Skip to content
Amazon VPC IPAM Multi-Account Walkthrough

VPC IPAM Multi-Account Walkthrough

Deploy org-wide VPC IPAM across four AWS accounts and two regions — delegated admin, RAM pool sharing, and pool-backed workload VPCs
Get Started View on GitHub

What you’ll build

Section titled “What you’ll build”

Delegate and plan

Management account delegates IPAM
Amazon VPC IP Address Manager — hosts the pool hierarchy in the network account; workloads allocate VPC CIDRs from RAM-shared leaf pools. admin to a dedicated network account
Delegated IPAM admin account — owns IPAM home region, pool tree, and RAM resource shares. and enables RAM org sharing before pools are created.

Share regional pools

Network account builds a three-level pool hierarchy
Three-level CIDR tree: org → org/nz|org/au → org/nz/dev|org/au/sandbox with regional locales. and RAM-shares
AWS Resource Access Manager permission for a workload account to use an IPAM pool — does not create a formal allocation by itself. leaf pools to dev and sandbox workload accounts.

Allocate workload VPCs

Workload stacks consume shared pools via the manual stack contract
Manual copy of nz_dev_pool_id and au_sandbox_pool_id into workload terraform.tfvars as pool_id — no terraform_remote_state. — pool-backed VPCs show formal allocations
Formal CIDR assignment from a pool to a VPC when the workload uses ipv4_ipam_pool_id — visible under Planning → Pools → Allocations. in the network account.

Verify two planes

Confirm Planning
IPAM console areas driven by ipam/ and workload allocations: IPAMs, Scopes, Pools, Allocations. allocations and Monitoring
Org-wide resource discovery: Dashboard, Resources, ENIs — not filtered by pools in ipam/main.tf. resource discovery — org-wide dashboard widgets lag behind pool Allocations.