Self-service management of customer-owned autonomous system numbers in a cloud provider network

1 . A system, comprising:

a cloud provider network hosting a computing resource of a customer at a network address in a network address block of the customer; and

at least one computing device configured to at least:

receive a request from the customer to utilize a first autonomous system number (ASN) of the customer in the cloud provider network;

authenticate control of the customer over the first ASN based at least in part on verifying that signature data provided by the customer matches a secure certificate publicly associated with the first ASN; and

cause network traffic to be routed according to routing information that associates the network address block with the first ASN of the customer instead of a second ASN of the cloud provider network.

2 . The system of claim 1 , wherein the at least one computing device is further configured to at least authorize an account with the cloud provider network to utilize the first ASN based at least in part on an authorization request from the customer, and the network address block is associated with the account.

3 . The system of claim 1 , wherein the at least one computing device is further configured to at least verify that a route origin authorization configured with a regional internet registry authorizes the network address block to use the first ASN as an origin autonomous system.

4 . The system of claim 1 , wherein the at least one computing device is further configured to at least programmatically switch an ASN association with the network address block between the first ASN and at least one of: the second ASN or a third ASN based at least in part on one or more ASN selection rules configured for the customer.

5 . The system of claim 1 , wherein the at least one computing device is further configured to at least:

receive a request from the customer to utilize a third ASN of the customer in the cloud provider network;

authenticate control of the customer over the third ASN based at least in part on verifying that other signature data provided by the customer matches a secure certificate publicly associated with the third ASN; and

advertise routing information that associates another network address block of the customer with the third ASN of the customer instead of the second ASN of the cloud provider network.

6 . The system of claim 1 , wherein the routing information indicates that the second ASN is a transit provider for the first ASN.

7 . A computer-implemented method, comprising:

receiving a request from a customer to utilize a first autonomous system number (ASN) of the customer in a cloud provider network;

authenticating control of the customer over the first ASN based at least in part on data publicly associated with the first ASN;

authorizing an account with the cloud provider network to utilize the first ASN based at least in part on an authorization request from the customer; and

causing network traffic to be routed according to routing information that associates a network address block of the account in the cloud provider network with the first ASN of the customer instead of a second ASN of the cloud provider network.

8 . The computer-implemented method of claim 7 , further comprising updating the routing information to associate the network address block with the second ASN instead of the first ASN in response to an update request.

9 . The computer-implemented method of claim 7 , further comprising updating the routing information to associate the network address block with a third ASN of the customer instead of the first ASN in response to an update request.

10 . The computer-implemented method of claim 7 , further comprising denying an update request from the customer to associate the network address block with a different ASN based at least in part on an update frequency limit.

11 . The computer-implemented method of claim 7 , further comprising receiving a request from the account to associate the network address block with the first ASN.

12 . The computer-implemented method of claim 7 , further comprising assigning a network address from the network address block to a computing resource in the cloud provider network.

13 . The computer-implemented method of claim 7 , further comprising creating a route origin authorization with a regional internet registry to authorize the network address block to use the first ASN as an origin autonomous system.

14 . The computer-implemented method of claim 7 , wherein authorizing the account with the cloud provider network to utilize the first ASN further comprises authorizing a plurality of accounts with the cloud provider network to utilize the first ASN.

15 . The computer-implemented method of claim 7 , wherein authenticating control of the customer over the first ASN based at least in part on the cryptographic data publicly associated with the first ASN further comprises:

receiving a record for the first ASN by querying a regional internet registry;

receiving a secure certificate from a comments field of the record; and

verifying that a signature of account permission data matches the secure certificate.

16 . The computer-implemented method of claim 7 , further comprising verifying that a route origin authorization configured with a regional internet registry authorizes the network address block to use the first ASN as an origin autonomous system.

17 . A computer-implemented method, comprising:

receiving a request from a customer of a cloud provider network to utilize a first autonomous system number (ASN) of an affiliate of the customer in a cloud provider network;

authenticating control of the affiliate of the customer over the first ASN based at least in part on data publicly associated with the first ASN; and

causing network traffic to be routed according to routing information that associates a network address block of the affiliate of the customer in the cloud provider network with the first ASN, wherein a second ASN of the cloud provider network is indicated as a transit provider for the first ASN.

18 . The computer-implemented method of claim 17 , further comprising indicating in the routing information that a third ASN of the customer is a transit provider for the first ASN, wherein the second ASN is indicated as a transit provider for the third ASN.

19 . The computer-implemented method of claim 17 , wherein authenticating control of the affiliate of the customer over the first ASN based at least in part on the cryptographic data publicly associated with the first ASN further comprises:

receiving a record for the first ASN by querying a regional internet registry;

receiving a secure certificate from a comments field of the record; and

verifying that a signature matches the secure certificate.

20 . The computer-implemented method of claim 17 , further comprising adding the first ASN to an as-set object of the cloud provider network that includes the second ASN.