IPv6 block access: Stop leaks before March 2026

Starting March 1, 2026, hourly billing for public IPv4 addresses forces an immediate economic pivot to IPv6-only architectures. Relying solely on routing tables or Egress-only Internet Gateways provides a false sense of security when Global Unicast Addresses are involved.

AWS distinguishes between internet-routed and private prefixes, a nuance often missed in standard dual-stack configurations. Organizations can use IPAM pools to segregate traffic without incurring Elastic IP penalties.

Configuring VPC Block Public Access enforces strict boundary controls across complex multi-prefix environments. Declarative security policies prevent Internet Gateways from leaking traffic, even when misconfigured routes exist. As AWS pushes customers toward IPv6 adoption through pricing use, understanding these specific guardrails becomes mandatory rather than optional for cloud architects.

The Role of VPC Block Public Access in Modern IPv6 Defense

VPC Block Public Access acts as a declarative control that blocks internet traffic regardless of attached gateway configurations. AWS defines public IP addresses as those advertised on the internet from AWS, whereas private addresses are not and cannot be advertised on the internet from AWS. This distinction separates Global Unicast Addresses (GUA) from Unique Local Addresses (ULA) within the VPC context. Unlike IPv4 architectures requiring Elastic IP dependencies for static routing, IPv6 prefixes are inherently globally unique without extra fees. A single VPC supports up to five IPv6 CIDR block ranges to enable complex dual-stack operations.

The scale difference is massive; an IPv6 /80 prefix assigned to an Elastic Network Interface contains approximately 300 trillion individual addresses. This abundance eliminates the need for NAT strictly for address conservation purposes. However, this ubiquity creates a specific risk: any GUA prefix marked as advertisable becomes reachable unless explicitly blocked by policy. Operators must configure IPAM pools as non-advertisable by default to prevent accidental exposure. The limitation is that pool-level settings cannot be changed after creation, requiring precise initial planning. This approach ensures that even if a route to an Internet Gateway exists, the data plane remains closed until an administrator explicitly permits traffic.

Applying Defense-in-Depth with Private IPv6 Prefixes

Defense-in-depth for IPv6 combines non-advertised Unique Local Addresses with VPC Block Public Access to enforce boundaries. Assigning private IPv6 GUA within IPAM pools ensures prefixes remain withdrawn from global routing tables by default. This configuration prevents accidental exposure even if an Internet Gateway is attached later. The economic driver is clear: AWS transitions to charging for public IPv4 addresses starting March 1, 2026, making IPv6-only architectures financially superior by avoiding hourly Elastic IP fees.

Operators must distinguish between route reachability and actual traffic flow. A prefix may be technically routable yet effectively blocked by policy. Relying solely on route withdrawal creates fragility if upstream filters change. VPC Block Public Access provides the necessary declarative layer to supersede route configuration errors. The limitation is operational complexity; managing multiple withdrawn pools requires rigorous IPAM discipline. Failure to track pool attributes leads to orphaned address space. Security teams gain flexibility to advertise specific prefixes later without re-architecting the VPC. This approach secures resources while preserving the option for future public exposure.

Global Unicast vs Unique Local Addresses in AWS VPC

Global Unicast Addresses constitute routable space advertised to the public internet, whereas Unique Local Addresses remain strictly private and unrouteable outside the VPC boundary. The fundamental distinction lies in advertisement status rather than format, as AWS defines public IP addresses as those advertised on the internet from AWS. Operators managing Bring Your Own IPv6 must select between advertisable and non-advertisable IPAM pools, a decision that permanently locks the prefix behavior upon creation.

A critical operational tension exists here; choosing an advertisable pool enables future global reach but risks accidental exposure if VPC Block Public Access policies lag behind route propagation. Conversely, non-advertisable pools guarantee isolation but eliminate the option for direct internet connectivity without re-architecting the address plan.

