AWS BYOIP in 2026: $43.80 per IPv4 vs Your Own /24

AWS BYOIP in 2026: $43.80 per IPv4 vs Your Own /24

Short answer (checked 2026-11-04): AWS charges $0.005 an hour for every public IPv4 address it provides, in use or idle: $3.65 a month, $43.80 a year per address. Addresses you bring yourself (BYOIP) carry no such charge. At the October 2026 market median (about $6,500 for a /24) a bought /24 pays for itself in about 7 months if you use all 256 addresses, and in about 36 months at 50. A leased /24 at the October 2026 average ($0.49 per IP, about $125 a month) beats AWS-provided addresses from about 35 public IPs. Below that, keep paying AWS. Market prices are dated observations; for a quote see IPv4 pricing.

What AWS charges, and what BYOIP removes

Since February 2024 AWS bills every public IPv4 address. The Amazon VPC pricing page (checked 2026-11-04) lists $0.005 per hour for an in-use address and the same $0.005 for an idle one, and says of BYOIP addresses: "These public IPv4 addresses are not charged." The page shows no free tier for public IPv4; the free tier it describes is for Amazon VPC IP Address Manager (IPAM).

A month is 730 hours in AWS billing, so:

• 1 address: $3.65 a month, $43.80 a year;
• 50 addresses: $182.50 a month, $2,190 a year;
• 256 addresses: $934.40 a month, $11,212.80 a year.

That last line matters more than it looks: after BYOIP, AWS lets you use every address of a /24, including the network and broadcast addresses (EC2 BYOIP requirements). IPAM is free for BYOIP in one Region and one account; the Advanced Tier, needed for two or more Regions or accounts, costs $0.00027 per active IP per hour, about $0.20 a month per address.

The rules AWS sets for a brought-in range

From the EC2 BYOIP documentation, checked 2026-11-04:

1. Registry. The range must be registered with ARIN, RIPE NCC or APNIC, to a business or institution, not a person. LACNIC and AFRINIC are not on the list.
2. Size. The most specific IPv4 range is a /24. You cannot bring a /25.
3. ROA. A Route Origin Authorization for Amazon's ASNs 16509 and 14618, with the maximum length equal to the range you bring (IPAM wants /24). Create a ROA for your current origin ASN first, or your existing routes can break. The European Sovereign Cloud uses ASNs 16509 and 214101 instead.
4. Proof of control. A self-signed X.509 certificate in the registry record (in RIPE: a new descr line on the inetnum, not remarks), or IPAM's DNS TXT method.
5. Reputation. AWS "might investigate the reputation" and can refuse a range with a poor history. Check a block before you buy it: see our IPv4 blacklist check.
6. Limits. Five BYOIP ranges per Region per account (more on request), one Region per range at a time. Most provisioning completes within two hours; AWS allows up to one week.

Check a range before you start: byoip_check.js

This script reads public data only (RIPEstat and RDAP, no AWS account) and answers two questions: is the prefix ready to provision, and at how many public IPs does a /24 beat AWS's price? Give it prefixes or an ASN. Save it as byoip_check.js:

// byoip_check.js - is a prefix ready for AWS BYOIP, and when does a /24 beat AWS public IPv4?
// usage: bun byoip_check.js <prefix | ASN> [prefix ...]   e.g. bun byoip_check.js AS204057
// Public data only (RIPEstat, RDAP), no AWS account needed.
const AWS_IP_HOUR = 0.005  // aws.amazon.com/vpc/pricing/, in-use or idle, checked 2026-11-04
const BUY_IP = 25.40       // ip4.market /24 90-day median per IP, 80 sales to 2026-10-26
const LEASE_IP_MONTH = 0.49 // IPv4Center all-region /24 lease average, page updated 2026-10-28
const AMAZON = [16509, 14618] // ASNs the ROA must authorize (EC2 BYOIP prerequisites)

const stat = async (call, q) =>
  (await (await fetch(`https://stat.ripe.net/data/${call}/data.json?${q}`)).json()).data

let prefixes = process.argv.slice(2)
if (prefixes.length === 1 && /^as\d+$/i.test(prefixes[0])) {
  const d = await stat('announced-prefixes', `resource=${prefixes[0]}`)
  prefixes = d.prefixes.map(p => p.prefix).filter(p => p.includes('.')).sort().slice(0, 5)
}

