cloud.punk blog

The Route Nobody Signed: What AWS's New RPKI Automation Actually Fixes

In 2018, a hijacked BGP announcement redirected Amazon's own DNS traffic long enough for real cryptocurrency to change hands, because nothing on the internet could cryptographically ask whether the hijacker was allowed to originate that prefix. Amazon VPC IPAM's new delegated RPKI automates the fix for BYOIP customers: AWS now creates, renews, and monitors Route Origin Authorizations at the Regional Internet Registries so nobody has to remember to.

One Firewall, Two Modes: What AWS's Rebuilt Egress Proxy Actually Fixes

AWS launched a standalone egress-proxy preview at re:Invent 2025, then quietly rebuilt it eight months later as a mode inside AWS Network Firewall itself. The redesign isn't cosmetic — no-source-preservation mode is the first documented way to centralise egress filtering across VPCs with overlapping CIDR blocks, a problem plain NAT Gateway and Transit Gateway routing can't solve.

BGP Inside the VPC: What Amazon VPC Route Server Actually Changes

For years, keeping a self-managed NAT instance or firewall appliance highly available inside a VPC meant a health-check script rewriting route tables through the EC2 API. AWS's own case study on how ad-tech firm Magnite pushed Amazon VPC Route Server into production shows what changes once BGP, not a script, is the thing deciding your route tables.

The Private Origin Trap: What CloudFront's VPC Origins Outage Actually Broke

On 16 July 2026 a single AWS fleet failed to load a routing-config update and every CloudFront distribution using VPC Origins went dark for three and a half hours — Canvas, Blackboard and Hugging Face included. The lesson isn't 'don't hide your origin'; it's that hiding it moves you onto a control plane you don't operate.

The Empty VPC: Client VPN Finally Speaks Native Transit Gateway

Every mature AWS estate has one: a VPC that exists only to host Client VPN ENIs, quietly rewriting every remote user's source IP on the way in. AWS has made it unnecessary — and given security teams their IPs back.

Understanding AWS Direct Connect BGP Communities

Understanding AWS Networking Interfaces: EFA, ENA, and ENI - A Guide to Making the Right Choice

RDMA: Revolutionising Cloud Network Infrastructure in AWS and Azure

Maximise Your Network's Uptime: Discover Best AS-Path Prepending Tactics for AWS Direct Connect

Network Segmentation with AWS Transit Gateway

The Future of General AI and Networking: A Potential Symbiotic Relationship

A Basic Introduction to Border Gateway Protocol (BGP)

Demystifying TCP: Understanding the Fundamentals of Reliable Network Communication

Introduction to Cloud Networking, benefits, Services, Security and more.

Real-World Cloud Talk: An Interview with a Microsoft Sr. Cloud Solution Architect - March 31st 2022