Virtual Private Cloud:Manage address resources

Restrict CIDR allocation from IPAM pools

In a multi-account enterprise, if business accounts can randomly allocate private CIDR blocks when they create VPCs, address conflicts may occur when the VPCs are interconnected. To prevent this issue, you can use a management account to create a control policy and attach the policy to a folder or a member. This way, business accounts can allocate CIDR blocks to VPCs only from shared IPAM pools. IPAM ensures that the allocated CIDR blocks do not overlap. This prevents address conflicts when VPCs are interconnected.

Control policies take effect on all RAM users and RAM roles within members in a resource directory, but not on the root users of the members. The management account of a resource directory is not a member of the resource directory. Therefore, control policies do not take effect on any identities of the management account.

{
  "Statement": [
    {
      "Action": [
        "vpc:CreateVpc",
        "vpc:AssociateVpcCidrBlock"
      ],
      "Resource": "*",
      "Effect": "Deny",
      "Condition": {
        "Null": {
          "vpc:Ipv4IpamPoolId": "true"
        }
      }
    }
  ],
  "Version": "1"
}

{
  "Statement": [
    {
      "Action": [
        "vpc:CreateVpc"
      ],
      "Resource": "*",
      "Effect": "Deny",
      "Condition": {
        "StringNotEquals": {
          "vpc:Ipv4IpamPoolId": "ipam-pool-0123456789abcdefg"
        }
      }
    },
    {
      "Action": [
        "vpc:CreateVpc"
      ],
      "Resource": "*",
      "Effect": "Deny",
      "Condition": {
        "Null": {
          "vpc:Ipv4IpamPoolId": "true"
        }
      }
    }
  ],
  "Version": "1"
}

{
  "Statement": [
    {
      "Action": [
        "vpc:CreateVpc",
        "vpc:AssociateVpcCidrBlock"
      ],
      "Resource": "*",
      "Effect": "Deny",
      "Condition": {
        "ForAllValues:StringNotLikeIfExists": {
          "vpc:Ipv4IpamPoolId": "ipam-pool-0123456789abcdefg"
        }
      }
    }
  ],
  "Version": "1"
}

Manage addresses with resource discovery

Resource discovery continuously discovers and tracks the IP utilization of VPC and VSwitch CIDR blocks in the Effective Region. After the discovered address ranges are associated with IPAM, IPAM centrally manages them.

1. By default, the applicable regions of a resource discovery are the same as those of the associated IPAM instance and cannot be modified.

2. Resource discoveries are updated every 5 minutes.

• When you create an IPAM instance, a default resource discovery is created and associated with the IPAM instance. VPC CIDR blocks that meet the following rules are automatically imported into the corresponding pools for centralized management:

  • Only unallocated CIDR blocks that are within the range of the CIDR blocks provisioned for a pool are imported.

  • Only IPAM pools that have Automatically Import Discovered Resource enabled in the default scope are imported.

  • If multiple discovered CIDR blocks overlap, IPAM imports only the largest CIDR block.

  • If multiple identical CIDR blocks are discovered, IPAM randomly imports one of them.

• If no IPAM instance is created, you can create a custom resource discovery to track the IP utilization of VPC and vSwitch CIDR blocks. After an IPAM instance is created in the home region, the custom resource discovery is automatically converted into a default resource discovery.

# Specify a region where no IPAM instance is created and you can create a custom resource discovery.
provider "alicloud" {
  region = "cn-shanghai"
}

resource "alicloud_vpc_ipam_ipam_resource_discovery" "example_ipam_resource_discovery" {
  operating_region_list               = ["cn-shanghai"]     # Specify the applicable regions of the IPAM resource discovery.
  ipam_resource_discovery_name        = "example_ipam_resource_discovery_name"
}

Centralized management with shared resource discovery

Address conflicts may occur if a business account uses an unplanned CIDR block to create resources. To resolve address conflicts, a network administrator can associate an IPAM instance with a resource discovery shared by the business account to centrally manage resources across multiple accounts.

