Virtual Private Cloud:Manage addresses

Restrict VPC CIDR block allocation

In a multi-account environment, CIDR block conflicts often arise when business accounts independently create VPCs with private CIDR blocks. To restrict arbitrary allocation, you can use a management account to create a control policy and attach it to a folder or member. This policy restricts business accounts to allocating VPC CIDR blocks only from shared IPAM pools. IPAM ensures that the allocated CIDR blocks do not overlap, which prevents address conflicts when you connect VPCs.

Control policies apply to all Resource Access Management (RAM) users and RAM roles of members in a resource directory, but not to the root users of the member accounts. The management account is not a member of a resource directory. Therefore, control policies do not apply to any identities within the management account.

{
  "Statement": [
    {
      "Action": [
        "vpc:CreateVpc",
        "vpc:AssociateVpcCidrBlock"
      ],
      "Resource": "*",
      "Effect": "Deny",
      "Condition": {
        "Null": {
          "vpc:Ipv4IpamPoolId": "true"
        }
      }
    }
  ],
  "Version": "1"
}

{
  "Statement": [
    {
      "Action": [
        "vpc:CreateVpc"
      ],
      "Resource": "*",
      "Effect": "Deny",
      "Condition": {
        "StringNotEquals": {
          "vpc:Ipv4IpamPoolId": "ipam-pool-0123456789abcdefg"
        }
      }
    },
    {
      "Action": [
        "vpc:CreateVpc"
      ],
      "Resource": "*",
      "Effect": "Deny",
      "Condition": {
        "Null": {
          "vpc:Ipv4IpamPoolId": "true"
        }
      }
    }
  ],
  "Version": "1"
}

{
  "Statement": [
    {
      "Action": [
        "vpc:CreateVpc",
        "vpc:AssociateVpcCidrBlock"
      ],
      "Resource": "*",
      "Effect": "Deny",
      "Condition": {
        "ForAllValues:StringNotLikeIfExists": {
          "vpc:Ipv4IpamPoolId": "ipam-pool-0123456789abcdefg"
        }
      }
    }
  ],
  "Version": "1"
}

Manage addresses using resource discovery

Resource discovery continuously monitors the IP address usage of VPC and vSwitch CIDR blocks within the Effective Region. After you associate a resource discovery with an IPAM instance, the instance centrally manages the discovered CIDR blocks.

1. The effective region of a default resource discovery is the same as the region of the IPAM instance and cannot be modified.

2. Resource discovery is updated every 5 minutes.

• When you create an IPAM instance, the system creates a default resource discovery and associates it with the IPAM instance. VPC CIDR blocks that meet the following rules are automatically imported into the corresponding address pool for unified management:

  • Only unallocated CIDR blocks that are within the provisioned CIDR block of the address pool are imported.

  • CIDR blocks are imported only into address pools in the default scope where Automatically Import Discovered Resource is enabled.

  • If multiple discovered CIDR blocks overlap, IPAM imports only the largest CIDR block.

  • If multiple identical CIDR blocks are discovered, IPAM randomly imports one of them.

• If no IPAM instance is created, you can create a custom resource discovery to track the IP address usage of VPC and vSwitch CIDR blocks. If an IPAM instance is later created in the managed region, the custom resource discovery is automatically converted into a default resource discovery.

# Specify a region where no IPAM instance is created and a custom resource discovery can be created.
provider "alicloud" {
  region = "cn-shanghai"
}

resource "alicloud_vpc_ipam_ipam_resource_discovery" "example_ipam_resource_discovery" {
  operating_region_list               = ["cn-shanghai"]     # Specify the applicable region of the IPAM resource discovery.
  ipam_resource_discovery_name        = "example_ipam_resource_discovery_name"
}

Use shared resource discovery for unified address management

If business accounts use unplanned CIDR blocks to create resources, address conflicts can occur. A network administrator can associate an IPAM instance with a resource discovery shared by a business account to centrally manage resources across multiple accounts and resolve address conflicts.

Both default and custom resource discoveries can be shared.

The applicable region of a shared resource discovery and the applicable region of the network administrator's IPAM instance can be different, but their managed regions must be the same. If the applicable regions are different:

• The resource owner (business account in this example) and the network administrator can manage and view all resources within the applicable region of the resource discovery.

• After the network administrator associates the resource discovery with an IPAM instance, the administrator can manage only the resources within the applicable region of the IPAM instance.

Scope

The IPAM trusted service only supports operations by the IPAM delegated administrator of the resource directory. The organization administrator or other members cannot perform these operations.

• Delegating an administrator: A resource directory supports only one delegated administrator for the IPAM trusted service. The delegated administrator account must be a member of the resource directory and cannot be the management account of the organization.

• Managing members: 

  • When the IPAM delegated administrator adds a member, the IPAM trusted service is enabled for the resource directory. When all members are removed, the IPAM trusted service is disabled.

  • An IPAM delegated administrator can use an IPAM instance in only one region to manage resource directory members. To use an IPAM instance in a different region, you must first remove all members from the current IPAM instance. Then, you must add the members to the IPAM instance in the new region.

  • The IPAM delegated administrator cannot manage the root node or the root folder of the resource directory as a member.

  • Member accounts managed by IPAM cannot share their own resource discoveries with the IPAM delegated administrator.

  • If the number of member accounts managed by the IPAM trusted service reaches the quota and you add more member accounts to a managed folder in the resource directory, the new accounts that exceed the quota are not managed by the IPAM trusted service.

• Revoking delegation: When the IPAM delegated administrator removes all managed members, the delegated administrator account can be deleted or the delegation can be revoked.

Monitor address utilization

Monitor address utilization to promptly scale out resources that have high utilization.

• To monitor the address utilization of an IPAM pool, go to the IPAM console - IPAM Pools page and click the ID of the target IPAM pool.

  • On the Details tab, you can view the number of available IP addresses in the IPAM pool and the number of IP addresses that are allocated to resources and sub-pools. If the IPAM pool is a sub-pool, you can also view the address utilization of both the sub-pool and its source pool.

  • On the IP Usage and Allocation tabs, you can view the allocation details of the IPAM pool.

• Monitor the address utilization of VPCs and vSwitches:

  • Go to the IPAM console - Resource Discovery page. Click the ID of the target resource discovery to view the CIDR blocks and IP address usage of all VPCs and vSwitches within the applicable scope.

  • Go to the IPAM console - IPAM Scopes page and click the ID of the target scope.

    • On the Resource Management tab, you can view the CIDR blocks and IP address usage of VPCs and vSwitches within this scope. Click the ID of a VPC or vSwitch to view its IP address usage.

    • On the Monitoring Chart tab, you can use line charts to monitor the address utilization of VPCs and vSwitches within this scope over time.

Monitor address overlaps

Monitor address overlaps to proactively identify and resolve address conflicts in your network. This prevents access conflicts during network interconnection.

Go to the IPAM console - IPAM Scopes page and click the ID of the target scope.

• On the Resource Management tab, you can view the overlap status of VPC and vSwitch CIDR blocks within the current scope. If any CIDR blocks overlap, click View in the Overlap Status column to view the details of the conflicting instances.

• On the Monitoring Chart tab, the line charts allow you to monitor the number of overlapping CIDR blocks in this scope over time.

Monitor the management status and compliance of CIDR blocks

Go to the IPAM console - IPAM Scopes page and click the ID of the target scope. On the Overview, Resource Management, and Monitoring Chart tabs, check whether a resource's CIDR block is managed by an IPAM pool and complies with the pool's allocation rules.

Billing

IPAM is in public preview. It is free of charge during the public preview period.

Quotas