Plan and allocate IP address ranges using IPAM scopes and pools to prevent CIDR overlap and reduce the risk of IP address exhaustion.
An IPAM scope represents an independent IP address space. Create separate scopes to give different entities their own address spaces with independent management. Scopes can contain overlapping CIDR blocks.
Within a scope, create IPAM pools and provision CIDR blocks to divide usable address ranges hierarchically by region, department, or line of business.
Share planned IPAM pools with multiple business accounts so they can allocate address resources from the shared pool.
Address planning design
CIDR design for IPAM pools
IPAM pool CIDR design divides IP address space into multiple levels (such as regional, departmental, or line-of-business levels) for flexible and efficient management.
Hierarchical planning: Start by creating large regional CIDR blocks, then subdivide them for different departments or lines of business to prevent IP address conflicts. This approach lets network administrators aggregate and allocate CIDR blocks easily, simplifying network management and routing configuration.
Division logic: IPAM pool hierarchies are not limited to a single scheme. You can build multi-level, multi-region address plans organized by region, department, line of business, or product, and configure corresponding security groups, network ACLs, and firewall rules. The maximum pool depth is 10 levels.
For example, a company plans to deploy multiple core services on Alibaba Cloud, using 10.0.0.0/8 as the overall address space. The business architecture includes: multi-region deployment, multi-environment deployment per line of business (each with isolated production, staging, and testing environments), and some services requiring network interconnection. Follow the IPAM pool CIDR design approach to divide and allocate address ranges level by level.
Network planning:
Determine planning dimensions: Based on the business architecture, set the hierarchy levels as region, line of business, and environment.
Reserve expansion capacity: Regions (3 in use, 5 reserved), lines of business (6 core per region, 10 reserved), environments (production, testing, and development per line of business).
Plan CIDR blocks level by level:
Divide address space by region: To support 8 regions, you need 8 address ranges (2^3 = 8). Each regional CIDR block has a mask of
/11(/8+ 3).Allocation example:
10.0.0.0/11,10.32.0.0/11, and10.64.0.0/11are assigned to the 3 active regions, with 5 remaining blocks reserved for future use.Following the same logic, each line-of-business block uses a
/15mask (supports 16 lines of business,/11+ 4), and each environment block uses a/17mask (supports 3 environments,/15+2).
Implement address planning with IPAM:
Create a top-level pool: In the default private scope, create a top-level pool with
10.0.0.0/8.Create regional pools: Under the
10.0.0.0/8pool, create/11sub-pools for each region.Create line-of-business pools: Under each regional pool, create
/15sub-pools for each line of business.Create environment pools: Under each line-of-business pool, create
/17sub-pools for allocation. These pools can be shared with business accounts for creating VPCs, custom allocations, and more.
Isolated business environments
When business environments require independent management or stronger isolation — such as acquired companies or multi-tenant environments — create multiple private scopes to manage them separately. Each scope can have its own management policies and permission settings, and scopes can contain overlapping CIDR blocks. However, evaluate whether these environments need network interconnection. Overlapping CIDR blocks may cause conflicts on interconnected networks, so plan carefully.
For example, in an acquisition scenario where Company A acquires Company B and both have overlapping IP address ranges, create a separate scope for each company. Even with overlapping addresses, there are no conflicts within IPAM. You can use each scope to view the IP allocation picture for each company independently. With this visibility, you can design an appropriate network connectivity and routing model that keeps the merged networks running effectively while avoiding IP address conflicts.
Hybrid cloud and multi-cloud network design
In a hybrid cloud or multi-cloud architecture, create custom allocation CIDRs in your IPAM pool to reserve on-premises data center ranges and other cloud provider ranges. This ensures that reserved ranges are not allocated to other cloud resources, preventing conflicts between VPC CIDR blocks and on-premises or third-party cloud ranges.
Plan with IPAM scopes and pools
Use IPAM scopes and IPAM pools to plan usable CIDR address ranges.
After you create an IPAM, the system automatically creates a public scope and a private scope, which cannot be deleted.
Public scope: Supports allocation and use of default Alibaba Cloud IPv6 address ranges for service planning and IPv6 resource allocation.