Eliminating Elastic IP dependencies removes management overhead for static endpoints, yet this abundance introduces configuration risk. While IPv4 architectures often rely on scarce CIDR blocks necessitating strict conservation, IPv6 scale allows operators to segregate environments using distinct prefixes without address exhaustion concerns.

IPAM Pool Advertisement Mechanics and Prefix Status

A prefix configured in a non-advertisable pool always holds the status 'withdrawn' and cannot be advertised to the global internet. This immutable constraint means pool settings cannot be overridden by prefix-level configurations, locking the security posture at creation. Operators using hierarchical addressing must recognize that BYOIPv6 blocks placed in these pools remain permanently unrouteable outside AWS. Conversely, pools marked as advertisable default to a withdrawn state, requiring explicit action to change the prefix status. This design prevents accidental exposure while preserving the option for future global reachability. The operational trade-off involves flexibility versus permanence; once a pool type is selected, it cannot be altered.

Selecting an advertisable pool introduces a tension between operational agility and risk management. While this configuration allows rapid transition to public routing, it relies entirely on secondary controls like VPC Block Public Access to prevent unintended exposure during the withdrawn phase. The consequence of misconfiguration here is immediate global visibility, bypassing the safety net provided by non-advertisable architectures.

Configuring Private IPv6 Subnets with EIGW Routing

Private subnets in IPv6 require an IPv6 default route pointing to the Egress-only Internet Gateway to enable outbound connectivity while blocking inbound initiation. This configuration establishes a stateful boundary where the EIGW functions as a specialized filter distinct from traditional NAT devices. Unlike IPv4 models relying on address translation, this approach maintains end-to-end addressability without exposing internal resources to unsolicited external probes. Operators must configure the specific route table entry to direct `::/0` traffic to the gateway identifier, ensuring no public routes leak into the private segment.

IPv6 assumes a zero-trust model where every interface has a public IP, requiring explicit Security Group and NACL configurations for protection. Unlike IPv4 architectures that often rely on NAT for implicit perimeter defense, the absence of address translation in IPv6 exposes every endpoint directly to the internet unless blocked by policy. This shift demands rigorous configuration management, as documented in technical guides discussing the necessity of updating security groups and NACLs to prevent accidental traffic blocking. Relying on routing logic alone creates fragile boundaries; a single misconfigured route table can expose internal services globally.

The distinction between address types dictates the required control layer. Amazon-provided prefixes arrive advertised by default, whereas BYOIPv6 ranges in non-advertisable pools remain permanently withdrawn. Operators must verify that VPC Block Public Access sits above these routing decisions to enforce a hard deny state regardless of gateway attachment.

The hidden tension lies in operational momentum; teams accustomed to "private by default" IPv4 mentalities may treat GUA prefixes as internal until an incident proves otherwise. Even with withdrawn prefixes, the lack of NAT obscurity means any future advertisement change instantly exposes the entire subnet range without additional translation layers.

VPC BPA as a Declarative Control Superseding IGW Routes

VPC Block Public Access functions as a high-priority filter that blocks internet traffic regardless of attached IGW or EIGW routes. This declarative control supersedes standard routing tables, effectively neutralizing accidental exposure even when default routes to the internet exist. Unlike route-based logic alone, the mechanism evaluates traffic at the VPC boundary before path selection determines forwarding. Operators must configure exclusions explicitly to permit necessary flows, shifting the default state from permissive to restrictive.

1. Enable VPC Block Public Access in bidirectional mode to block all ingress and egress immediately.
2. Define granular exclusions for specific subnets requiring Egress-only Internet Gateway connectivity.
3. Validate the security posture using Network Access Analyzer to confirm no unintended public paths remain.

The trade-off is operational rigidity; enabling this control without pre-set exclusions causes immediate connectivity loss for public-facing assets. Relying solely on route tables leaves networks vulnerable to human error during updates, whereas this model enforces a zero-trust baseline by design.

Configuring Subnet Exclusions for Public-Facing IPv6 Resources

Apply VPC BPA subnet exclusions to maintain IGW routing for specific public-facing workloads while blocking all other internet traffic.

