Why does my Amazon VPC internet connectivity fail when I attach BYOIP to my resources?

Resolution

Note: If you receive errors when you run AWS Command Line Interface (AWS CLI) commands, then see Troubleshooting errors for the AWS CLI. Also, make sure that you're using the most recent AWS CLI version.

Troubleshoot Amazon VPC connectivity issues with Reachability Analyzer

Use Amazon VPC Reachability Analyzer to check for security group, network access control list (network ACL), and route table configurations that might cause connection issues. You can also use Reachability Analyzer to analyze paths across multiple AWS accounts in your organization. For more information, see How Reachability Analyzer works.

Troubleshoot your BYOP CIDR range

Complete the following steps:

1. Log in to the AWS account that you used to provision your BYOIP CIDR block.
2. Run the following describe-byoip-cidrs AWS CLI command to review your BYOIP configuration:

   aws ec2 describe-byoip-cidrs --max-results 5 --region example-region

   Note: Replace example-region with your AWS Region.
   -or-
   Review your BYOIP configuration in the Amazon EC2 Console.
3. Check that you correctly configured your Route Origin Authorization (ROA) and certificate. Verify that your BYOIP address range is in the Provisioned state. If your BYOIP range isn't provisioned, then provision it.
4. Run the following advertise-byoip-cidr command to advertise your address range:

   aws ec2 advertise-byoip-cidr --cidr example-address-range --region example-region

   Note: Replace example-address-range with your address range and example-region with your Region.
5. In the output, verify that your address range is in the Advertised state. Your BYOIP CIDR block must be in an Advertised state to connect to resources on the internet.

Be sure not to advertise any portion of your address range from other Regions. You can run the withdraw-byoip-cidr command to stop advertising your address range:

aws ec2 withdraw-byoip-cidr --cidr example-address-range --region example-region

Note: Replace example-address-range with your address range, and example-region with your Region.

Manually troubleshoot Amazon VPC connectivity issues

Verify that you configured your VPC's route tables to direct traffic destined for the internet through an Internet Gateway or a NAT Gateway. Then, make sure that your security groups and network ACLs allow the necessary inbound and outbound traffic to and from the internet.

For more information, see How do I troubleshoot connectivity issues between two endpoints in VPC?