Private scope: Supports allocation and use of IPv4 address ranges. You can create additional private scopes to independently manage separate address spaces.
Creating separate private scopes lets you give entities with overlapping address ranges their own independent IP address spaces. This is suitable for company acquisitions, multi-tenant environments, or security isolation scenarios.
Create IPAM pools and divide address ranges hierarchically by region, department, or line of business:
Provision the CIDR blocks you plan to manage into the top-level pool.
Pools in different IPAM scopes can have overlapping provisioned CIDRs. Evaluate whether environments in different scopes need network interconnection. Overlapping CIDR blocks may cause routing conflicts on connected networks — plan carefully.
Within the same scope, you can create multiple top-level pools, but their provisioned CIDRs cannot overlap.
Subdivide the top-level pool's planned CIDRs by region or line of business into multiple levels of sub-pools, ensuring each environment uses non-overlapping address ranges to avoid conflicts.
Console
Plan independent address spaces using IPAM scopes
Go to the IPAM console. In the top menu bar, select the region where you want to create the IPAM (the managed region).
Click Create IPAM. You can add additional Effective Region beyond the managed region. IPAM centrally manages address resources across all operating regions. After creation, you can add or remove operating regions, but the managed region cannot be removed.
The system creates a public scope and a private scope by default. To plan additional independent IPv4 address spaces, go to the IPAM Scope page and click Create Scope.
Create an IPAM pool to plan address ranges
Go to the IPAM console - IPAM Pool page, select the IPAM managed region at the top of the page, and click Create IPAM Pool.
IPAM Scope: Select a scope that matches the IP version you want to plan.
CIDR Range:
IPAM: Creates a top-level pool within the IPAM scope. Select this when planning address ranges for the first time.
IPAM Pool: Creates a sub-pool. Uses another pool in the IPAM as the Source IPAM Pool, from which you select CIDRs to provision into this pool. Select this when you need to further subdivide and use already-planned address ranges.
IP Version: Determined by the IPAM Scope you selected.
Public scope: IPv6 only. For the IPv6 CIDR type, select Assign BGP (Multi-ISP).
Private scope: IPv4 only.
Effective Region: Resources can only be allocated from the pool when their region matches the operating region.
The operating region must be within the IPAM's operating regions, and cannot be changed after creation.
Required when planning IPv6 address ranges. Sub-pools inherit the operating region from their source pool.
Optional when planning IPv4 address ranges. If the source pool has an operating region set, sub-pools inherit it. If the source pool has no operating region, the sub-pool's operating region must be within the IPAM's operating regions.
Automatically Import Discovered Resource: When enabled, IPAM uses resource discovery to continuously find VPCs in the operating region whose CIDR blocks fall within the pool's range and are not yet tracked in IPAM.
This parameter takes effect only when Effective Region is configured. If the pool has no Effective Region set, you cannot enable Automatically Import Discovered Resource.
If IPAM discovers multiple overlapping CIDRs, it only auto-imports the largest one.
If IPAM discovers multiple identical CIDRs, it randomly imports only one of them.
After creation, you can enable or disable auto-import on the Details tab of the pool's details page, or on the Edit page.
Provision CIDR Block: Only pools with provisioned CIDRs can allocate CIDRs to resources.
IPv6 top-level pools can only provision 1 CIDR by selecting an address mask. IPv4 top-level pools support entering address ranges and can provision multiple CIDRs.
Sub-pools can provision multiple CIDRs by entering address ranges, selecting an address mask, or using the visualization interface to select allocable portions from the source pool.
After creation, you can provision additional CIDRs on the CIDR tab of the pool's details page.
Allocation Rule: When allocating CIDRs from a pool to resources, the mask length must be between the minimum and maximum values. If no mask is specified, the default mask length is used.
For IPv6 pools, the minimum, default, and maximum mask length ranges are 0-128. For IPv4 pools, the range is 0-32.
After creation, you can modify allocation rules on the Compliance Rules tab of the pool's details page.
After a pool has provisioned CIDRs, you can create sub-pools under it or create a VPC using IPAM planning.
Deprovision a CIDR
Before deprovisioning, ensure that the CIDR has no allocations to VPCs, IPAM pools, or custom allocations. Click the target pool ID, or click Actions > Manage. On the CIDR tab, find the target CIDR and click Deprovision in the Actions column.
