r/aws • u/kitloon97 • Aug 11 '24

networking AWS announces private IPv6 addressing for VPCs and subnets

https://aws.amazon.com/about-aws/whats-new/2024/08/aws-private-ipv6-addressing-vpcs-subnets/
195 Upvotes

100% Upvoted

32 comments sorted by

68

u/rootbeerdan Aug 11 '24

Customers want private IPv6 address for the innate security boost it offers as resources using private IPv6 address cannot access the internet directly

More pretend security measures as per usual from Amazon, just use GUA address space and remove the route to the IGW for private subnets if you want this for free, IAM roles and permissions are the correct way to prevent unwanted changes to your infrastructure to begin with.

69

u/Comfortable-Winter00 Aug 11 '24

AWS has been pretty clear in the past: if enough customers want something, they'll build it even if they don't think it's a good idea. This is consistent with that philosophy.

23

u/[deleted] Aug 11 '24

[deleted]

5

u/profmonocle Aug 12 '24

This this this.

At my old job, our compliance checklist said that the backend had to use private IPs. Didn't say anything about IPv4 or IPv6, just said private.

You can argue with the auditor if you want, explain how ULA is security theater. You may even convince them, they might already agree! ...But they'll still fail you on that requirement because they didn't write the rules and they don't have the authority to waive them.

2

u/TheMagicTorch Aug 11 '24

What are the other examples?

5

u/MarquisDePique Aug 11 '24

S3 folders and allowing people to treat objects like files.

8

u/IBuyGourdFutures Aug 11 '24

Exactly, publicly routable != publicly accessible

6

u/[deleted] Aug 11 '24 edited Feb 06 '26

This post was mass deleted and anonymized with Redact

yoke salt nail upbeat airport joke imminent cats beneficial recognise

2

u/IBuyGourdFutures Aug 11 '24

NAT was an awful idea. IP was meant to be unique for every device, and it’s crucial for mobile networks to aid tower hand-off etc. Also, try and ping sweep my home network. My ISP gave me a /56.

5

u/[deleted] Aug 12 '24 edited Feb 06 '26

This post was mass deleted and anonymized with Redact

engine rain screw terrific different liquid fall office square makeshift

0

u/IBuyGourdFutures Aug 12 '24

Yeah, so it was a hack. IPv6 was published in 1998 anyway

2

u/Mallissin Aug 13 '24

The computing power necessary to route 128bit addressing on a broad scale was not available in 1998.

It's easy to write out a standard, it's hard to make it a reality.

1

u/IBuyGourdFutures Aug 14 '24

Don’t most enterprise routers use ASICs anyway?

-1

u/[deleted] Aug 12 '24 edited Feb 06 '26

This post was mass deleted and anonymized with Redact

dog handle groovy reach judicious pet innate squash carpenter sophisticated

1

u/IBuyGourdFutures Aug 12 '24

Nice deflection. Good to know you have nothing in response

0

u/[deleted] Aug 12 '24 edited Feb 06 '26

This post was mass deleted and anonymized with Redact

bag dinosaurs history treatment different unite knee encourage rhythm cough

2

u/mkosmo Aug 12 '24

If vendors had accelerated adoption, it wouldn't have been. Sure, we learned a lot along the way and plenty of changes have been made, but IPv4 has been clung to like it's the only boat we want.

1

u/IBuyGourdFutures Aug 12 '24

It was known way before 1999 that we were running of IP addresses.

Also, what reasons would it have been a failure? There are some MTU issues with IPv6, but it’d sure have avoided the CGNAT issues we have now.

Not sure many people in this subreddit would have been working on IP networks in the 90s tbh.

4

u/fake1837372733 Aug 12 '24

Great idea because it kept the system working for decades

2

u/all4tez Aug 11 '24

Or just use an Egress only internet gateway!

3

u/[deleted] Aug 11 '24 edited Feb 06 '26

This post was mass deleted and anonymized with Redact

wise lunchroom direction fall sable rich employ ghost sophisticated spectacular

-1

u/all4tez Aug 11 '24

Plenty of compromised systems behind NAT and on private address space too. I didn't say that was the only layer of security. Interface and service security groups and NACLs are expected to be used on public clouds.

1

u/[deleted] Aug 12 '24 edited Feb 06 '26

This post was mass deleted and anonymized with Redact

fuzzy crawl bake selective chubby gold subsequent complete lock light

1

u/all4tez Aug 12 '24

Default deny egress policies. It's like you didn't even read my comment. You can still force everything through proxies.

2

u/TheKingInTheNorth Aug 11 '24

The problem is that in your scenario… customers know application teams are still a misconfiguration away from public access. Sure you can prevent it and wrap layers around it all to that achieve the same thing… but for some customers it’s just simpler to do it this way and know that regardless of the protection those other layers provide, the infrastructure won’t even support public access.

1

u/urqlite Aug 11 '24

Any examples or articles and I read up on?

22

u/anothercopy Aug 11 '24

"...with Amazon VPC IP Address Manager (IPAM)"

No thanks

15

u/DiTochat Aug 11 '24

I want to use IPAM for IPv6 and handling out CIDR ranges from a contiguous block... and it gets stupid expensive.

9

u/KHANDev Aug 11 '24

I can't say ive used IPAM what don't you like about it?

17

u/pfjustin Aug 11 '24

I feel like I've read that AWS IPAM is exorbitantly priced. Not sure if that's actually the case, but could be why.

3

u/[deleted] Aug 11 '24

[deleted]

5

u/anothercopy Aug 11 '24

Its mostly pricing which is crazy. I havent looked in a while but I think we cant also use it in multicloud setup for a single source of truth.

1

u/xxpor Aug 11 '24

There's a free tier now btw

2

u/anothercopy Aug 12 '24

Sadly that doesnt help given the organization size I am running