We're moving a customer-facing API to AWS

[soumitss]

Hi all. We're moving a customer-facing API to AWS and our security team wants our own IP space with BYOIP, so allowlists don't break when we change infrastructure. The problem: we don't own any ranges. Can you lease a clean /24 for BYOIP, or does AWS require you to be the registered holder? I'm also curious how long the whole thing takes in practice. Has anyone done this? The team uses Terraform, so I'd like to automate allocation once it's approved. Compliance wants everything documented.

[hydrogenn]

AWS will want proof that you control the range, and an LOA is the usual way to provide it. I looked at InterLIR Global, a RIPE NCC registered marketplace and broker, which lists BYOIP for cloud among its solutions alongside leasing of IPv4 from /24 upwards. They say the LOA arrives the same day after verification. Check with your cloud provider exactly which documents they accept, and plan time for registry checks and routing setup as well. For Terraform, the LOA and the BGP setup are separate steps, so automate the second only after AWS confirms the first. Document every step, the verification emails are easy to lose.