Delete an IPAM pool
Before deleting, ensure the pool has no sub-pools or pool allocations. When these conditions are met, you can delete the pool directly without manually deprovisioning CIDRs. In the Actions column or on the details page, click Delete.
If sub-pools exist, go to Sub-Pools > Associated Sub-Pools and delete the sub-pools.
If VPC allocations exist, go to Allocated VPCs > Associated VPCs with Allocated CIDRs and delete the corresponding VPCs.
Only IPv4 pool VPCs can be deleted directly from the dialog. For IPv6 pools, go to the VPC details page and delete the VPC after confirming there is no business impact, which releases the allocation.
If custom allocations exist, go to Custom Allocations > Associated Custom Address Allocations and delete the custom allocations.
Delete an IPAM scope
The two default scopes cannot be deleted. For custom scopes, click Delete in the Actions column or on the details page. Before deleting, ensure all IPAM pools under the scope have been deleted.
Delete an IPAM
Before deleting, ensure all IPAM pools and custom scopes have been deleted. In the Actions column or on the details page, click Delete.
API
Plan independent address spaces using IPAM scopes
Call OpenVpcIpamService to activate IPAM.
Call CreateIpam to create an IPAM.
Call CreateIpamScope to create a private IPAM scope.
Create an IPAM pool and provision CIDRs
Call CreateIpamPool to create an IPAM pool.
Call AddIpamPoolCidr to provision a CIDR block to the pool.
Clean up resources
Call DeleteIpamPoolCidr to deprovision a CIDR block from a pool.
Call DeleteIpamPool to delete an IPAM pool.
Call DeleteIpamScope to delete a custom IPAM scope.
Call DeleteIpam to delete an IPAM.
Terraform
Resources: alicloud_vpc_ipam_service, alicloud_vpc_ipam_ipam, alicloud_vpc_ipam_ipam_scope, alicloud_vpc_ipam_ipam_pool, alicloud_vpc_ipam_ipam_pool_cidr
# Specify the region where you want to create the IPAM
provider "alicloud" {
region = "cn-hangzhou"
}
# Activate the IPAM service (required on first use)
resource "alicloud_vpc_ipam_service" "example_ipam_service" {
}
# Create an IPAM
resource "alicloud_vpc_ipam_ipam" "example_ipam" {
ipam_name = "example_ipam_name"
operating_region_list = ["cn-hangzhou"] # Specify the IPAM's operating regions
}
# Create an IPAM scope
resource "alicloud_vpc_ipam_ipam_scope" "example_ipam_scope" {
ipam_scope_name = "example_ipam_scope_name"
ipam_id = alicloud_vpc_ipam_ipam.example_ipam.id
ipam_scope_type = "private" # Private scope
}
# Create an IPAM pool
resource "alicloud_vpc_ipam_ipam_pool" "example_parentIpamPool" {
ipam_scope_id = alicloud_vpc_ipam_ipam_scope.example_ipam_scope.id # Specify the IPAM scope
ipam_pool_name = "example_parentIpamPool_name"
pool_region_id = alicloud_vpc_ipam_ipam.example_ipam.region_id # Specify the pool's operating region
ip_version = "IPv4" # Specify the IP version
}
# Provision a CIDR block to the pool
resource "alicloud_vpc_ipam_ipam_pool_cidr" "example_ipamPoolCidr" {
cidr = "10.0.0.0/16" # Specify the CIDR
ipam_pool_id = alicloud_vpc_ipam_ipam_pool.example_parentIpamPool.id # Specify the pool ID
}
# Create an IPAM sub-pool
resource "alicloud_vpc_ipam_ipam_pool" "example_childIpamPool" {
ipam_pool_name = "example_childIpamPool_name"
ipam_scope_id = alicloud_vpc_ipam_ipam_scope.example_ipam_scope.id # Specify the IPAM scope
pool_region_id = alicloud_vpc_ipam_ipam.example_ipam.region_id # Specify the pool's operating region
source_ipam_pool_id = alicloud_vpc_ipam_ipam_pool.example_parentIpamPool.id # Specify the source pool ID
ip_version = "IPv4" # Specify the IP version
}
# Provision a CIDR block to the sub-pool
resource "alicloud_vpc_ipam_ipam_pool_cidr" "example_childIpamPoolCidr" {
cidr = "10.0.0.0/24" # Specify the CIDR
ipam_pool_id = alicloud_vpc_ipam_ipam_pool.example_childIpamPool.id # Specify the pool ID
}Share planned pools across multiple accounts
Network administrators can share created pools with business accounts (pool consumers). Business accounts can use shared pools to allocate addresses for VPCs or create custom allocations.
