Account Topology

Four-account topology

Delegated admin model

AWS Organizations requires a dedicated network member account as the IPAM delegated administrator. The management account cannot host IPAM — attempting to do so returns IpamOrganizationDelegatedAdminCannotBeRootAccount.

Account	Profile	Region	Responsibility
Management	ipam-org	Global	org-bootstrap/ — delegation + RAM org sharing
Network	ipam-network	ap-southeast-6	ipam/ — IPAM instance, pools, RAM shares
Dev	ipam-workload-a	ap-southeast-6	workload-a/ — pool-backed VPC
Sandbox	ipam-workload-b	ap-southeast-2	workload-b/ — pool-backed VPC

The org-bootstrap/ stack runs aws_vpc_ipam_organization_admin_account to designate the network account as IPAM admin. It also enables aws_ram_sharing_with_organization — required before pools can be shared inside the org.

Private vs Public scopes

AWS creates two default scopes per IPAM:

Scope	Pool count (this example)	Usage
Private	5	All org / regional / leaf pools under RFC1918
Public	0	Empty by design — no BYOIP or public IPv4 pools

All pool work, RAM shares, and allocations are under Private. The Public scope is normal and costs nothing while empty.

RAM relationships

RAM shareRAM share
AWS Resource Access Manager permission for a workload account to use an IPAM pool — does not create a formal allocation by itself. grants permission to use a pool. IPAM allocationIPAM allocation
Formal CIDR assignment from a pool to a VPC when the workload uses ipv4_ipam_pool_id — visible under Planning → Pools → Allocations. (linking the VPC CIDR to the pool) is what makes usage visible in the network account. See RAM and onboarding for the three onboarding layers.

Upstream: examples/multi-account/