided addresses: 256 × $3.65 = about $934 a month, or roughly $11,213 a year, metered whether the addresses are busy or idle.
On BYOIP: $0 in AWS address charges. Elastic IPs from your pool are free. Your only outlay is the lease on the block - and prevailing market rates for a /24 are a small fraction of $934 a month. Own the block already, and even that disappears.
Even after the lease, the gap is wide, and it compounds every month the addresses stay in your account. Run your own figures against current rates with the IPv4 pricing calculator.
FAQ
Does AWS charge for BYOIP addresses?
No. Addresses brought in through EC2/VPC BYOIP are exempt from the $0.005/hour public IPv4 charge, and Elastic IPs allocated from your BYOIP pool are free. The one exception is Amazon SES BYOIP, which is a separate, paid feature.
Can I bring leased IPv4 addresses to AWS?
Yes. AWS validates control of the range through the registry - a ROA authorizing Amazon's ASNs plus current RDAP records - not legal ownership. A leased /24 works fine as long as the IP owner sets up that authorization. A leasing marketplace like IPbnb handles it so the block arrives AWS-ready.
How many BYOIP ranges can I bring per Region?
Five IPv4 and IPv6 ranges per Region. For more, request a limit increase through AWS Support.
How long does BYOIP provisioning take?
AWS gives no guaranteed time. Allow up to 24 hours for the ROA to propagate, and plan for a few business days end to end once the registry records are in place. Because provisioning is asynchronous, the range must reach the provisioned state before you can advertise it.
What are the downsides of AWS BYOIP?
Chiefly the five-ranges-per-Region cap, the one-Region-at-a-time rule, and the fact that provisioning is a planned migration rather than an instant switch. For very small address needs, the setup effort may not repay itself.
