AWS vpc: Restructure IPAM public IPv4 allocation strategy doc
Summary
Reorganizes the IPAM policy allocation-strategy page: renames sections (e.g., 'When to use IPAM policies' to 'When to use allocation rules'), renumbers steps, removes inline console/CLI procedures and terminology definitions, and links out to the IPAM policies page for creation/enabling/precedence details.
Security assessment
The diff is purely editorial: section heading changes, step renumbering, and moving procedural content to a linked IPAM policies page. It concerns public IPv4 address allocation strategy, not a vulnerability, credential, encryption, or access-control fix, so no security issue is addressed.
Evidence
Allocation rules in an [IPAM policy](https://docs.aws.amazon.com/vpc/latest/ipam/ipam-policies.html) define how public IPv4 addresses from IPAM pools are allocated to AWS resources.
Diff
diff --git a/vpc/latest/ipam/define-public-ipv4-allocation-strategy-with-ipam-policies.md b/vpc/latest/ipam/define-public-ipv4-allocation-strategy-with-ipam-policies.md index 3aa1ede..78a53b3 100644 --- a//vpc/latest/ipam/define-public-ipv4-allocation-strategy-with-ipam-policies.md +++ b//vpc/latest/ipam/define-public-ipv4-allocation-strategy-with-ipam-policies.md @@ -6,0 +7,2 @@ +When to use allocation rulesHow it worksSupported services and resourcesPrerequisitesTerminologyStep 1: Add allocation rulesStep 2: Enable the policyStep 3: Test your policyStep 4: Monitor usage + @@ -9 +11 @@ -An IPAM policy is a set of rules that define how public IPv4 addresses from IPAM pools are allocated to AWS resources. Each rule maps an AWS service to IPAM pools that the service will use to get IP addresses. A single policy can have multiple rules and be applied to multiple AWS Regions. If the IPAM pool run out of addresses then the services fallback to Amazon-provided IP addresses. A policy can be applied to an individual AWS account or an entity within AWS Organizations. If you [bring your own IP (BYOIP)](https://docs.aws.amazon.com/vpc/latest/ipam/tutorials-byoip-ipam.html), this helps reduce your AWS public IPv4 costs. +Allocation rules in an [IPAM policy](https://docs.aws.amazon.com/vpc/latest/ipam/ipam-policies.html) define how public IPv4 addresses from IPAM pools are allocated to AWS resources. Each rule maps an AWS service to the IPAM pools that the service uses to get IP addresses. A single policy can have multiple rules and be applied to multiple AWS Regions. If an IPAM pool runs out of addresses, the service falls back to Amazon-provided IP addresses. If you [bring your own IP (BYOIP)](https://docs.aws.amazon.com/vpc/latest/ipam/tutorials-byoip-ipam.html), this helps reduce your AWS public IPv4 costs. @@ -11 +13 @@ An IPAM policy is a set of rules that define how public IPv4 addresses from IPAM -**When to use IPAM policies** +## When to use allocation rules @@ -13 +15 @@ An IPAM policy is a set of rules that define how public IPv4 addresses from IPAM -Use IPAM policies to: +Use allocation rules to: @@ -24 +26 @@ Use IPAM policies to: -**How it works** +## How it works @@ -26 +28 @@ Use IPAM policies to: -When you create an AWS resource that needs a public IP address in an account with IPAM policies enforced: +The following occurs when you create an AWS resource that needs a public IP address in an account with IPAM policies enforced: @@ -39 +41 @@ When you create an AWS resource that needs a public IP address in an account wit -**Supported services and resources** +## Supported services and resources @@ -58 +60 @@ If you choose a specific IPAM pool or EIP allocation ID when creating an AWS res -**Prerequisites** +## Prerequisites @@ -60 +62 @@ If you choose a specific IPAM pool or EIP allocation ID when creating an AWS res - * An [IPAM](https://docs.aws.amazon.com/vpc/latest/ipam/create-ipam.html) in the delegated administrator account with [advanced tier](https://docs.aws.amazon.com/vpc/latest/ipam/mod-ipam-tier.html) enabled + * An IPAM policy. For the IPAM requirements and how to create a policy, see [IPAM policies](./ipam-policies.html). @@ -64,4 +65,0 @@ If you choose a specific IPAM pool or EIP allocation ID when creating an AWS res - * [IAM permissions](https://docs.aws.amazon.com/vpc/latest/ipam/iam-ipam.html) for IPAM and EC2 operations - - - @@ -69 +66,0 @@ If you choose a specific IPAM pool or EIP allocation ID when creating an AWS res -**Terminology** @@ -71 +67,0 @@ If you choose a specific IPAM pool or EIP allocation ID when creating an AWS res -**IPAM policy** @@ -73,2 +69 @@ If you choose a specific IPAM pool or EIP allocation ID when creating an AWS res - -An IPAM policy is a set of rules that define how public IPv4 addresses from IPAM pools are allocated to AWS resources. Each rule maps an AWS service to IPAM pools that the service will use to get IP addresses. A single policy can have multiple rules and be applied