1. Enable VPC Block Public Access in bidirectional mode to immediately suppress all ingress and egress flows, effectively creating a zero-trust baseline regardless of existing route tables.
2. Define granular exclusions at the subnet level for resources requiring public reachability, ensuring only assigned IPv6 prefixes bypass the block policy.
3. Validate connectivity using Network Access Analyzer.

This configuration strategy addresses the risk where standard route tables accidentally expose private assets via an attached IGW. Unlike static routing, the exclusion model allows operators to permit egress-only traffic through an EIGW without enabling inbound initiation, a nuance detailed in VPC architecture guides. A critical analytical gap often overlooked is that exclusions apply to the resource ID, not the IP range; moving a workload to a non-excluded subnet instantly revokes its public status, creating a potential availability incident if IPAM tracking lags behind deployment. Teams adopting IPv6-only subnets must coordinate these exclusions with DNS64 resolution policies to prevent asymmetric connectivity failures.

Meanwhile, apply Service Control Policies to prevent accidental IGW attachments that bypass VPC Block Public Access constraints.

1. Deploy Service Control Policies denying `ec2:AttachInternetGateway` to enforce organizational boundaries.
2. Enable VPC flow logs to capture rejected traffic patterns for audit trails.
3. Mandate encryption in transit using VPC Encryption Controls to secure data moving between subnets.

Declarative security controls reduce human error by defining desired states rather than managing individual routes. Misconfigurations often incur indirect costs from breach remediation and auditing efforts security auditing.

Defining Advertisable vs Non-Advertised IPAM Pool Controls

Non-advertisable pools force a withdrawn status on every BYOIPv6 prefix, preventing internet routing regardless of gateway configuration. This immutable constraint means pool settings cannot be changed after creation, locking the advertisable capability permanently. Operators selecting a /56 block for private use gain no benefit from hierarchical addressing if the pool type mismatches the operational intent. The distinction dictates whether International Unicast Addresses function as reachable endpoints or isolated identifiers within the cloud boundary. This billing model applies uniformly whether the underlying pool permits external advertisement or enforces isolation.

Configuring BYOIPv6 GUA within an advertisable IPAM pool establishes a withdrawn default state that prevents internet routing until explicitly enabled. This approach uses the fact that prefixes in such pools remain non-routable by design, allowing operators to maintain globally unique addresses without exposure risk. The declarative security model ensures safety.

Operators gain granular control by separating route advertisement status from actual traffic flow permissions. A prefix may be routable on the internet yet effectively private if VPC BPA blocks all ingress and egress at the boundary. This layered defense mitigates human error where a route table modification might inadvertently expose resources. The cost of misconfiguration drops significantly when the default policy denies access regardless of gateway attachment. The limitation involves the immutability of pool settings; once created as non-advertisable, a pool cannot be converted, requiring careful initial planning. This combination creates a strong zero-trust baseline where connectivity is an explicit exception rather than an assumed capability.

Evaluating Operational Flexibility: BYOIPv6 GUA Versus Amazon-Provided GUA

Selecting BYOIPv6 over Amazon-provided ranges enables explicit control of prefix advertisements that random assignments lack. Operators bringing a /48 block gain route summarization capabilities impossible with fragmented Amazon allocations. This architectural choice supports contiguous address planning, facilitating improved route summarization across large-scale deployments. Amazon-provided GUA prefixes simplify initial setup but forfeit the ability to withdraw routes at the pool level. The cost pressure from public IPv4 pricing accelerates this migration, as enterprises seek to avoid hourly charges through IPv6-only architectures. However, BYOIPv6 introduces rigidity; pool settings defining advertisability cannot be changed after creation. This permanence demands precise upfront design to avoid rebuilding address pools later.

InterLIR recommends pairing BYOIPv6 with VPC Block Public Access to decouple routing visibility from actual traffic flow permissions. The trade-off is operational overhead; managing bring-your-own address space requires strict IPAM governance to prevent accidental exposure.