Tutorial: Set up delegated RPKI for BYOIP prefixes
This tutorial walks through all BGP route protection capabilities end to end. You can stop after any step and use what you've set up so far. Steps 1 and 2 require no RIR interaction. Steps 3 and later require a one-time setup with your RIR. For background on BGP route protection concepts, tier requirements, and supported RIRs, see Monitor BGP route protection.
Prerequisites
An IPAM created in the Advanced Tier.
One or more BYOIP prefixes provisioned to IPAM pools.
Access to your Regional Internet Registry account (ARIN, RIPE, APNIC, or LACNIC).
Step 1: View your BGP routes
Once you have BYOIP prefixes provisioned to IPAM, view all advertised routes in the centralized dashboard.
Step 2: Review route protection findings
For Advanced Tier customers, IPAM evaluates routes against published ROA data and surfaces findings with get-ipam-route-protection-findings.
Note
get-ipam-route-protection-findings requires the Advanced Tier. Free Tier
customers receive an UnsupportedOperation error.
List all findings.
aws ec2 get-ipam-route-protection-findings \ --ipam-id ipam-0a1b2c3d4e5f6g7h8Filter for invalid or missing ROAs.
aws ec2 get-ipam-route-protection-findings \ --ipam-id ipam-0a1b2c3d4e5f6g7h8 \ --filters "Name=rpki-status,Values=invalid,unknown"Filter by status in a specific Region.
aws ec2 get-ipam-route-protection-findings \ --ipam-id ipam-0a1b2c3d4e5f6g7h8 \ --filters "Name=rpki-status,Values=invalid" "Name=resource-region,Values=us-west-2"
The following is example output.
{ "IpamId": "ipam-0a1b2c3d4e5f6g7h8", "RouteProtectionFindings": [ { "ResourceOwnerId": "123456789012", "ResourceRegion": "us-west-2", "IpamPoolId": "ipam-pool-0da89c821626f1e4b", "Cidr": "203.0.113.0/24", "State": "advertised", "AdvertisementType": "regional", "NetworkBorderGroup": "us-west-2", "PoolId": "ipv4pool-ec2-0a1b2c3d4e5f6g7h8", "Asn": "64512", "RpkiStatus": "valid", "RpkiStrength": "strict", "Roas": [ { "Asn": "64512", "Prefix": "203.0.113.0/24", "MaxLength": 24, "Match": true, "Expiration": "2027-06-15T00:00:00Z" } ], "RouteOverlaps": [ { "Prefix": "203.0.113.128/25", "Asn": "64513", "DetectedAt": "2026-03-10T15:45:00+00:00" } ], "SampleTime": "2026-03-10T15:30:00+00:00", "RoaSampleTime": "2026-03-10T16:00:00+00:00" } ] }
Valid filter names are cidr, account-id,
resource-region, byoip-cidr-state,
advertisement-type, network-border-group,
ipam-pool-id, rpki-status, and asn. These
EC2-style filter names don't always match the returned fields. For example, you filter
on account-id but the response returns ResourceOwnerId, and
you filter on byoip-cidr-state but the field is State. ROA
strength is not filterable.
Step 3: Set up delegated RPKI
Delegated RPKI lets you authorize AWS to manage ROAs on your behalf.
-
Create the Internet Registry Association.
aws ec2 create-ipam-internet-registry-association --region us-east-1 \ --ipam-id ipam-0de83dba6694560a9 \ --rir ARIN --org-handle my-arin-orgThe following is example output.
{ "IpamInternetRegistryAssociation": { "IpamInternetRegistryAssociationId": "ipam-internet-registry-assoc-036486dfa6af58ee0", "State": "create-in-progress" } }Run the following command until the state reaches
pending-enable.aws ec2 describe-ipam-internet-registry-associations --region us-east-1 \ --ipam-internet-registry-association-ids ipam-internet-registry-assoc-036486dfa6af58ee0Once the state is
pending-enable, the ChildRequestXml is ready to submit to your RIR. IPAM stages ROAs based on public VRP (Validated ROA Payload) data. They're pending and will be activated once the Internet Registry Association is enabled. -
Review the staged ROAs.
aws ec2 get-ipam-route-origin-authorizations --region us-east-1 \ --ipam-internet-registry-association-id ipam-internet-registry-assoc-036486dfa6af58ee0The following is example output.
