Architecture and Troubleshooting: A Guide to AWS Peering#

Chitiz Shrestha - Amazon Web Services (AWS)

• Why: Useful for anyone interconnecting with AWS — which spans the PM's DC/WAN interconnect interest — as it explains how AWS actually runs and troubleshoots peering, and what will break maintenance operations on their side.
• What: AWS's peering operation explained: AS16509 (public peering), 14618, 7224 (Direct Connect); selective, IX-centric peering (175 IXs, 189 interconnection facilities); regional route scoping — peers receive region-specific routes to localize traffic and keep it off the AWS backbone. Capability matrix: AS-path prepending is their primary TE; RPKI/ROA filtering yes; MD5 optional; BFD and BGP communities not supported. Operational content: common issues (link errors, discards, session flapping, non-optimal paths); auto-mitigation with the caveat that "taking the wrong action can be worse than taking no action"; the maintenance workflow (drain via BGP filtering / IGP metric poisoning before work); a hard rule that peers must not static-route to AWS (it breaks their zero-traffic-then-deploy model); and self-service diagnostics — the EC2 reachability checker (first triage step: if the test host is reachable, the problem is WAF/security groups, not peering), RIPE Atlas probes hosted on EC2 (reverse traces, since AWS has no looking glass), and NLNOG Ring nodes. Provisioning is portal-automated (interconnect.amazon with PeeringDB auth) with pre-deployment checks (RPKI validation, no private ASN, stable sessions) and auto-disconnect of dead sessions.
• How: Explanation of their internal model plus concrete self-service tooling a peer can use before escalating.
• Where applicable: Only relevant if you peer or interconnect with AWS. It is a hyperscaler explaining its own operational contract — informative context, not a transferable technique.