AWS vpc: Note that OU exclusions override IPAM policy targets
Summary
Added a note explaining that organizational unit exclusions also apply to IPAM policies, so a policy does not apply to accounts covered by an OU exclusion even if listed as targets.
Security assessment
IPAM policies govern IP address allocation/scope across accounts; clarifying that OU exclusions take precedence over policy targets prevents administrators from assuming a policy is enforced on excluded accounts, which is an authorization-scope concern.
Evidence
+Organizational unit (OU) exclusions also apply to IPAM policies. A policy doesn't apply to accounts that an OU exclusion covers, even if the policy specifies those accounts as targets. Before you choose policy targets, review your OU exclusions. For more information, see [Exclude organizational units from IPAM](./exclude-ous.html).
Diff
diff --git a/vpc/latest/ipam/ipam-policies.md b/vpc/latest/ipam/ipam-policies.md index 465cc98..a37b773 100644 --- a//vpc/latest/ipam/ipam-policies.md +++ b//vpc/latest/ipam/ipam-policies.md @@ -60,0 +61,4 @@ A policy applies only to accounts in the delegated administrator's own organizat +###### Note + +Organizational unit (OU) exclusions also apply to IPAM policies. A policy doesn't apply to accounts that an OU exclusion covers, even if the policy specifies those accounts as targets. Before you choose policy targets, review your OU exclusions. For more information, see [Exclude organizational units from IPAM](./exclude-ous.html). +