AWS vpc: Reorganized IPAM policies documentation and terminology
Summary
Restructured the IPAM policies topic, moved terminology earlier, retitled the page, and moved create/enable procedures to a separate managing policies page.
Security assessment
The diff is a documentation reorganization and terminology cleanup for IPAM policies; it does not address a specific vulnerability or add security-specific guidance.
Evidence
+# Understanding IPAM policies
Diff
diff --git a/vpc/latest/ipam/ipam-policies.md b/vpc/latest/ipam/ipam-policies.md index a37b773..6559f71 100644 --- a//vpc/latest/ipam/ipam-policies.md +++ b//vpc/latest/ipam/ipam-policies.md @@ -7 +7 @@ -PrerequisitesWhere a policy appliesTerminologyWhich policy applies to an accountCreate an IPAM policyEnable an IPAM policy +TerminologyWhere a policy appliesWhich policy applies to an account @@ -9 +9 @@ PrerequisitesWhere a policy appliesTerminologyWhich policy applies to an account -# IPAM policies +# Understanding IPAM policies @@ -11 +11 @@ PrerequisitesWhere a policy appliesTerminologyWhich policy applies to an account -An IPAM policy is a set of rules that IPAM applies to AWS resources when they are created in the accounts that the policy targets. You define the rules once, enable the policy for your organization, for organizational units, or for individual accounts, and IPAM applies the rules without any action in the member accounts. +An Amazon VPC IP Address Manager (IPAM) policy is a set of rules that IPAM applies to AWS resources when they are created in the accounts that the policy targets. You define the rules once, enable the policy for your organization, for organizational units, or for individual accounts, and IPAM applies the rules without any action in the member accounts. @@ -13 +13 @@ An IPAM policy is a set of rules that IPAM applies to AWS resources when they ar -This topic describes the concepts and procedures that are common to all IPAM policies: prerequisites, how IPAM decides which policy applies to an account, and how to create and enable a policy. The kinds of rules that you can define in a policy are described in the following topics. +This section describes the concepts and procedures that are common to all IPAM policies: prerequisites, how IPAM decides which policy applies to an account, and how to create and enable a policy. The kinds of rules that you can define in a policy are described in the following topics. @@ -15 +15 @@ This topic describes the concepts and procedures that are common to all IPAM pol -###### Contents +###### Topics @@ -17 +17 @@ This topic describes the concepts and procedures that are common to all IPAM pol - * Prerequisites + * Terminology @@ -21,2 +20,0 @@ This topic describes the concepts and procedures that are common to all IPAM pol - * Terminology - @@ -25 +23,10 @@ This topic describes the concepts and procedures that are common to all IPAM pol - * Create an IPAM policy + * [Managing IPAM policies](./managing-ipam-policies.html) + + * [Defining a public IPv4 allocation strategy with IPAM policies](./define-public-ipv4-allocation-strategy-with-ipam-policies.html) + + + + +## Terminology + +The following terms apply to IPAM policies: @@ -27 +34 @@ This topic describes the concepts and procedures that are common to all IPAM pol - * Enable an IPAM policy +**Allocation rules** @@ -29 +35,0 @@ This topic describes the concepts and procedures that are common to all IPAM pol - * [Define public IPv4 allocation strategy with IPAM policies](./define-public-ipv4-allocation-strategy-with-ipam-policies.html) @@ -30,0 +37 @@ This topic describes the concepts and procedures that are common to all IPAM pol +Optional configurations within an IPAM policy that map AWS resource types to specific IPAM pools. If no rules are defined, the resource types default to using Amazon-provided IP addresses. @@ -31,0 +39 @@ This topic describes the concepts and procedures that are common to all IPAM pol +**IPAM policy** @@ -34 +42 @@ This topic describes the concepts and procedures that are common to all IPAM pol -## Prerequisites +A set of rules that IPAM applies to resources created in the accounts that the policy targets. A policy can contain rules of more than one kind, and a policy's targets apply to all of its rules. Only one policy can be enabled for a given target, so rules of different kinds that should apply to the same target must be in the same policy. Use separate policies only when the rules should apply to different targets. @@ -36 +44 @@ This topic describes the concepts and procedures that are common to all IPAM pol - * An [IPAM](https://docs.aws.amazon.com/vpc/latest/ipam/create-ipam.html). +**Rule** @@ -38 +45,0 @@ This topic describes the concepts and procedures that are common to all IPAM pol - * [IAM permissions](https://docs.aws.amazon.com/vpc/latest/ipam/iam-ipam.html) for the IPAM policy operations and for the EC2 operations that create the governed resources. @@ -39,0 +47,3 @@ This topic describes the concepts and procedures that are common to all IPAM pol +An entry in a policy that maps matching resources to an outcome, such as the IPAM pool that a resource gets its IP address from. Each kind of rule has its own matching model, described in the topic for that rule kind. + +**Target** @@ -41,0 +52 @@ This topic describes the concepts and procedures that are common to all IPAM pol +An AWS account, [organizational unit](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_getting-started_concepts.html#organization-structure) (OU), or [organization root](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_getting-started_concepts.html#organization-structure) to which a policy is applied. The targets that take