Virtual Private Cloud:Address resource management

Restrict CIDR block allocation from an IPAM pool

In a multi-account environment, CIDR block conflicts often arise when business accounts independently create VPCs with private CIDR blocks. To prevent arbitrary allocation, you can use a management account to create a control policy and attach it to a folder or member. This policy restricts business accounts to allocating VPC CIDR blocks only from shared IPAM pools. IPAM ensures that the allocated CIDR blocks do not overlap, preventing address conflicts when you connect VPCs.

A control policy applies to all RAM users and RAM roles of the members in a Resource Directory but not to the root users of the member accounts. In addition, the management account of a Resource Directory is external to the Resource Directory and does not belong to it.

{
  "Statement": [
    {
      "Action": [
        "vpc:CreateVpc",
        "vpc:AssociateVpcCidrBlock"
      ],
      "Resource": "*",
      "Effect": "Deny",
      "Condition": {
        "Null": {
          "vpc:Ipv4IpamPoolId": "true"
        }
      }
    }
  ],
  "Version": "1"
}

{
  "Statement": [
    {
      "Action": [
        "vpc:CreateVpc"
      ],
      "Resource": "*",
      "Effect": "Deny",
      "Condition": {
        "StringNotEquals": {
          "vpc:Ipv4IpamPoolId": "ipam-pool-0123456789abcdefg"
        }
      }
    },
    {
      "Action": [
        "vpc:CreateVpc"
      ],
      "Resource": "*",
      "Effect": "Deny",
      "Condition": {
        "Null": {
          "vpc:Ipv4IpamPoolId": "true"
        }
      }
    }
  ],
  "Version": "1"
}

{
  "Statement": [
    {
      "Action": [
        "vpc:CreateVpc",
        "vpc:AssociateVpcCidrBlock"
      ],
      "Resource": "*",
      "Effect": "Deny",
      "Condition": {
        "ForAllValues:StringNotLikeIfExists": {
          "vpc:Ipv4IpamPoolId": "ipam-pool-0123456789abcdefg"
        }
      }
    }
  ],
  "Version": "1"
}

Manage addresses with resource discovery

Resource discovery continuously discovers and tracks the address utilization of VPC and vSwitch CIDR blocks within the Effective Region. After you associate a resource discovery with an IPAM instance, the IPAM instance centrally manages the discovered CIDR blocks.

1. By default, the operating region of a resource discovery is the same as the region of the IPAM instance and cannot be modified.

2. Resource discovery is updated every 5 minutes.

• When you create an IPAM instance, the system creates a default resource discovery and associates it with the IPAM instance. VPC CIDR blocks that meet the following rules are automatically imported into the corresponding IPAM pool for centralized management.

  • Only unallocated CIDR blocks that are within the provisioned CIDR range of an IPAM pool are imported.

  • CIDR blocks are imported only into the IPAM pools for which Automatically Import Discovered Resource is enabled in the default scope.

  • If multiple discovered CIDR blocks overlap, IPAM imports only the largest CIDR block.

  • If multiple identical CIDR blocks are discovered, IPAM randomly imports one of them.

• If no IPAM instance is created, you can create a custom resource discovery to track the address utilization of VPC and vSwitch CIDR blocks. After you create an IPAM instance in the managed region, the custom resource discovery is automatically converted into a default resource discovery.

# Specify a region where no IPAM instance is created and a custom resource discovery can be created.
provider "alicloud" {
  region = "cn-shanghai"
}

resource "alicloud_vpc_ipam_ipam_resource_discovery" "example_ipam_resource_discovery" {
  operating_region_list               = ["cn-shanghai"]     # Specify the operating region of the IPAM resource discovery.
  ipam_resource_discovery_name        = "example_ipam_resource_discovery_name"
}

Centralized management with shared resource discovery

If business accounts use unplanned CIDR blocks to create resources, address conflicts may occur. A network administrator can associate an IPAM instance with a resource discovery that is shared by a business account to centrally manage resources across multiple accounts and resolve address conflicts.

Both default and custom resource discoveries can be shared.

The operating regions of a shared resource discovery and the network administrator's IPAM instance can be different, but their managed regions (creation regions) must be the same. If the operating regions are different, the following rules apply:

• The resource owner (the business account in this example) and the network administrator can manage and view all resources within the operating regions of the resource discovery.