for (const pfx of prefixes) {
  const len = +pfx.split('/')[1]
  const rdap = await (await fetch(`https://rdap.org/ip/${pfx}`)).json().catch(() => ({}))
  const raw = JSON.stringify(rdap)
  const origins = (await stat('prefix-overview', `resource=${pfx}`)).asns.map(a => a.asn)
  const rpki = {}
  for (const asn of [...origins, ...AMAZON])
    rpki[asn] = (await stat('rpki-validation', `resource=AS${asn}&prefix=${pfx}`)).status
  const ok = len <= 24 && AMAZON.every(a => rpki[a] === 'valid') && raw.includes('BEGIN CERTIFICATE')
  console.log(`\n${pfx}  ${rdap.handle ?? '?'}  ${rdap.type ?? '?'}  ${rdap.country ?? ''}`)
  console.log(`  size /${len} (AWS takes /24 or larger): ${len <= 24 ? 'ok' : 'too small'}`)
  for (const [asn, s] of Object.entries(rpki))
    console.log(`  ROA AS${asn}${AMAZON.includes(+asn) ? ' (Amazon)' : ' (origin today)'}: ${s}`)
  console.log(`  X.509 certificate in the registry record: ${raw.includes('BEGIN CERTIFICATE') ? 'yes' : 'no'}`)
  console.log(`  ready to provision: ${ok ? 'yes' : 'no'}`)
}

// Cost: AWS-provided public IPv4 vs a /24 brought in (BYOIP addresses carry no AWS IPv4 charge)
const awsMonth = n => n * AWS_IP_HOUR * 730
const buy = 256 * BUY_IP, lease = 256 * LEASE_IP_MONTH
const usd = v => '$' + Math.round(v).toLocaleString('en-US')
console.log(`\npublic IPs | AWS per month | AWS per year | lease /24 per month | buy /24 pays back in`)
for (const n of [10, 35, 50, 100, 256])
  console.log(`${String(n).padStart(10)} | ${usd(awsMonth(n)).padStart(13)} | ${usd(awsMonth(n) * 12).padStart(12)} | ${
    (usd(lease) + (awsMonth(n) > lease ? ' (cheaper)' : ' (dearer)')).padStart(19)} | ${
    (buy / awsMonth(n)).toFixed(1).padStart(6)} months`)
console.log(`/24 to buy: ${usd(buy)} once (+ broker fee, LIR or sponsoring LIR); lease: ${usd(lease)} a month`)

bun byoip_check.js AS204057

Output, run on a DCXV Cloud server with Bun 1.4.4 on 2026-11-04 (our own AS204057; the other four prefixes gave the same result as the first):

116.204.153.0/24  116.204.153.0 - 116.204.153.255  ALLOCATED PA  CZ
  size /24 (AWS takes /24 or larger): ok
  ROA AS14618 (Amazon): invalid_asn
  ROA AS16509 (Amazon): invalid_asn
  ROA AS204057 (origin today): valid
  X.509 certificate in the registry record: no
  ready to provision: no

public IPs | AWS per month | AWS per year | lease /24 per month | buy /24 pays back in
        10 |           $37 |         $438 |       $125 (dearer) |  178.1 months
        35 |          $128 |       $1,533 |      $125 (cheaper) |   50.9 months
        50 |          $183 |       $2,190 |      $125 (cheaper) |   35.6 months
       100 |          $365 |       $4,380 |      $125 (cheaper) |   17.8 months
       256 |          $934 |      $11,213 |      $125 (cheaper) |    7.0 months
/24 to buy: $6,502 once (+ broker fee, LIR or sponsoring LIR); lease: $125 a month

Our prefixes are correctly not ready: they are announced by AS204057 only and have no Amazon ROA or certificate. invalid_asn for 16509 and 14618 is exactly what you will see before step 3, and valid is what you need after it. The price constants are dated at the top of the script: change them when you get a quote.

Buy, lease or keep paying AWS

Public IPv4 you run on AWS	Cheapest route (October 2026 prices)	Watch out for
Under about 35	Keep AWS-provided addresses	Idle Elastic IPs bill the same $0.005 an hour
About 35 to 100	Lease a /24 and bring it	The lessor must create the Amazon ROA and certificate
About 100 to 256	Buy a /24	Payback 7 to 18 months; the block stays an asset
Several Regions	Buy a /22 or larger, split it into /24s	One ROA and record can cover all of them
Leaving AWS later	Buy	The block moves with you; AWS addresses do not

The table uses the October 2026 figures from the script: an ip4.market 90-day median of $25.40 per IP over 80 /24 sales to 2026-10-26, and the IPv4Center all-region /24 lease average of $0.49 per IP per month (page updated 2026-10-28). A purchase also needs an LIR or a sponsoring LIR and a broker fee; DCXV's published fee for a /24 deal is EUR 2.00 per IP. After a RIPE transfer the block cannot be transferred again for 24 months, which does not stop you using it on AWS. Compare both paths in IPv4 lease vs buy.

Two practical points. With a lease, BYOIP only works if the lessor agrees to add Amazon's ASNs to the ROA and your certificate to the record: ask before you sign. And if you also pay for AWS support, remember it is a share of the whole bill, IPv4 charges included, as our AWS support and billing guide shows.

Where DCXV fits

DCXV brokers IPv4 in the RIPE, ARIN and APNIC regions: we can find a clean /24 for sale or lease, check its history and handle the transfer, so the ROA and certificate steps can start as soon as it is in your name. Tell us how many addresses you use on AWS and in which regions on the IPv4 desk or at ipv4@dcxv.com.