Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AWS is estimated to make $400M to $1B with the new IPv4 charge

border0.com

Post reply on HN
Print view View original

71–79 of 79 posts

Re: AWS is estimated to make $400M to $1B with the new IPv4 charge

#71

Post by colmmacc »

mdaniel wrote: post #50
colmmacc wrote: post #47

Earlier quoted context omitted.

$ dig AAAA ec2.us-east-1.api.aws ... 2600:1f70:8000:a0:41d7:f53b:34f4:5798 The EC2 API is available over IPv6. AWS services that support IPv6 for their APIs use the .aws TLD and the SDKs and CLIs know how to invoke that when IPv6 is preferred. See https://docs.aws.amazon.com/general/latest/gr/rande.html#dua... The reason is for backwards compatibility. If IPv6 was simply added to the original names, some clients woul…

I'm not trying to shoot the messenger, but that is pretty up there in the list of dumbest things, and accompanying reason for dumb things, I've heard in quite a long time Also, I especially enjoy that control-f "iam" or "sts" on https://docs.aws.amazon.com/vpc/latest/userguide/aws-ipv6-su... is all hurp-durp as is $(dig sts.api.aws. AAAA) so I guess one should be sure to email themselves some credentials in any such…

You're not shooting the messenger. I signed off on this strategy. In our case, quite a number of customers lock down their IAM policies with IP address based permissions. They have rules like "This account can be used only from our datacenter", or "These EIPs are the only legitimate source for changes" that help them defend against credential theft. There are other defenses, but for some ... this simple defense makes sense. My understanding is that GitHub have a similar challenge, and you can see in their note at: https://docs.github.com/en/enterprise-cloud@latest/organizat...

If we turned IPv6 on like a light switch and suddenly broke all of those customers whose traffic would flip to IPv6 ... that'd be pretty bad. That's not dumb. So instead we have dedicated endpoints for IPv6 and are working with customers to get their policies updated and tested.

For IAM creds on an EC2 instance it's more common to use EC2 Instance Roles. Those are retrieved locally from the IMDS, which is available over IPv6. We have a number of customers, including some large ones, running IPv6-only on their EC2 setups.

Re: AWS is estimated to make $400M to $1B with the new IPv4 charge

#73

Post by theshackleford »

kjs3 wrote: post #62
jedberg wrote: post #61

Earlier quoted context omitted.

> You have absolutely no idea what their constraints are or what their IPv6 decision making process is. Yes I do. I've talked to them about it in depth. > But it's not "because the hardware doesn't support it"; I never said the hardware doesn't support it. I said the hardware needs upgrades to support it at their scale , which includes software updates to the hardware, as well as the operations around said hardware.…

Yes I do. I've talked to them about it in depth. Thanks for that. I needed a good chuckle after today.

And thank you as well. Everyone’s a comedian today apparently.

Re: AWS is estimated to make $400M to $1B with the new IPv4 charge

#74

Post by zokier »

fulafel wrote: post #68
luhn wrote: post #15

What's really offensive about this is that AWS does not have good enough IPv6 support for most customers to migrate off of IPv4, even if they want to. ALB uses 2-4 IPv4 addresses. It supports dualstack, but not IPv6-only. CloudFront does not support IPv6 origins. All APIs except for a handful are IPv4-only, so you either need a VPC endpoint (priced per month per AZ per API) or an IPv4 address to communicate with them…

It's also pretty ridiculous their reverse proxy (ALB) "dual stack" mode can't serve IPv6 clients unless your backend app server is also IPv6. This is so much worse than anything you'd set up yourself.

That doesn't seem right, for example this reddit thread (yeah, I know) says that ipv6 alb -> ipv4 target should work fine: https://old.reddit.com/r/aws/comments/1145bcw/dualstack_alb_...

Re: AWS is estimated to make $400M to $1B with the new IPv4 charge

#75

Post by zokier »

tormeh wrote: post #23
jedberg wrote: post #14

Earlier quoted context omitted.

The costs to AWS are having to upgrade all their routers and any other equipment that handles IP (including the management cards in each physical host).

There is no way AWS has any equipment that is not IPv6-ready. These things are replaced about every 5 years or so. I bet it's all software that assumes IPv4, which is arguably worse.

AWS is selling still M4 instances that originally date from 2015, nearly 10 years ago https://aws.amazon.com/about-aws/whats-new/2015/06/introduci...

Re: AWS is estimated to make $400M to $1B with the new IPv4 charge

#76

Post by zokier »

luhn wrote: post #15

What's really offensive about this is that AWS does not have good enough IPv6 support for most customers to migrate off of IPv4, even if they want to. ALB uses 2-4 IPv4 addresses. It supports dualstack, but not IPv6-only. CloudFront does not support IPv6 origins. All APIs except for a handful are IPv4-only, so you either need a VPC endpoint (priced per month per AZ per API) or an IPv4 address to communicate with them…

https://docs.aws.amazon.com/vpc/latest/userguide/aws-ipv6-su...

yeah, that's a sad table. AWS has gazillion services and handful have even basic dual-stack support and even fewer have ipv6-only support :(

Re: AWS is estimated to make $400M to $1B with the new IPv4 charge

#77

Post by overstay8930 »

kjs3 wrote: post #62
jedberg wrote: post #61

Earlier quoted context omitted.

> You have absolutely no idea what their constraints are or what their IPv6 decision making process is. Yes I do. I've talked to them about it in depth. > But it's not "because the hardware doesn't support it"; I never said the hardware doesn't support it. I said the hardware needs upgrades to support it at their scale , which includes software updates to the hardware, as well as the operations around said hardware.…

Yes I do. I've talked to them about it in depth. Thanks for that. I needed a good chuckle after today.

You know there are actual network engineers who've like, written IPv6 RFCs here right?

Re: AWS is estimated to make $400M to $1B with the new IPv4 charge

#79

Post by fulafel »

zokier wrote: post #74
fulafel wrote: post #68

Earlier quoted context omitted.

It's also pretty ridiculous their reverse proxy (ALB) "dual stack" mode can't serve IPv6 clients unless your backend app server is also IPv6. This is so much worse than anything you'd set up yourself.

That doesn't seem right, for example this reddit thread (yeah, I know) says that ipv6 alb -> ipv4 target should work fine: https://old.reddit.com/r/aws/comments/1145bcw/dualstack_alb_...

Like most of the people in the linked reddit thread, I read the docs (and web search results[1] and LLM answers) as requiring v6 behind the ALB too. Not taking the poster's word for it yet but could be worth another look.

[1] https://repost.aws/knowledge-center/elb-configure-with-ipv6

Post reply on HN