to multiple AWS Regions. If the IPAM pool run out of addresses then the services fallback to Amazon-provided IP addresses. A policy can be applied to an individual AWS account or an entity within AWS Organizations. A policy can be applied to an individual AWS account or an entity within AWS Organizations. +## Terminology @@ -81,2 +76 @@ Optional configurations within an IPAM policy that map AWS resource types to spe -**Target** - +## Step 1: Add allocation rules @@ -84,3 +78 @@ Optional configurations within an IPAM policy that map AWS resource types to spe -An individual AWS account or an entity within an AWS Organization to which an IPAM policy can be applied. - -**Step 1: Create an IPAM policy** +After you create the policy (see [Create an IPAM policy](./ipam-policies.html#ipam-policies-create)), add allocation rules that define how IP addresses are allocated: @@ -90,30 +82 @@ An individual AWS account or an entity within an AWS Organization to which an IP -Follow these steps to create an IPAM policy using the AWS Console: - - 1. Open the IPAM console at [https://console.aws.amazon.com/ipam/](https://console.aws.amazon.com/ipam/). - - 2. In the left navigation pane, choose **Policies**. - - 3. Choose **Create policy**. - - 4. Enter a **Name** for your policy (optional). - - 5. Select the **IPAM** to associate with this policy. - - 6. (Optional) Add tags. - - 7. Choose **Create policy**. - - - - -###### Using the AWS CLI: - -Use the [create-ipam-policy](https://docs.aws.amazon.com/cli/latest/reference/ec2/create-ipam-policy.html) command. - -**Step 2: Add allocation rules** - -After creating the policy, you need to add allocation rules that define how IP addresses are allocated: - -###### Using the AWS Console: - -Follow these steps to add allocation rules using the AWS Console: +Follow these steps to add allocation rules by using the AWS Console: @@ -123 +86 @@ Follow these steps to add allocation rules using the AWS Console: - 2. Choose the policy you created in the previous step. + 2. Choose the policy that you created. @@ -152,57 +115 @@ Use the [modify-ipam-policy-allocation-rules](https://docs.aws.amazon.com/cli/la -**Step 3: Enable the policy** - -Specify which accounts should use this policy. - -###### Using the AWS Console: - -Follow these steps to enable the policy using the AWS Console: - - 1. In your policy details page, choose the **Targets** tab. - - 2. Choose **Manage policy targets**. - - 3. Do one of the following: - - * For single account usage (IPAM not integrated with AWS Organizations), choose **Enable for your account**. - - * For IPAM integrated with AWS Organizations (when you're the delegated admin): - - * In the **Organizational structure** section, select the accounts or organizational units where you want to apply this policy. - - * Check the **Enabled** checkbox for each target. - - * Choose **Save Changes**. - - * **Important** : Enabling this policy will replace any active IPAM policies on the selected accounts or organizational units. - - - - -###### Using the AWS CLI: - -Use the [enable-ipam-policy](https://docs.aws.amazon.com/cli/latest/reference/ec2/enable-ipam-policy.html) command based on your setup: - -For single account usage (IPAM not integrated with AWS Organizations): - - - aws ec2 enable-ipam-policy \ - --ipam-policy-id ipam-policy-12345678 - - -For IPAM integrated with AWS Organizations (when you're the delegated admin), set a policy to target an account in the AWS Organization: - - - aws ec2 enable-ipam-policy \ - --ipam-policy-id ipam-policy-12345678 \ - --organization-target-id 123456789012 - - -For IPAM integrated with AWS Organizations (when you're the delegated admin), set a policy to target an organizational unit: - - - aws ec2 enable-ipam-policy \ - --ipam-policy-id ipam-policy-12345678 \ - --organization-target-id ou-123 - - -###### Important +## Step 2: Enable the policy @@ -210 +117 @@ For IPAM integrated with AWS Organizations (when you're the delegated admin), se -Enabling this policy will replace any active IPAM policies on the selected accounts or organizational units. +Specify which accounts should use this policy. See [Enable an IPAM policy](./ipam-policies.html#ipam-policies-enable). If an account is in the scope of more than one enabled policy, see [Which policy applies to an account](./ipam-policies.html#ipam-policies-precedence). @@ -212 +119 @@ Enabling this policy will replace any active IPAM policies on the selected accou -**Step 4: Test your policy** +## Step 3: Test your policy @@ -220 +127 @@ If you choose a specific IPAM pool or EIP allocation ID when creating an AWS res -**Step 5: Monitor usage** +## Step 4: Monitor usage @@ -230 +137 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Move VPC CIDRs between scopes +IPAM policies @@ -232 +139 @@ Move VPC CIDRs between scopes -View allocations +Tracking IP address usage in IPAM