AWS vpc: IPAM service role policy: statement descriptions and new IAM actions
Summary
Replaces the inline JSON of the AWSIPAMServiceRolePolicy managed policy with per-statement descriptions (IPAMDiscoveryDescribeActions, CloudWatchMetricsPublishActions, IPAMAllocationPolicyActions, PrefixListResolverWrite/ReadActions, IPAMDhcpOptionSetManagementActions) and links to the AWS Managed Policy Reference, and adds changelog entries for newly added permissions: DHCP option set management (ec2:DescribeDhcpOptions, CreateDhcpOptions, AssociateDhcpOptions, DeleteDhcpOptions), Route 53 hosted zone reads, ec2:GetIpamDiscoveredRoutes, CloudFront anycast IP list reads, and ec2:AllocateIpamPoolCidr.
Security assessment
The diff documents the exact IAM permissions granted to the IPAM service-linked role managed policy, including newly added write actions (ec2:CreateDhcpOptions, ec2:AssociateDhcpOptions, ec2:DeleteDhcpOptions, ec2:AllocateIpamPoolCidr) and read actions across Route 53 and CloudFront. This is IAM permission/least-privilege documentation with direct security impact (visibility into what the service role can do), but there is no evidence it fixes a specific vulnerability or incident.
Evidence
+AWSIPAMServiceRolePolicy | Actions added to the AWSIPAMServiceRolePolicy managed policy (ec2:DescribeDhcpOptions, ec2:CreateDhcpOptions, ec2:AssociateDhcpOptions, and ec2:DeleteDhcpOptions) to let IPAM create, associate, and delete the DHCP option sets that it manages for IPAM policy DHCP rules. | October 15, 2026
Diff
diff --git a/vpc/latest/ipam/iam-ipam-managed-pol.md b/vpc/latest/ipam/iam-ipam-managed-pol.md index c17a3f4..f18db01 100644 --- a//vpc/latest/ipam/iam-ipam-managed-pol.md +++ b//vpc/latest/ipam/iam-ipam-managed-pol.md @@ -17,72 +17,14 @@ This managed policy enables IPAM to do the following: - * Monitor CIDRs associated with networking resources across all members of your AWS Organization. - - * Store metrics related to IPAM in Amazon CloudWatch, such as the IP address space available in your IPAM pools and the number of resource CIDRs that comply with allocation rules. - - * Modify and read managed prefix lists. - - - - -The following example shows the details of the managed policy that's created. - -JSON - - -**** - - - - { - "Version":"2012-10-17", - "Statement": [ - { - "Sid": "IPAMDiscoveryDescribeActions", - "Effect": "Allow", - "Action": [ - "ec2:DescribeAccountAttributes", - "ec2:DescribeAddresses", - "ec2:DescribeByoipCidrs", - "ec2:DescribeIpv6Pools", - "ec2:DescribeManagedPrefixLists", - "ec2:DescribeNetworkInterfaces", - "ec2:DescribePublicIpv4Pools", - "ec2:DescribeSecurityGroups", - "ec2:DescribeSecurityGroupRules", - "ec2:DescribeSubnets", - "ec2:DescribeVpcs", - "ec2:DescribeVpnConnections", - "ec2:GetIpamDiscoveredAccounts", - "ec2:GetIpamDiscoveredPublicAddresses", - "ec2:GetIpamDiscoveredResourceCidrs", - "ec2:GetManagedPrefixListEntries", - "ec2:ModifyManagedPrefixList", - "globalaccelerator:ListAccelerators", - "globalaccelerator:ListByoipCidrs", - "organizations:DescribeAccount", - "organizations:DescribeOrganization", - "organizations:ListAccounts", - "organizations:ListDelegatedAdministrators", - "organizations:ListChildren", - "organizations:ListParents", - "organizations:DescribeOrganizationalUnit" - ], - "Resource": "*" - }, - { - "Sid": "CloudWatchMetricsPublishActions", - "Effect": "Allow", - "Action": "cloudwatch:PutMetricData", - "Resource": "*", - "Condition": { - "StringEquals": { - "cloudwatch:namespace": "AWS/IPAM" - } - } - } - ] - } - - -The first statement in the preceding example enables IPAM to monitor the CIDRs used by your single AWS account or by the members of your AWS Organization. - -The second statement in the preceding example uses the `cloudwatch:PutMetricData` condition key to allow