3 ms·
Yep, lots of AWS apis don't work over ipv6, and many require making requests outside the VPC, so you need to have at least one ipv4 address for a NAT.
by thayne 2y ago
Yep, lots of AWS apis don't work over ipv6, and many require making requests outside the VPC, so you need to have at least one ipv4 address for a NAT.
- cyberax 2y agoYou can use NAT64, it works with all the AWS services. Although it's pretty stupid that services like ECR don't have IPv6.
- thayne 2y agoNAT64 requires you to have a NAT with a public ipv4 address. Or possibly pay to use someone elses NAT.
- cyberax 2y agoAWS supports NAT64 automatically if you have an Internet gateway attached, you just need to set it up in the VPC settings.
- thayne 2y agohttps://docs.aws.amazon.com/vpc/latest/userguide/nat-gateway-nat64-dns64.html https://docs.aws.amazon.com/vpc/latest/userguide/nat-gateway... Says you need to have an AWS NAT for that to work. And AFAIK, setting up a NAT requires an ipv4 elastic ip. And it makes since that AWS would want customers to have their own IP for NAT64, so that if one customer does something to get the ip address blocklisted it doesn't impact other customers.
- cyberax 2y agoYes, you're correct. Though I don't think AWS cares too much about IP blocklist, you can always just get another elastic IP at any moment.