12 ms·

IPv6 Support for Amazon S3

153 points by agwa 10y ago

kalleboo 10y ago
Great to finally see AWS start moving to IPv6! I'm sure just getting S3 to support it was a massive effort on the backend infrastructure (in all their data centers around the world - except for China apparently) and they've going to spend a lot of time looking at the new traffic and tweaking their network. I don't forsee just S3 access having a huge impact outside of Amazon though, since IPv6 has the biggest impact on end-users, and I presume most of those are hitting CloudFront, ELB or EC2 endpoints. Here's hoping CloudFront is next!
agwa 10y ago
From the documentation [http://docs.aws.amazon.com/AmazonS3/latest/dev/ipv6-access.html http://docs.aws.amazon.com/AmazonS3/latest/dev/ipv6-access.h...]: "Before EC2 (VPC) supports IPv6, we recommend that you continue using the standard IPv4-only endpoints from EC2" In other words, IPv6 in VPC is coming.
- api 10y ago
  This could finally be the tipping point for IPv6, since now all the other major cloud providers will be forced to follow suit or appear hopelessly out of date. Memes are strictly verboten here, but I'll make an exception for this: https://media.giphy.com/media/5mBE2MiMVFITS/giphy.gif https://media.giphy.com/media/5mBE2MiMVFITS/giphy.gif
  - kyledrake 10y ago
    All the other providers I use already support IPv6 and have for years. Amazon should have supported this years ago, and even now they only have tentative, incomplete support for a few of their services. It's embarrassing, frankly. I'm impressed they didn't try to charge for it, but then again, when you're marking up bandwidth egress 18x over market rate, I guess you have some room to work with.
    - IgorPartola 10y ago
      Some other providers support it. Scaleway is a fun new thing, yet their initial offering wasn't developed with IPv6 support and cannot be backed in on their old servers. DigitalOcean "supports" IPv6. In some regions. And only gives you 16 addresses per VPS to play with instead of a /64. There are many examples of this, but you see my point. People still don't think IPv6 first, so it's always a separate project to tack it back on. That's a shame because if you support just IPv6, your OS will do IPv4 to IPv6 translation for you, so that you don't have to support two stacks. (I am talking about server-side applications, not places where you need to make connections to IPv4 servers.)
      - api 10y ago
        I've found vultr.com to have solid IPv6. They give you a true /64 that can (with NDP proxying) be fully routed back into your VPS. It just works. Does DO really not give you a /64? I see prefixlen 64 on my eth0 on one of my 'droplets'.
        zAy0LfpBZLC8mAC 10y ago
        > I've found vultr.com to have solid IPv6. They give you a true /64 How is that solid IPv6? You can't even trivially subnet it! Sure, it's marginally better than the 16 address madness of other hosters, but it's still terrible. Especially so, given that you need an NDP proxy hack ... WTF?
        api 10y ago
        Does anyone actually give you a real /64? The NDP proxy hack is easy: https://github.com/DanielAdolfsson/ndppd https://github.com/DanielAdolfsson/ndppd See also: https://www.zerotier.com/community/topic/69/default-route-override-a-k-a-full-tunnel-in-1-1-6 https://www.zerotier.com/community/topic/69/default-route-ov...
        agwa 10y ago
        Yes, Linode will route /64 and /48 subnets to you. They'll even give you several of each if you ask, and the subnets can be failed over to other nodes for high availability. Linode are the only ones I have seen do IPv6 correctly. I wish they also knew how to do security correctly; unfortunately I can no longer recommend them in good conscience.
- imperalix 10y ago
  Yup, same comment in the YouTube[1] video at :33. 1. https://youtu.be/sMvrx8exfek https://youtu.be/sMvrx8exfek
scrollaway 10y ago
Finally! Some movement on IPv6. Long overdue, but it's just nice they're taking care of it. Python 3 on Lambda too, maybe? Or is that wishful thinking? https://news.ycombinator.com/item?id=12235314 https://news.ycombinator.com/item?id=12235314
- deleted 10y ago
  [deleted]
Twirrim 10y ago
Why is this being supported on an entirely new endpoint instead of added to the existing ones?
- agwa 10y ago
