Lecture 252: Amazon VPC IP Address Manager (IPAM)
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：23:44
- 来源：Udemy Lecture 41579154
- Slide 数量：10
- 画面切换：02:40、04:23、05:50、08:33、10:54、12:01、14:01、17:07、20:02
扫描说明
逐条读取 Transcript 面板中的 517 条英文 cue，并按播放器进度同步全长约 23:44 的视频。依据 IPAM Scope/Pool、Pool Hierarchy、Organizations、Allocation Rule、Console Walkthrough 与 Monitoring 划分为 10 个小节。10 张截图均来自真实课程 Slide 或 AWS Console 演示，统一为 1364×770。课程录制时提到的 IPAM Tier、功能范围与 Public IPv4 费用属于时间敏感信息，本讲义只保留架构原理并提示以当前 AWS 文档为准。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. IPAM 把分散的 Spreadsheet 变成可治理的 Address Lifecycle
时间范围：00:00–02:40
总结 / Summary
中文
少量 VPC 可以用 Spreadsheet 维护 CIDR，但 Multi-account、Multi-region、多个 Environment 与 On-premises 并存后，手工流程很容易产生 Overlap、重复分配、容量不可见与变更失控。Amazon VPC IP Address Manager（IPAM）把 Address Space 集中到 Pool，按规则分配给 VPC 等资源，并持续发现、追踪 Utilization 与 Compliance。它解决的是地址生命周期治理，不替代 Routing、DNS 或 Network Firewall。
English
A few VPC CIDRs may be tracked in a spreadsheet, but multi-account, multi-region, multi-environment, and on-premises estates quickly create overlap, duplicate allocation, invisible capacity, and uncontrolled change. Amazon VPC IP Address Manager centralizes address space in pools, allocates it to resources under rules, and continuously discovers and tracks utilization and compliance. It governs the address lifecycle; it does not replace routing, DNS, or network firewalls.
Transcript
00:00 Hi.
00:01 So in this lecture,
00:02 let's understand how you can centrally manage the IP addresses across your AWS
00:07 state.
00:08 And for this AWS
00:10 has a tool called
00:11 IPAM.
00:12 As the name suggests it is IP address management.
00:15 So in this lecture, we'll talk about what's the problem with, you know,
00:19 managing your IP addresses, then what's
00:22 IPAM
00:22 and then what are the components of the
00:25 IPAM to help you manage these IP addresses?
00:27 Then I will just show you quickly how you can create IPAM
00:31 pools and then use those pools to allocate IP addresses to your VPCs.
00:36 And then we'll touch upon how can you track and monitor your IP addresses with IPAM.
00:42 So if you are starting with
00:44 AWS, probably you would have just a couple of VPCs
00:46 and your on-premises network
00:48 and then you will create these VPCs allocate CIDRs
00:51 and then make sure that these VPCs can communicate with each other
00:55 using say Transit gateways or VPC
00:58 peering connection.
00:59 Now, one thing that you need to take care is that
01:02 the IP addresses or
01:04 CIDR blocks for these VPCs
01:05 are non-overlapping.
01:07 That's for the reason that if they are overlapping,
01:10 then there is a problem connecting these two VPCs.
01:13 So it's the best practice to, you know,
01:15 manage these IP addresses in such a way that no two VPCs
01:19 probably have the overlapping
01:21 CIDRS.
01:21 So that's better to manage your growing network in the future, right?
01:25 So
01:26 when you begin,
01:27 probably you can have simple Excel sheets in which you
01:30 have the list of VPCs and corresponding CDR ranges.
01:33 So that whenever some new VPC has to be created,
01:37 you can just look at your Excel and see, OK, this CIDR
01:39 block is not used.
01:41 So for the new VPC, you can use a new CIDR range
01:45 and that works well if your
01:47 AWS footprint is small,
01:49 but over the time,
01:50 if you are using multiple
01:52 AWS regions, multiple environments and lots of
01:55 VPCs,
01:57 then you can imagine that pain if you are managing
01:59 this IP address location mapping in some kind of Excels
02:03 because there will be multiple network administrator
02:07 and then probably
02:08 it will be Excel hell going forward.
02:10 So
02:11 exactly to address this problem,
02:14 AWS has come up with this tool called
02:16 IPAM, which is IP address management.
02:18 But at very high level,
02:20 you create the pools of IP addresses
02:22 and then you make sure that when you create VPCs,
02:26 you allocate the VPC CIDR from those pools only.
02:30 So that
02:31 irrespective of how many number of VPCs you create,
02:33 you are sure that this VPC will never get the overlapping IP addresses.