{ "Roas": [ { "prefix": "18.96.0.0/14", "asn": "77221", "maxLength": "24", "state": "pending-activate" } ] } -
Enable the Internet Registry Association.
Take the ChildRequestXml to your RIR portal and submit the delegation request. The RIR returns a parent response XML. Extract the following fields from that response: RpkiVersion, ServiceUri, ChildHandle, ParentHandle, and ParentBpkiTa. Then call the following command.
aws ec2 enable-ipam-internet-registry-association --region us-east-1 \ --ipam-internet-registry-association-id ipam-internet-registry-assoc-036486dfa6af58ee0 \ --rpki-version "..." \ --service-uri "..." \ --child-handle "..." \ --parent-handle "..." \ --parent-bpki-ta "..."The following is example output.
{ "IpamInternetRegistryAssociation": { "IpamInternetRegistryAssociationId": "ipam-internet-registry-assoc-036486dfa6af58ee0", "State": "enable-in-progress" } }Run the following command until the state reaches
enable-complete.aws ec2 describe-ipam-internet-registry-associations --region us-east-1 \ --ipam-internet-registry-association-ids ipam-internet-registry-assoc-036486dfa6af58ee0Once the state is
enable-complete, staged ROAs transition tocreate-complete. AWS now manages the ROA lifecycle for all CIDRs under this association. -
View associated CIDRs.
aws ec2 get-ipam-internet-registry-association-cidrs --region us-east-1 \ --ipam-internet-registry-association-id ipam-internet-registry-assoc-036486dfa6af58ee0The following is example output.
{ "IpamInternetRegistryAssociationCidrs": [ { "Cidr": "18.96.0.0/14", "LastObservedAt": "2026-07-30T18:00:00.000Z" } ] } -
View associated ASNs.
aws ec2 get-ipam-internet-registry-association-asns --region us-east-1 \ --ipam-internet-registry-association-id ipam-internet-registry-assoc-036486dfa6af58ee0The following is example output.
{ "IpamInternetRegistryAssociationAsns": [ { "Asn": "77221", "LastObservedAt": "2026-07-30T18:00:00.000Z" } ] }
Step 4: Provision BYOIP with automated ROA creation
With delegated RPKI active, provisioning is simplified.
| Before (without delegated RPKI) | After (with delegated RPKI) |
|---|---|
Must provide --cidr-authorization-context |
Still pass --cidr-authorization-context, but with
Message="CoveredByInternetRegistryAssociation",Signature=""
— no signed message is required |
| Must validate via WHOIS or DNS TXT record | Not required — IPAM verifies against association CIDRs |
| Must manually create ROAs at RIR before advertising | ROAs auto-created on provisioning |
| Must manually renew ROAs before expiration | AWS auto-renews — no action needed |
aws ec2 provision-ipam-pool-cidr \ --cidr 18.97.16.0/24 \ --ipam-pool-id ipam-pool-0da89c821626f1e4b \ --cidr-authorization-context Message="CoveredByInternetRegistryAssociation",Signature="" \ --region us-east-1
IPAM validates ownership through the Internet Registry Association and creates strict ROAs matching the pool's locale and ASN. There is no manual ROA step.
Step 5: Manage ROAs for on-premises prefixes
For IP space that is not brought to AWS, use routing policy registrations (RPRs).
-
Create an RPR.
aws ec2 create-ipam-routing-policy-registration --region us-east-1 \ --ipam-id ipam-0de83dba6694560a9 \ --ipam-internet-registry-association-id ipam-internet-registry-assoc-036486dfa6af58ee0 \ --cidr 18.96.0.0/14 --asns 77221,13446 \ --permit-more-specific-announcementsThe following is example output.