  It's kind of sucky, but there are a couple of good reasons for it: 1. Some people have broken IPv6 connectivity. Their OS will prefer the IPv6 address and won't fall back to the IPv4 address until after a lengthy timeout. 2. People might have IP address restrictions in place that currently only have IPv4 addresses whitelisted. If suddenly they started using IPv6 addresses they'd be blocked and their applications would break.
  - deleted 10y ago
    [deleted]
  - WorldMaker 10y ago
    (1) is the user's OS responsibility. All modern OS systems have a complex system in place already for this (using ICMP preflighting and DNS resolution timing checks and simultaneous v4/v6 connections, among other things). We're already in a world were networks have to be IPv6-first or IPv6-only (mobile networks are IPv6-first and soon likely to be IPv6-only; several large US cable ISPs have moved or are moving to IPv6-first/IPv6-only; etc), at least in the consumer world.
    - agwa 10y ago
      I agree, and furthermore the success of World IPv6 Day in 2011 showed that such breakage isn't all that common in the wild. The second point is still a real concern though.
    - saurik 10y ago
      > (1) is the user's OS responsibility. I don't care whose "responsibility" it is: if it costs my company a customer and it is something that can be fixed on my end with a seemingly simple workaround, it is something that I should fix, and I am glad that Amazon is thinking this through, particularly if it breaks an existing user when they roll out the upgrade. I mean: imagine if 0.1% of Netflix customers woke up today and the only immediate recourse Netflix has when they start being flooded with complaints is "you will need to upgrade your OS: we can no longer support whatever slightly older version you have.
garaetjjte 10y ago
https://tools.ietf.org/html/rfc2460 https://tools.ietf.org/html/rfc2460 "December 1998"
IgorPartola 10y ago
Does their website hosting thing support it yet? I currently have a site set up as: BUCKET.COM.s3-website-us-east-1.amazonaws.com Is there a dual stack version of that?
- agwa 10y ago
  No, S3 website hosting still doesn't support IPv6.
  - IgorPartola 10y ago
    Do you know why that is?
    - agwa 10y ago
      Nope, just relaying what the documentation says.
  - takeda 10y ago
    LOL, so essentially what's the benefit of it? So you can only call S3 API over v6?
throwaway01012 10y ago
About f*cking time. Google - what are you going to do about it? ;) Lest we forget: https://code.google.com/p/google-compute-engine/issues/detail?id=8 https://code.google.com/p/google-compute-engine/issues/detai... https://forums.aws.amazon.com/message.jspa?messageID=672099 https://forums.aws.amazon.com/message.jspa?messageID=672099
- ZoeZoeBee 10y ago
  If your application requires a specific protocol version, Google also provides IPv4-only, IPv6-only and dual-stack targets unaffected by the list of DNS resolvers above. The available CNAME targets are: ghs.googlehosted.com: Automatic (default) ghs4.googlehosted.com: IPv4 only ghs6.googlehosted.com: IPv6 only ghs46.googlehosted.com: IPv4 and IPv6
- profmonocle 10y ago
  Google actually supports IPv6 on Cloud Storage, which is their equivalent to S3. Neither Google or Amazon support it on VM instances yet.
  - xenadu02 10y ago
    I'll note that Azure fully supports IPv6 because it was obvious 10 years ago that building a cloud host without it was a dumb idea. Why it is taking AWS and Google so long I have no idea.
    - agwa 10y ago
      What? The Azure FAQ says: "The foundational work to enable IPv6 in the Azure environment is well underway. However, we are unable to share a date when IPv6 support will be generally available at this time." https://azure.microsoft.com/en-us/pricing/faq/ https://azure.microsoft.com/en-us/pricing/faq/
M2Ys4U 10y ago
>Now Available – IPv6 Support for Amazon S3 Yay! >S3 Feature Support – IPv6 support is available for all S3 features with the exception of Website Hosting Oh.
- josteink 10y ago
  Oh what the hell. What use is it then?
  - tedunangst 10y ago
    Image hosting.
    - josteink 10y ago
      But not IPv6 image hosting.
      - tedunangst 10y ago
        web site hosting is a distinct feature from file serving.
- djsumdog 10y ago
  Yea, it should read "IPv6 available ... for one use case .. and not the ten other ones."
jensvdh 10y ago
What about HTTP2
youdontknowtho 10y ago
Alright! Now we are talking!