Both default and custom resource discoveries can be shared.

The applicable regions of a shared resource discovery and the associated IPAM instance can be different, but their home regions (creation regions) must be the same. If their applicable regions are different:

• The resource owner (the business account in this example) and the network administrator can manage and view all resources in the applicable regions of the resource discovery.

• After the network administrator associates the resource discovery with an IPAM instance, the administrator can manage only the resources in the applicable regions of the IPAM instance.

Scope

Only the delegated administrator of IPAM can perform operations on the trusted service of IPAM. The administrator of the resource directory or other members cannot perform operations on the trusted service.

• Delegate an administrator: You can delegate only one member of a resource directory as the delegated administrator for the trusted service of IPAM. The management account of the resource directory cannot be specified as the delegated administrator.

• Manage members:

  • After the delegated administrator of IPAM adds members, the trusted service of IPAM is enabled for the resource directory. If all members are removed, the trusted service of IPAM is disabled.

  • The delegated administrator of IPAM can select an IPAM instance in only one region to manage the members of a resource directory. If you want to use an IPAM instance in another region to manage accounts, you must remove all members from the IPAM instance in the current region, go to the multi-account management page of the IPAM instance in the other region, and then add members.

  • The delegated administrator of IPAM cannot manage the root folder of a resource directory or the resources in the root folder as a member.

  • Member accounts managed by IPAM cannot share their resource discovery with the IPAM delegated administrator.

  • If the number of member accounts that are managed by the trusted service of IPAM reaches the quota and a new member account is added to a managed folder in the resource directory, the new member account is not managed by the trusted service of IPAM.

• Remove a delegated administrator: After all managed members are removed by the delegated administrator of IPAM, you can delete the delegated administrator account or remove the delegated administrator.

Monitor address utilization

You can monitor address utilization to scale out resources that have high utilization in a timely manner.

• Monitor the address utilization of an IPAM pool: Go to the IPAM console - IPAM Pools page and click the ID of the destination pool.

  • On the Details tab, you can view the number of available IP addresses in the IPAM pool and the number of IP addresses allocated to resources and sub-pools. If the target IPAM pool is a sub-pool, you can also view the address utilization of the current pool and the source IPAM pool.

  • On the IP Usage and Allocate tabs, you can view the allocation details of the IPAM pool.

• Monitor the address utilization of VPCs and vSwitches:

  • Go to the IPAM console - Resource Discovery page and click the ID of the destination resource discovery. You can view the CIDR blocks and IP utilization of all VPCs and vSwitches in the applicable regions.

  • Go to the IPAM console - IPAM Scopes page and click the ID of the destination scope.

    • On the Resource Management tab, you can view the CIDR and address utilization of VPCs and VSwitches within this scope. Click the ID of the target VPC or VSwitch to view the IP usage.

    • On the Monitoring Chart tab, you can use a line chart to monitor the address utilization of VPCs and VSwitches within the specified scope over time.

Monitor address overlaps

You can monitor address overlaps to proactively identify and resolve address conflicts in network connections. This ensures that access conflicts do not occur during network interconnection.

Go to the IPAM console - IPAM Scopes page and click the ID of the destination scope.

• On the Resource Management tab, you can view overlaps between the CIDR blocks of VPCs and VSwitches within the scope. If CIDR blocks overlap, you can click Overlap Status (Overlapping) > View to view the specific instances that conflict with the current resource.

• On the Monitoring Chart tab, you can view a line chart that displays the number of overlapping CIDRs within the specified scope over time.

Monitor management and compliance status

Go to IPAM console - IPAM scope and click the target scope ID. On the Overview, Resource Management, and Monitoring Chart tabs, you can view whether the CIDR block of a resource is allocated from an IPAM pool (that is, whether it is managed) and whether it complies with the allocation rules of the IPAM pool (that is, whether it is compliant).

Billing

The IP Address Manager (IPAM) feature is in public preview. You can use this feature for free during the public preview.

Quotas