02:38 So that essentially is
2. Scope 隔离 Address Realm，Pool 承载可分配的 CIDR
时间范围：02:40–04:23
总结 / Summary
中文
IPAM 创建默认 Public Scope 与 Private Scope；Scope 表示彼此独立的 Address Realm，因此同一 Private CIDR 可以存在于不同 Private Scope 中而不被视为冲突。Pool 位于 Scope 内，包含一个或多个 Provisioned CIDR，并可继续建立 Child Pool。真正分配给 VPC、Subnet 或其他资源的是 Pool 中的 Allocation。默认 Scope 是起点；需要隔离并购、独立网络或重叠地址域时，可增加 Private Scope。
English
IPAM creates default public and private scopes. A scope represents an independent address realm, so the same private CIDR can exist in separate private scopes without being treated as an overlap. A pool belongs to a scope, contains one or more provisioned CIDRs, and can contain child pools. Resources such as VPCs and subnets receive allocations from pools. Default scopes are the starting point; additional private scopes can isolate acquisitions, independent networks, or overlapping address realms.
Transcript
02:40 IPAM. Now, if you talk about the
02:42 IPAM components, then
02:44 IPAM has something called scope.
02:45 So IPAM
02:46 scope can be public or private.
02:48 So as the name suggests,
02:49 public scope is for managing public IP addresses and
02:53 private scope is for managing private IP addresses.
02:57 And in this lecture, we will mainly focus on the private IP address space.
03:01 Because for public IP addresses, you need to Bring Your Own IPs (BYOIP),
03:05 which unfortunately, we can't do here.
03:09 So when you enable the
03:10 IPAM, the public and private
03:12 scopes are created for you
03:14 and then once you have this scope, then you can create the pools.
03:18 Now these pools are like collection of
03:20 CIDR ranges and then you can have layered pools.
03:23 That means you can have a top level pool and inside that you can have sub pools.
03:28 For example, if you see this diagram, there is one single Global pool
03:32 and inside that
03:34 you can create pools per
03:36 AWS Region. Now that's just an example
03:38 and it's up to you how you want to organize your pools.
03:43 But
03:43 you can create this kind of sub pools. And then when you create the VPC,
03:47 you can allocate VPC
03:49 CIDR from these sub pools
03:51 and this make sure that you are organizing your big address space
03:56 into a smaller pools
04:00 and then you're allocating your VPC,
04:00 CIDR from those small pools.
04:02 So that's how the
04:03 IPAM works.
04:04 Now, if you have a single
04:06 AWS account, which is not part of
04:09 AWS organization, then also you can use
04:11 IPAM
04:12 or if you use
04:14 AWS organization,
04:15 then also you can use IPAM
04:17 to manage IP addresses across all member accounts in your
04:21 AWS organization.
3. Pool Hierarchy 先表达组织模型，再逐层缩小 Prefix
时间范围：04:23–05:50
总结 / Summary
中文
常见层次是 Global → Region → Environment → VPC，也可以按 Business Unit → Region → Application 组织。顶层 Pool 可不设 Locale，用来容纳多个 Regional Child Pool；带 Locale 的 Pool 管理该 Region 中创建的 Allocation。层次顺序没有唯一答案，但每一层都应对应稳定的治理边界，并预留 Growth、Failover、Acquisition 与 On-premises 需求，避免把所有地址一次性切得过细。
English
A common hierarchy is global to region to environment to VPC, but business unit to region to application is also valid. A top-level pool may have no locale and contain regional child pools; a pool with a locale manages allocations created in that region. There is no single correct ordering, but each layer should represent a stable governance boundary and reserve room for growth, failover, acquisitions, and on-premises needs rather than fragmenting all space immediately.
Transcript
04:23 OK? Just to give you an example about the pool structure,
04:27 so you can have a Global address space, which is again the collection of
04:32 CIDR ranges.
04:33 And then you can divide this top level pool into regional pools.
04:37 And within that, you can create a pool specific to a particular environment,
04:42 for example, for Development, Staging or Prod.
04:45 And now when you create a VPC,
04:47 you first decide that this VPC will be for Development environment
04:51 in a particular Region.
04:52 And then the VPC will be allocated IP
04:55 address range from that particular development pool.
04:59 And this is how you can manage your CIDRs for your VPCs.
05:03 Now another example,
05:05 you can also do the other way around. For example, you have the
05:08 IP
05:09 address space which is a Global pool.
05:11 And inside that first you create the pools as per your environments, for example,
05:16 production development.
05:17 And within that, then you have the regional pools
05:20 and just to talk about another example,
05:23 you can also create pools as per your line of businesses.