IPAM to store IPAM metrics in your `AWS/IPAM` [Amazon CloudWatch namespace](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/cloudwatch_concepts.html). These metrics are used by the AWS Management Console to display data about the allocations in your IPAM pools and scopes. For more information, see [Monitor CIDR usage with the IPAM dashboard](./monitor-cidr-usage-ipam.html). + * Monitor CIDRs associated with networking resources across all members of your AWS Organization, including public IP addresses used by Global Accelerator and CloudFront, and DNS records in Route 53 hosted zones that resolve to those IP addresses (statement `IPAMDiscoveryDescribeActions`). + + * Store metrics related to IPAM in Amazon CloudWatch, such as the IP address space available in your IPAM pools and the number of resource CIDRs that comply with allocation rules (statement `CloudWatchMetricsPublishActions`). The `cloudwatch:PutMetricData` condition key restricts this to your `AWS/IPAM` [Amazon CloudWatch namespace](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/cloudwatch_concepts.html). These metrics are used by the AWS Management Console to display data about the allocations in your IPAM pools and scopes. For more information, see [Monitor CIDR usage with the IPAM dashboard](./monitor-cidr-usage-ipam.html). + + * Allocate CIDRs from your IPAM pools when enforcing IPAM policy allocation rules (statement `IPAMAllocationPolicyActions`). For more information, see [Define public IPv4 allocation strategy with IPAM policies](./define-public-ipv4-allocation-strategy-with-ipam-policies.html). + + * Modify and read managed prefix lists (statements `PrefixListResolverWriteActions` and `PrefixListResolverReadActions`). For more information, see [Automate prefix list updates with IPAM](./automate-prefix-list-updates.html). + + * Create, associate, and delete the DHCP option sets that IPAM manages for IPAM policy DHCP rules (statement `IPAMDhcpOptionSetManagementActions`). IPAM does not modify or delete DHCP option sets that you create. + + + + +To view the current JSON policy document, version history, and ARN for this policy, see [AWSIPAMServiceRolePolicy](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSIPAMServiceRolePolicy.html) in the _AWS Managed Policy Reference_. @@ -95,0 +38,3 @@ Change | Description | Date +AWSIPAMServiceRolePolicy | Actions added to the AWSIPAMServiceRolePolicy managed policy (ec2:DescribeDhcpOptions, ec2:CreateDhcpOptions, ec2:AssociateDhcpOptions, and ec2:DeleteDhcpOptions) to let IPAM create, associate, and delete the DHCP option sets that it manages for IPAM policy DHCP rules. | October 15, 2026 +AWSIPAMServiceRolePolicy | Actions added to the AWSIPAMServiceRolePolicy managed policy (route53:ListHostedZones, route53:GetHostedZone, route53:ListResourceRecordSets, and route53:ListTagsForResource) to let IPAM read DNS records in Route 53 hosted zones during resource discovery. | October 15, 2026 +AWSIPAMServiceRolePolicy | Action added to the AWSIPAMServiceRolePolicy managed policy (ec2:GetIpamDiscoveredRoutes) to let IPAM get routes during resource discovery for BGP route protection monitoring. | September 9, 2026 @@ -96,0 +42,2 @@ AWSIPAMServiceRolePolicy | Actions added to the AWSIPAMServiceRolePolicy manage +AWSIPAMServiceRolePolicy | Actions added to the AWSIPAMServiceRolePolicy managed policy (cloudfront:ListAnycastIpLists, cloudfront:ListDistributionsByAnycastIpListId, and cloudfront:ListTagsForResource) to let IPAM discover BYOIP CIDRs used by CloudFront anycast IP lists. | October 23, 2025 +AWSIPAMServiceRolePolicy | Action added to the AWSIPAMServiceRolePolicy managed policy (ec2:AllocateIpamPoolCidr) to let IPAM allocate CIDRs from IPAM pools when enforcing IPAM policy allocation rules. | October 23, 2025