AWS Wavelength Zones use a special construct similar to an internet gateway called a carrier gateway. This is how traffic will route to/from the MNO’s network to EC2 instances or containers you attach to the subnets in your AWS Wavelength Zone:

Figure 7.5 – Creating a carrier gateway for an AWS Wavelength Zone

Routing tables

When using Wavelength Zones, it is best to have a different route table in the VPC from the one the public subnets in the parent region are attached to. This is so that only resources in the Wavelength Zones have their non-VPC traffic routed directly onto the MNO’s network instead of out of the usual internet gateway:

Figure 7.6 – Route table defaulting to a carrier gateway

Once a carrier gateway exists, set the default route (0.0.0.0/0) to point to it within the relevant route table(s). Note that there is only ever one carrier gateway per VPC:

Figure 7.7 – Deploying an EC2 instance with a carrier IP

Once the subnets and routes are configured, you can begin deploying compute resources into a Wavelength Zone. Unlike EC2 instances in standard AZs, instances deployed into one of these special zones can assign a carrier IP at deploy time. It is essentially the same thing as a public IP in a region, only it is specifically drawn from the MNO’s IP space. That’s how traffic goes directly to them. Note that you cannot assign standard public IPs to resources in Wavelength Zones.

It is important to understand that only subscribers on a given MNO’s network can access a carrier IP. For example, in the next diagram, only Verizon customers can reach 141.195.196.252 or 141.195.196.95. Subscribers on other networks or devices on the general internet will get timeouts if they attempt to reach those IPs:

Figure 7.8 – Ingress from Verizon network to AWS Wavelength Zones