Share with any Alibaba Cloud account: The consumer must accept the resource sharing invitation.
Share within a Resource Directory: The consumer does not need to confirm — the invitation is automatically accepted.
Console
This section describes sharing a pool with any Alibaba Cloud account. To share within a Resource Directory, see Share resources with objects in a resource directory.
Share an IPAM pool
Log in as the pool owner. Go to the IPAM console - IPAM Pool page, select the region of the target pool at the top. Click the target pool ID or click Actions > Manage. On the Sharing Management tab, click Create Resource Share.
On the Create Resource Share page, follow the wizard to configure resource sharing.
Set Resources to IPAM Pool, then select the IPAM pool to share.
The associated permission for IPAM pool resources is
AliyunRSDefaultPermissionIpamPool.Set Principal Scope to Sharing with All Accounts. Set Method to Add Manually. Enter the Alibaba Cloud account ID of the pool consumer and click Add.
Verify the configuration and click Confirm.
Log in as the pool consumer and accept the sharing invitation:
Go to the Resource Sharing - Shared with Me page in the Resource Management console.
In the top menu bar, select the region where the shared resource is located. Click Accept in the Status column of the target resource share.
After the share is accepted, the consumer can view the pool on the IPAM Pool page under the Pools Shared with Me tab, and can use the pool to Use IPAM to plan and create a VPC or Use IPAM to plan and create a VPC.
Stop sharing
Log in as the pool owner. On the IPAM Pool details page, go to the Sharing Management tab, click the target resource share to open its details page, and select Delete Resource Share.
After sharing is stopped, the consumer can no longer view the pool. However, existing address allocations created from the shared pool are not affected. When the consumer deletes a VPC, the corresponding pool allocation is released.
The pool owner can still manage pool allocations, including releasing VPC-type allocations and custom allocations created by the consumer.
API
Share an IPAM pool
Method 1: Share with any account
Using the pool owner's credentials, call CreateResourceShare to create a resource share. Set
AllowExternalTargetstoTrue.Using the consumer's credentials, call ListResourceShareInvitations to retrieve the resource sharing invitation, then call AcceptResourceShareInvitation to accept it.
Method 2: Share within a Resource Directory only
Using the Resource Directory management account's credentials, call EnableSharingWithResourceDirectory to enable resource sharing within the directory.
Using the pool consumer's credentials, call CreateResourceShare to create a resource share. Set
AllowExternalTargetstoTrue.
Stop sharing
Using the pool owner's credentials, call DeleteResourceShare to delete the resource share.
Terraform
Terraform does not currently support sharing IPAM pools.
More information
Billing
IPAM is in public preview and free to use during this period.
Quota limits
Quota name | Description | Default limit | Adjustable |
ipam_quota_per_region | IPAMs per user per region | 1 | No |
ipam_scope_quota_per_ipam | IPAM scopes per IPAM | 5 | |
ipam_pool_quota_depth | Maximum pool hierarchy depth | 10 | |
ipam_cidr_quota_per_ipam_pool | Provisioned CIDRs per pool | 50 | |
ipam_sub_pool_quota_per_ipam_pool | Sub-pools per pool | 50 | |
ipam_pool_quota_per_scope | Pools per private IPAM scope | 500 | |
resource_share_quota_per_ipam_pool | Resource shares per pool | 100 | |
shared_ipam_pool_quota_per_user | Shared pools per user | 100 | |
ipam_public_ipv6_top_pool_quota_per_region_isp | Public IPv6 top-level pools per ISP type per region | 1 | |
ipam_cidr_quota_per_public_ipv6_top_pool | Provisioned CIDRs per public IPv6 top-level pool per region | 1 |