{ "deltaId": "0130c368-1f8c-4283-8f16-66e67e633086", "state": "PENDING" } -
Check delta status. If the change would invalidate existing routes, it fails with an error. Use
--forceto override.aws ec2 get-ipam-routing-policy-registration-deltas --region us-east-1 \ --ipam-id ipam-0de83dba6694560a9 \ --ipam-internet-registry-association-id ipam-internet-registry-assoc-036486dfa6af58ee0 \ --delta-id 0130c368-1f8c-4283-8f16-66e67e633086 -
Batch update (atomic). Batch updates succeed or fail atomically. There is no partial application.
aws ec2 batch-modify-ipam-routing-policy-registrations --region us-east-1 \ --ipam-id ipam-0de83dba6694560a9 \ --ipam-internet-registry-association-id ipam-internet-registry-assoc-036486dfa6af58ee0 \ --delta-json file://delta.jsonWhere
delta.jsoncontains the following.{ "Add": [ { "prefix": "18.96.0.0/14", "asns": ["77221", "13446"], "permit-more-specific-announcements": "false" } ], "Delete": [ { "prefix": "18.97.16.0/24", "asns": ["77221", "13446"], "permit-more-specific-announcements": "false" } ] } -
View all registrations for an association.
aws ec2 get-ipam-routing-policy-registrations --region us-east-1 \ --ipam-internet-registry-association-id ipam-internet-registry-assoc-036486dfa6af58ee0The following is example output.
{ "IpamRoutingPolicyRegistrations": [ { "Cidr": "18.96.0.0/14", "Asns": ["77221", "13446"], "PermitMoreSpecificAnnouncements": false, "MaxLength": 14, "LatestDeltaId": "0130c368-1f8c-4283-8f16-66e67e633086", "State": "create-complete" }, { "Cidr": "18.97.16.0/24", "Asns": ["77221", "13446"], "PermitMoreSpecificAnnouncements": false, "MaxLength": 24, "LatestDeltaId": "0130c368-1f8c-4283-8f16-66e67e633086", "State": "create-complete" } ] } -
Filter to a specific prefix.
aws ec2 get-ipam-routing-policy-registrations --region us-east-1 \ --ipam-internet-registry-association-id ipam-internet-registry-assoc-036486dfa6af58ee0 \ --cidr 18.96.0.0/14
Step 6: Set up CloudWatch alarms for route anomalies
IPAM publishes CloudWatch metrics for each BYOIP route to the global IPAM account.
The RoaExpiration metric is published to the AWS/IPAM
namespace with the dimensions Cidr, RoaPrefix,
Asn, and MaxLength.
| Type | Name | Description |
|---|---|---|
| Metric | RoaExpiration | Number of days until the ROA expires |
| Dimension | Asn | ASN for the prefix |
| Dimension | Cidr | CIDR brought via BYOIP |
| Dimension | MaxLength | MaxLength from the ROA |
| Dimension | RoaPrefix | Prefix from the ROA |
Because RoaExpiration reports the number of days remaining until the ROA
expires, alarm when the value drops to or below your threshold. Specify all four
dimensions to target a single ROA. Create the alarm in the same account and Region where
the metrics are published.
aws cloudwatch put-metric-alarm --region us-east-1 \ --alarm-name "IPAM-RoaExpiration-203.0.113.0-24" \ --alarm-description "Alert when the ROA for 203.0.113.0/24 is within 30 days of expiration" \ --namespace "AWS/IPAM" \ --metric-name RoaExpiration \ --dimensions Name=Cidr,Value=203.0.113.0/24 Name=RoaPrefix,Value=203.0.113.0/24 Name=Asn,Value=64512 Name=MaxLength,Value=24 \ --statistic Minimum \ --period 86400 \ --evaluation-periods 1 \ --threshold 30 \ --comparison-operator LessThanOrEqualToThreshold \ --treat-missing-data notBreaching \ --alarm-actions arn:aws:sns:us-east-1:123456789012:roa-expiry-notifications
Cleanup
To remove delegated RPKI resources:
Delete all routing policy registrations.
Disassociate the Internet Registry Association.
(Optional) Remove the authorization at your RIR portal.
Important
Deleting an Internet Registry Association removes all AWS-managed ROAs for that association. Make sure your routes have alternative ROA coverage before you disassociate.
Related resources