153 points by agwa 10y ago

Great to finally see AWS start moving to IPv6! I'm sure just getting S3 to support it was a massive effort on the backend infrastructure (in all their data centers around the world - except for China apparently) and they've going to spend a lot of time looking at the new traffic and tweaking their network. I don't forsee just S3 access having a huge impact outside of Amazon though, since IPv6 has the biggest impact on end-users, and I presume most of those are hitting CloudFront, ELB or EC2 endpoints. Here's hoping CloudFront is next!

agwa 10y ago

From the documentation [http://docs.aws.amazon.com/AmazonS3/latest/dev/ipv6-access.html http://docs.aws.amazon.com/AmazonS3/latest/dev/ipv6-access.h...]: "Before EC2 (VPC) supports IPv6, we recommend that you continue using the standard IPv4-only endpoints from EC2" In other words, IPv6 in VPC is coming.

api 10y ago
This could finally be the tipping point for IPv6, since now all the other major cloud providers will be forced to follow suit or appear hopelessly out of date. Memes are strictly verboten here, but I'll make an exception for this: https://media.giphy.com/media/5mBE2MiMVFITS/giphy.gif https://media.giphy.com/media/5mBE2MiMVFITS/giphy.gif
- kyledrake 10y ago
  All the other providers I use already support IPv6 and have for years. Amazon should have supported this years ago, and even now they only have tentative, incomplete support for a few of their services. It's embarrassing, frankly. I'm impressed they didn't try to charge for it, but then again, when you're marking up bandwidth egress 18x over market rate, I guess you have some room to work with.
  - IgorPartola 10y ago
    Some other providers support it. Scaleway is a fun new thing, yet their initial offering wasn't developed with IPv6 support and cannot be backed in on their old servers. DigitalOcean "supports" IPv6. In some regions. And only gives you 16 addresses per VPS to play with instead of a /64. There are many examples of this, but you see my point. People still don't think IPv6 first, so it's always a separate project to tack it back on. That's a shame because if you support just IPv6, your OS will do IPv4 to IPv6 translation for you, so that you don't have to support two stacks. (I am talking about server-side applications, not places where you need to make connections to IPv4 servers.)
    - api 10y ago
      I've found vultr.com to have solid IPv6. They give you a true /64 that can (with NDP proxying) be fully routed back into your VPS. It just works. Does DO really not give you a /64? I see prefixlen 64 on my eth0 on one of my 'droplets'.
      - zAy0LfpBZLC8mAC 10y ago
        > I've found vultr.com to have solid IPv6. They give you a true /64 How is that solid IPv6? You can't even trivially subnet it! Sure, it's marginally better than the 16 address madness of other hosters, but it's still terrible. Especially so, given that you need an NDP proxy hack ... WTF?
        api 10y ago
        Does anyone actually give you a real /64? The NDP proxy hack is easy: https://github.com/DanielAdolfsson/ndppd https://github.com/DanielAdolfsson/ndppd See also: https://www.zerotier.com/community/topic/69/default-route-override-a-k-a-full-tunnel-in-1-1-6 https://www.zerotier.com/community/topic/69/default-route-ov...
        agwa 10y ago
        Yes, Linode will route /64 and /48 subnets to you. They'll even give you several of each if you ask, and the subnets can be failed over to other nodes for high availability. Linode are the only ones I have seen do IPv6 correctly. I wish they also knew how to do security correctly; unfortunately I can no longer recommend them in good conscience.
imperalix 10y ago
Yup, same comment in the YouTube[1] video at :33. 1. https://youtu.be/sMvrx8exfek https://youtu.be/sMvrx8exfek

scrollaway 10y ago

Finally! Some movement on IPv6. Long overdue, but it's just nice they're taking care of it. Python 3 on Lambda too, maybe? Or is that wishful thinking? https://news.ycombinator.com/item?id=12235314 https://news.ycombinator.com/item?id=12235314

deleted 10y ago
[deleted]

Twirrim 10y ago

Why is this being supported on an entirely new endpoint instead of added to the existing ones?

