“A BGP-based feature of the AWS Direct Connect service allowed a third party to inject an incorrect route for an external IP assigned to me, effectively hijacking my AWS-sourced traffic.”
Another AWS customer typo’d the third octet of a test prefix, and EC2 egress to Finnigan’s server got routed into their network and dropped. AWS skipped RPKI on Direct Connect because of “the increased burden” on users, and its ownership check failed. AWS fixed the process and published no security bulletin. One customer’s typo cut a stranger’s server off from EC2 in multiple regions, and AWS called it a process issue.