Workload Deploy

Stacks workload-a/ and workload-b/ can run in parallel after ipam/ completes.

Stack contract

Each workload receives pool_id from ipam/ outputs via gitignored terraform.tfvars:

# workload-a/terraform.tfvars (gitignored — use real pool ID from ipam output)
pool_id = "ipam-pool-0123456789abcdef0"

The VPC is created from the shared pool via modules/ipam-vpc/:

module "vpc" {
  source = "../modules/ipam-vpc"

  ipv4_ipam_pool_id   = var.pool_id
  ipv4_netmask_length = 20
}

Workload-a (NZ dev)

Credential context

Switch to ipam-workload-a. Run aws sts get-caller-identity and confirm the dev account, region ap-southeast-6.

Field	Value
Account	Dev
Profile	ipam-workload-a
Region	ap-southeast-6
Pool	org/nz/dev (nz_dev_pool_id)

export AWS_PROFILE=ipam-workload-a
export AWS_REGION=ap-southeast-6
aws sts get-caller-identity
terraform -chdir=examples/multi-account/workload-a init
terraform -chdir=examples/multi-account/workload-a apply

Workload-b (AU sandbox)

Credential context

Switch to ipam-workload-b. Run aws sts get-caller-identity and confirm the sandbox account, region ap-southeast-2.

Field	Value
Account	Sandbox
Profile	ipam-workload-b
Region	ap-southeast-2
Pool	org/au/sandbox (au_sandbox_pool_id)

export AWS_PROFILE=ipam-workload-b
export AWS_REGION=ap-southeast-2
aws sts get-caller-identity
terraform -chdir=examples/multi-account/workload-b init
terraform -chdir=examples/multi-account/workload-b apply

Outputs

terraform -chdir=examples/multi-account/workload-a output vpc_cidr   # 10.64.0.0/20
terraform -chdir=examples/multi-account/workload-b output vpc_cidr   # 10.128.0.0/20

Expected result

• Each workload VPC CIDR allocated from the intended shared pool (/20)
• Pool allocations visible to IPAM admin account (may lag briefly)

Check Allocations first after apply; the summary dashboard may lag — see Verification.

See RAM and onboarding for the three-layer onboarding model.

Next: Verification.

Upstream: examples/multi-account/