agwa 10y ago
It's kind of sucky, but there are a couple of good reasons for it: 1. Some people have broken IPv6 connectivity. Their OS will prefer the IPv6 address and won't fall back to the IPv4 address until after a lengthy timeout. 2. People might have IP address restrictions in place that currently only have IPv4 addresses whitelisted. If suddenly they started using IPv6 addresses they'd be blocked and their applications would break.
- deleted 10y ago
  [deleted]
- WorldMaker 10y ago
  (1) is the user's OS responsibility. All modern OS systems have a complex system in place already for this (using ICMP preflighting and DNS resolution timing checks and simultaneous v4/v6 connections, among other things). We're already in a world were networks have to be IPv6-first or IPv6-only (mobile networks are IPv6-first and soon likely to be IPv6-only; several large US cable ISPs have moved or are moving to IPv6-first/IPv6-only; etc), at least in the consumer world.
  - agwa 10y ago
    I agree, and furthermore the success of World IPv6 Day in 2011 showed that such breakage isn't all that common in the wild. The second point is still a real concern though.
  - saurik 10y ago
    > (1) is the user's OS responsibility. I don't care whose "responsibility" it is: if it costs my company a customer and it is something that can be fixed on my end with a seemingly simple workaround, it is something that I should fix, and I am glad that Amazon is thinking this through, particularly if it breaks an existing user when they roll out the upgrade. I mean: imagine if 0.1% of Netflix customers woke up today and the only immediate recourse Netflix has when they start being flooded with complaints is "you will need to upgrade your OS: we can no longer support whatever slightly older version you have.

garaetjjte 10y ago

https://tools.ietf.org/html/rfc2460 https://tools.ietf.org/html/rfc2460 "December 1998"

IgorPartola 10y ago

Does their website hosting thing support it yet? I currently have a site set up as: BUCKET.COM.s3-website-us-east-1.amazonaws.com Is there a dual stack version of that?

agwa 10y ago
No, S3 website hosting still doesn't support IPv6.
- IgorPartola 10y ago
  Do you know why that is?
  - agwa 10y ago
    Nope, just relaying what the documentation says.
- takeda 10y ago
  LOL, so essentially what's the benefit of it? So you can only call S3 API over v6?

throwaway01012 10y ago

About f*cking time. Google - what are you going to do about it? ;) Lest we forget: https://code.google.com/p/google-compute-engine/issues/detail?id=8 https://code.google.com/p/google-compute-engine/issues/detai... https://forums.aws.amazon.com/message.jspa?messageID=672099 https://forums.aws.amazon.com/message.jspa?messageID=672099

ZoeZoeBee 10y ago
If your application requires a specific protocol version, Google also provides IPv4-only, IPv6-only and dual-stack targets unaffected by the list of DNS resolvers above. The available CNAME targets are: ghs.googlehosted.com: Automatic (default) ghs4.googlehosted.com: IPv4 only ghs6.googlehosted.com: IPv6 only ghs46.googlehosted.com: IPv4 and IPv6
profmonocle 10y ago
Google actually supports IPv6 on Cloud Storage, which is their equivalent to S3. Neither Google or Amazon support it on VM instances yet.
- xenadu02 10y ago
  I'll note that Azure fully supports IPv6 because it was obvious 10 years ago that building a cloud host without it was a dumb idea. Why it is taking AWS and Google so long I have no idea.
  - agwa 10y ago
    What? The Azure FAQ says: "The foundational work to enable IPv6 in the Azure environment is well underway. However, we are unable to share a date when IPv6 support will be generally available at this time." https://azure.microsoft.com/en-us/pricing/faq/ https://azure.microsoft.com/en-us/pricing/faq/

M2Ys4U 10y ago

>Now Available – IPv6 Support for Amazon S3 Yay! >S3 Feature Support – IPv6 support is available for all S3 features with the exception of Website Hosting Oh.

josteink 10y ago
Oh what the hell. What use is it then?
- tedunangst 10y ago
  Image hosting.
  - josteink 10y ago
    But not IPv6 image hosting.
    - tedunangst 10y ago
      web site hosting is a distinct feature from file serving.
djsumdog 10y ago
Yea, it should read "IPv6 available ... for one use case .. and not the ten other ones."

jensvdh 10y ago

What about HTTP2

youdontknowtho 10y ago

Alright! Now we are talking!