• After the network administrator associates the resource discovery with an IPAM instance, the administrator can manage only the resources within the operating regions of the IPAM instance.

View IP information of discovered resources

You can use resource discovery to view the details of all used private IPv4 addresses within discovered VPCs and vSwitches. The details include the IP address, resource ID, the region to which the resource belongs, and the cloud service type. This helps you gain a comprehensive understanding of address utilization in your network.

You can query IP information only for VPCs and vSwitches managed by a resource discovery.

• You can filter by VPC ID, vSwitch ID, or CIDR block. You can specify any valid IPv4 CIDR block, including a /32 CIDR block to match a specific IP address. The CIDR block must be used in combination with a VPC ID or vSwitch ID.

• The following query combinations are supported: VPC ID only, vSwitch ID only, VPC ID + CIDR, vSwitch ID + CIDR, and VPC ID + vSwitch ID + CIDR.

Usage notes

Only the IPAM delegated administrator of the Resource Directory can perform operations for the IPAM trusted service. The organization administrator or other members cannot perform these operations.

• Delegate an administrator: A Resource Directory supports only one delegated administrator for the IPAM trusted service. The delegated administrator account must be a member account of the Resource Directory and cannot be the management account of the organization.

• Manage members: 

  • When the IPAM delegated administrator adds a member, the IPAM trusted service is enabled for the resource directory. When all members are removed, the IPAM trusted service is disabled.

  • To manage members by using an IPAM instance in a different region, you must first remove all members from the current instance and then add them to the new one.

  • The IPAM delegated administrator cannot manage the root node or the root folder of the Resource Directory as a member.

  • Member accounts managed by an IPAM instance cannot share their own resource discoveries with the IPAM delegated administrator.

  • If you reach the member account quota for the IPAM trusted service, any new accounts added to a managed folder in the Resource Directory will not be managed by the service.

• Revoke delegation: When the IPAM delegated administrator removes all managed members, you can delete the delegated administrator account or revoke the delegation.

Monitor address utilization

Monitor address utilization to promptly scale up resources that have high utilization.

• To monitor the address utilization of an IPAM pool, go to the IPAM console - IPAM Pools page and click the ID of the target IPAM pool.

  • On the Details tab, you can view the number of available IP addresses in the IPAM pool and the number of IP addresses that are allocated to resources and sub-pools. If the IPAM pool is a sub-pool, you can also view the address utilization of both the sub-pool and its source pool.

  • On the IP Usage and Allocate tabs, you can view the allocation details of the IPAM pool.

• To monitor the address utilization of VPCs and vSwitches:

  • Go to the IPAM console - Resource Discovery page. Click the ID of the target resource discovery to view the CIDR blocks and address utilization of all VPCs and vSwitches within the operating regions.

  • Go to the IPAM console - IPAM Scopes page and click the ID of the target scope.

    • On the Resource Management tab, you can view the CIDR blocks and address utilization of VPCs and vSwitches within this scope. Click the ID of a VPC or vSwitch to view its address utilization.

    • On the Monitoring Chart tab, you can use line charts to monitor the address utilization of VPCs and vSwitches within this scope over time.

Monitor address overlaps

Monitor address overlaps to proactively identify and resolve address conflicts in your network. This prevents access conflicts during network interconnection.

Go to the IPAM console - IPAM Scopes page and click the ID of the target scope.

• On the Resource Management tab, you can view the overlap status of VPC and vSwitch CIDR blocks within the current scope. If any CIDR blocks overlap, click View in the Overlap Status (Overlapping) column to view the details of the conflicting instances.

• On the Monitoring Chart tab, the line charts allow you to monitor the number of overlapping CIDR blocks in this scope over time.

Monitor CIDR block management and compliance

Go to the IPAM console - IPAM Scopes page and click the ID of the target scope. On the Overview, Resource Management, and Monitoring Chart tabs, you can check whether a resource's CIDR block is managed by an IPAM pool and whether it complies with the pool's allocation rules.

Billing

IP Address Manager (IPAM) is in public preview and is free of charge during the preview period.

Quotas