Amazon’s new IPv4 fee is coming: how to sidestep it
For all the talk about the cloud driving down infrastructure costs, Amazon Web Services (AWS) recently found a way to add a new line item to your bill. Starting February 1, 2024, AWS will charge “per IP per hour for all public IPv4 addresses, whether attached to a service or not.” That adds up to at least $43 per year for every public IPv4 address you use. When you consider that AWS controls roughly 100 million IPv4 addresses — about 1.7% of the entire address space — the collective bill for the Internet could reach around $2bn per year.
That’s a steep price for something that used to be effectively free. But there are ways to avoid it, and one of them involves a transition to IPv6 with Cloudflare as an intermediary. Here’s what’s going on and how to configure your setup to dodge the charge.
Why IPv4 is suddenly expensive
IP addresses are the identifiers that let networks route traffic to the right destination — say, 198.51.100.1. The original IPv4 standard offered roughly 4.3 billion unique addresses. That sounded like a lot in the 1990s, but it ran out. In September 2015, ARIN, one of the regional Internet registries, announced it had no more IPv4 space to allocate. Since then, anyone needing IPv4 addresses has had to buy them on the private market, where prices have climbed to about $40 per address — and a minimum prefix of 256 addresses runs around $10,000.
IPv6 was designed in 1995 to solve this exact problem. By expanding the address space from 32 bits to 128 bits, IPv6 offers approximately 340 undecillion addresses — a number roughly comparable to the grains of sand on Earth. Global adoption has grown to about 46% of networks, and the performance penalty of IPv6 compared to IPv4 has shrunk to just a slight degradation, mostly due to legacy hardware and connectivity issues outside Cloudflare’s network. Many security and anti-abuse tools initially struggled with IPv6 traffic, and for some that’s still a concern.
AWS took advantage of the IPv4 shortage earlier, buying up large swaths of the dwindling address space while prices were low. Now, instead of subsidizing IPv4 usage, it’s passing the cost along to customers.
How to avoid the AWS IPv4 tax
The only true way to escape Amazon’s IPv4 charge is to stop using public IPv4 addresses on AWS and communicate with the service via IPv6 instead. That may sound like a daunting migration, and it can be: moving to IPv6 involves hardware compatibility checks, reconfiguring networks, and making sure traffic still runs smoothly.
Cloudflare’s approach is to handle the IPv6 communication with AWS on your behalf. You set up IPv6 origins, enable Cloudflare’s IPv6 Compatibility feature, and let Cloudflare’s dual-stack network bridge the gap. This way, you keep all the performance and security benefits of Cloudflare’s network — and you avoid paying Amazon for something they shouldn’t be charging for in the first place.
Configuring IPv6 origins on AWS
Before you can point Cloudflare to an IPv6 origin, you need to make sure AWS actually exposes your services over IPv6. That’s a multi-step process in the AWS console:
- Associate an IPv6 CIDR block with your VPC and subnets
- Update your route tables
- Update your security group rules
- Change your instance type
- Assign IPv6 addresses to your instances
- (Optional) Configure IPv6 on your instances
Detailed guidance is available in AWS’s own documentation for migrating a VPC to IPv6.
Enabling IPv6 on the Cloudflare side
Once your origins are reachable over IPv6, the Cloudflare configuration is straightforward:
- Log in to your Cloudflare account.
- Select the appropriate domain.
- Click the Network app.
- Make sure IPv6 Compatibility is toggled on.
Then, instead of pointing your DNS records at IPv4 addresses, add a proxied (orange-cloud) AAAA record in your Cloudflare DNS editor with the IPv6 address of your origin. If you’re using Load Balancers, update the origin addresses there. After the AAAA record is in place, you can remove the A/IPv4 records, and traffic will shift to the v6 path.
Cloudflare has offered this kind of IPv6 support since 2011, so the feature set is well established. And once you’ve had traffic running through Cloudflare to your IPv6 origin for at least six months, Cloudflare will deposit a $43 credit into your account — usable for Pro or Business subscriptions, or for Workers and R2 usage — as part of its offer to help you make the switch.
Even if the full migration to IPv6 isn’t feasible for your organization yet, the flexibility of Cloudflare’s dual-stack setup lets you manage your IPv6 settings to suit your needs, keeping connectivity seamless while cutting off an unnecessary — and increasingly costly — dependency on IPv4.
