Hi Sebastian. Failover of the devices will work without Internet access. The standby device will become active at the time of failover. However, if you'd like to have an AWS route automatically updated with an API call (which can be easily set up with the HA iApp), then you'll need the BIG-IP to be able to make an HTTPS connection to the (public) AWS API endpoint. The alternative would be to script this route update yourself for your failover scenario. Does that make sense?