| IPAM admin account |
Network member account |
Management account cannot host IPAM; dedicated network ownership |
Integrate IPAM with Org |
| Stack count |
4 Terraform roots |
Credential boundary per account; RAM enable only in mgmt |
Org bootstrap |
| IPAM home region |
ap-southeast-6 |
NZ-primary workloads; home = where IPAM resource is created |
terraform -chdir=examples/multi-account/ipam output operating_regions |
| Operating regions |
ap-southeast-6 + ap-southeast-2 |
Pool locales + home region |
Same output |
| Pool hierarchy |
org → nz/au → dev/sandbox |
Regional aggregation; room for sibling pools under /12 |
Console IPAM pools |
| Root pool locale |
None on org |
Parent with locale locks all children to that region |
Pool hierarchy |
| IPAM scope |
Private only |
RFC1918 VPC pools use Private; Public stays empty |
Console scope dropdown → Private |
| CIDR plan |
/8 → /12 regional → /16 account → /20 VPC |
Non-overlapping, recognisable blocks |
ipam/main.tf in upstream clone |
| Workload regions |
dev=ap-southeast-6, sandbox=ap-southeast-2 |
Locale enforcement |
aws sts get-caller-identity per profile |
| RAM org sharing |
org-bootstrap/ (mgmt) |
Member accounts get AccessDeniedException; pools cannot be shared without org RAM |
FINDINGS.md |
| NAT gateway |
Disabled |
~$0/day idle VPC cost; not IPAM-related |
enable_nat_gateway = false in workload |
| Profiles |
ipam-org, ipam-network, ipam-workload-a/b |
One profile per account |
Prerequisites |
| Workload VPC CIDR |
ipv4_ipam_pool_id on aws_vpc |
Formal pool allocation; IPAM shows Managed VPC |
Planning → Pools → Allocations |
| Monitoring scope |
Org-wide discovery (all member accounts) |
Pool tree in ipam/main.tf does not filter discovery |
Monitoring → Resources resource count >> pool count |