| IPAM admin account | Network member account | Management account cannot host IPAM; dedicated network ownership | Integrate IPAM with Org |
| Stack count | 4 Terraform roots | Credential boundary per account; RAM enable only in mgmt | Org bootstrap |
| IPAM home region | ap-southeast-6 | NZ-primary workloads; home = where IPAM resource is created | terraform -chdir=examples/multi-account/ipam output operating_regions |
| Operating regions | ap-southeast-6 + ap-southeast-2 | Pool locales + home region | Same output |
| Pool hierarchy | org → nz/au → dev/sandbox | Regional aggregation; room for sibling pools under /12 | Console IPAM pools |
| Root pool locale | None on org | Parent with locale locks all children to that region | Pool hierarchy |
| IPAM scope | Private only | RFC1918 VPC pools use Private; Public stays empty | Console scope dropdown → Private |
| CIDR plan | /8 → /12 regional → /16 account → /20 VPC | Non-overlapping, recognisable blocks | ipam/main.tf in upstream clone |
| Workload regions | dev=ap-southeast-6, sandbox=ap-southeast-2 | Locale enforcement | aws sts get-caller-identity per profile |
| RAM org sharing | org-bootstrap/ (mgmt) | Member accounts get AccessDeniedException; pools cannot be shared without org RAM | FINDINGS.md |
| NAT gateway | Disabled | ~$0/day idle VPC cost; not IPAM-related | enable_nat_gateway = false in workload |
| Profiles | ipam-org, ipam-network, ipam-workload-a/b | One profile per account | Prerequisites |
| Workload VPC CIDR | ipv4_ipam_pool_id on aws_vpc | Formal pool allocation; IPAM shows Managed VPC | Planning → Pools → Allocations |
| Monitoring scope | Org-wide discovery (all member accounts) | Pool tree in ipam/main.tf does not filter discovery | Monitoring → Resources resource count >> pool count |