AWS vpc: Add AWS RAM pool-sharing step to IPAM allocation policy workflow
Summary
Adds a new 'Step 2: Share the pools with target accounts' section explaining that target accounts must own or be shared the pool via AWS RAM for allocation rules to apply, and renumbers subsequent steps.
Security assessment
The change documents cross-account resource sharing via AWS RAM required for IPAM allocation policies to take effect, clarifying access-control prerequisites. It is security-adjacent (resource access management) but does not address a specific vulnerability.
Evidence
+An allocation rule only specifies which pool to use. To get an address from the pool, the target account must own the pool, or you must share the pool with it by using AWS RAM. If the target account can't access the pool, the request still succeeds, but the resource gets an Amazon-provided IP address.
Diff
diff --git a/vpc/latest/ipam/define-public-ipv4-allocation-strategy-with-ipam-policies.md b/vpc/latest/ipam/define-public-ipv4-allocation-strategy-with-ipam-policies.md index 78a53b3..6ef1744 100644 --- a//vpc/latest/ipam/define-public-ipv4-allocation-strategy-with-ipam-policies.md +++ b//vpc/latest/ipam/define-public-ipv4-allocation-strategy-with-ipam-policies.md @@ -7 +7 @@ -When to use allocation rulesHow it worksSupported services and resourcesPrerequisitesTerminologyStep 1: Add allocation rulesStep 2: Enable the policyStep 3: Test your policyStep 4: Monitor usage +When to use allocation rulesHow it worksSupported services and resourcesPrerequisitesTerminologyStep 1: Add allocation rulesStep 2: Share the pools with target accountsStep 3: Enable the policyStep 4: Test your policyStep 5: Monitor usage @@ -65,0 +66,2 @@ If you choose a specific IPAM pool or EIP allocation ID when creating an AWS res + * If you enable the policy for accounts other than the pool owner, you must share the pool with those accounts by using AWS Resource Access Manager (AWS RAM). For more information, see [Share an IPAM pool using AWS RAM](./share-pool-ipam.html). + @@ -115 +117,13 @@ Use the [modify-ipam-policy-allocation-rules](https://docs.aws.amazon.com/cli/la -## Step 2: Enable the policy +## Step 2: Share the pools with target accounts + +An allocation rule only specifies which pool to use. To get an address from the pool, the target account must own the pool, or you must share the pool with it by using AWS RAM. If the target account can't access the pool, the request still succeeds, but the resource gets an Amazon-provided IP address. + +You can skip this step if you enable the policy only for the account that owns the pools in its allocation rules. + +If you enable the policy for an organization, an organizational unit (OU), or member accounts, share each pool in the allocation rules with those targets. For more information, see [Share an IPAM pool using AWS RAM](./share-pool-ipam.html). + +###### Note + +After you share a pool, wait several minutes before you test the policy. Until the share takes effect, resources might get Amazon-provided IP addresses. If you add a pool to an allocation rule later, share that pool too. + +## Step 3: Enable the policy @@ -119 +133 @@ Specify which accounts should use this policy. See [Enable an IPAM policy](./ipa -## Step 3: Test your policy +## Step 4: Test your policy @@ -127 +141 @@ If you choose a specific IPAM pool or EIP allocation ID when creating an AWS res -## Step 4: Monitor usage +## Step 5: Monitor usage