effect depend on the IPAM owner and tier. For more information, see Where a policy applies. @@ -61,2 +71,0 @@ A policy applies only to accounts in the delegated administrator's own organizat -###### Note - @@ -65,17 +73,0 @@ Organizational unit (OU) exclusions also apply to IPAM policies. A policy doesn' -## Terminology - -**IPAM policy** - - -A set of rules that IPAM applies to resources created in the accounts that the policy targets. A policy can contain rules of more than one kind, and a policy's targets apply to all of its rules. Only one policy can be enabled for a given target, so rules of different kinds that should apply to the same target must be in the same policy. Use separate policies only when the rules should apply to different targets. - -**Rule** - - -An entry in a policy that maps matching resources to an outcome, such as the IPAM pool that a resource gets its IP address from. Each kind of rule has its own matching model, described in the topic for that rule kind. - -**Target** - - -A _target_ is an AWS account, an OU, or the root of an AWS Organization to which a policy is applied. The targets that take effect depend on the IPAM owner and tier. For more information, see Where a policy applies. - @@ -86 +78 @@ An account can be in the scope of more than one enabled policy. The delegated ad - 1. **Member account target** : A policy that the delegated administrator enabled for the account directly. + 1. **Member account target** – A policy that the delegated administrator enabled for the account directly. @@ -88 +80 @@ An account can be in the scope of more than one enabled policy. The delegated ad - 2. **OU target** : A policy that the delegated administrator enabled for an OU that contains the account. If more than one OU in the account's path has a policy, the policy on the OU nearest to the account applies. + 2. **OU target** – A policy that the delegated administrator enabled for an OU that contains the account. If more than one OU in the account's path has a policy, the policy on the OU nearest to the account applies. @@ -90 +82 @@ An account can be in the scope of more than one enabled policy. The delegated ad - 3. **Organization root target** : A policy that the delegated administrator enabled for the whole organization. + 3. **Organization root target** – A policy that the delegated administrator enabled for the whole organization. @@ -92 +84 @@ An account can be in the scope of more than one enabled policy. The delegated ad - 4. **Self-activation** : A policy that the account enabled for itself from its own IPAM. + 4. **Self-activation** – A policy that the account enabled for itself from its own IPAM. @@ -101 +93 @@ For example, suppose that you enable a policy with two kinds of rules for the or -###### Important +###### Note @@ -105,84 +96,0 @@ A policy that a member account enables for itself never overrides a policy that -## Create an IPAM policy - -###### Using the AWS Console: - -Follow these steps to create an IPAM policy by using the AWS Console: - - 1. Open the IPAM console at [https://console.aws.amazon.com/ipam/](https://console.aws.amazon.com/ipam/). - - 2. In the left navigation pane, choose **Policies**. - - 3. Choose **Create policy**. - - 4. Enter a **Name** for your policy (optional). - - 5. Select the **IPAM** to associate with this policy. - - 6. (Optional) Add tags. - - 7. Choose **Create policy**. - - - - -###### Using the AWS CLI: - -Use the [create-ipam-policy](https://docs.aws.amazon.com/cli/latest/reference/ec2/create-ipam-policy.html) command. - -After you create the policy, add rules to it. See the topic for the kind of rule that you want to add. - -## Enable an IPAM policy - -Specify which accounts should use the policy. A policy's targets apply to all of the rules in the policy, and only one policy can be enabled for a given target. - -###### Using the AWS Console: - -Follow these steps to enable the policy by using the AWS Console: - - 1. In your policy details page, choose the **Targets** tab. - - 2. Choose **Manage policy targets**. - - 3. Do one of the following: - - * For single account usage (IPAM not integrated with AWS Organizations, or an account applying a policy to itself), choose **Enable for your account**. - - * For IPAM integrated with AWS Organizations (when you're the delegated admin): - - * In the **Organizational structure** section, select the accounts or organizational units where you want to apply this policy. - - * Check the **Enabled** checkbox for each target. - - * Choose **Save Changes**. - - - - -###### Using the AWS CLI: - -Use the [enable-ipam-policy](https://docs.aws.amazon.com/cli/latest/reference/ec2/enable-ipam-policy.html) command based on your setup: - -For single account usage (IPAM not integrated with AWS Organizations, or an account applying a policy to itself): - - - aws ec2 enable-ipam-policy \ - --ipam-policy-id ipam-policy-12345678 - -For IPAM integrated with AWS Organizations (when you're the delegated admin), set a policy to target an account in the AWS Organization: - - - aws ec2 enable-ipam-policy \ - --ipam-policy-id ipam-policy-12345678 \ - --organization-target-id 123456789012 - -For IPAM integrated with AWS Organizations (when you're the delegated admin), set a policy to target an organizational unit: - - - aws ec2 enable-ipam-policy \ - --ipam-policy-id ipam-policy-12345678 \ - --organization-target-id ou-123 - -###### Important - -Enabling a policy for a target replaces any policy that is already enabled for that same target. Policies enabled for different targets coexist; see Which policy applies to an account. - @@ -197 +105 @@ Delete a resource discovery -Define IPv4 allocation strategy +Managing IPAM policies