05:26 And then you can have multilevel pools as you can see here for business unit one,
05:31 I have regional pools and inside that I have environment specific pools, right?
05:36 So
05:37 it really depends on how you want to create these pools.
05:41 And if you're interested,
05:42 you can just check out this blog which
05:44 talks about some best practices for creating the IP
05:47 Pools.
05:48 I hope that is clear.
4. Organizations 集成：Delegated Administrator 管 Pool，RAM 分发访问，SCP 防止绕过
时间范围：05:50–08:33
总结 / Summary
中文
在 AWS Organizations 中，通常把 IPAM Delegated Administrator 放在专用 Networking/Infrastructure Account，并启用可信访问，让它发现组织内各 Account/Region 的资源。跨账号使用 Pool 通过 AWS Resource Access Manager（RAM）Share 与 IAM Permission 实现；SCP 或其他 Preventive Guardrail 用来禁止成员账号绕过 IPAM 直接随意创建 CIDR。要区分三件事：Delegation 决定谁管理 IPAM，RAM/IAM 决定谁可从 Pool 分配，SCP 决定哪些绕过路径被拒绝。
English
In AWS Organizations, IPAM delegated administration is commonly placed in a dedicated networking or infrastructure account with trusted access enabled so it can discover resources across member accounts and operating regions. Cross-account pool use is provided through AWS Resource Access Manager shares and IAM permissions, while SCPs or other preventive guardrails can stop member accounts from bypassing IPAM and choosing arbitrary CIDRs. Delegation selects the administrator, RAM and IAM grant pool use, and SCPs deny bypass paths.
Transcript
05:50 Now, earlier, I mentioned that you can use IPAM
05:52 with
05:53 AWS Organization as well
05:55 and for that, there are a few considerations. So let's talk about that.
05:59 Now, if you see this diagram, this is a control tower based landing zone diagram.
06:03 If you don't know what is landing zone or control tower, just read about it.
06:07 But essentially, it is kind of best practices to manage your
06:12 AWS organization accounts so that there is a separation of duties,
06:16 security is taken care,
06:18 network is Centralized and all member accounts can have their own control.
06:24 But still you are having the governance at the management account level.
06:28 So this is a kind of, you know,
06:30 AWS organization structure.
06:32 And again, this is very flexible
06:34 and this is just one representation of control tower landing zone.
06:39 So IPAM
06:40 can be integrated with your
06:42 AWS organization structure. And for that, what IPAM
06:45 suggests that you should have a separate
06:48 network admin account in which you enable the
06:51 IPAM.
06:52 And then using this account,
06:53 you can manage the IP addresses for rest of the account in your
06:57 AWS organization.
06:58 So there should be a Dedicated
07:00 IPAM
07:01 administrator account
07:03 in your
07:03 AWS organization.
07:06 And this account of course, should be a member of
07:09 AWS organization.
07:10 Now, additionally,
07:12 while using the
07:13 AWS organization, what you can also do is
07:15 you can enable the SCP policies.
07:18 Now, SCP is service control policies
07:20 which enforces that all the members account in my
07:24 AWS organization
07:25 should not be able to perform,
07:27 you know, some actions.
07:29 And here it makes sense to have this kind of action which says
07:32 no member account can directly assign the IP addresses to the VPCs.
07:37 That means all the IP addresses should be assigned
07:40 using the IPAM.
07:42 Now if you put this governance policy in place,
07:45 then you are sure that all the member accounts will
07:47 have non-overlapping IP addresses which is assigned by using the
07:53 IPAM.
07:53 So here this is just an example to enforce use of
07:57 IPAM in the member account.
07:59 But then you can also modify these policies and say a
08:02 particular
08:03 AWS account can use a particular IPAM
08:05 pool
08:06 or
08:07 you can also say that this particular organization unit
08:11 in AWS organization can use a set of IPAM
08:14 pools. So this is all flexible
08:17 and if you're interested, you can just look at the
08:19 AWS documentation around
08:20 how to write these policies.
08:22 So the point here is that you can use IPAM
08:25 with
08:25 AWS organization
08:27 and you can enforce the use of
08:29 IPAM for the member accounts.
08:31 Okay. So moving forward
5. Allocation Rule 约束 Prefix 与 Tag；IaC 直接从 Pool 申请地址
时间范围：08:33–10:54
总结 / Summary
中文
Pool 的 Allocation Rule 可定义 Minimum、Default、Maximum Netmask Length 以及 Required Resource Tag；Locale 限制 Allocation 所属 Region。账号或 OU 的访问范围主要由 RAM/IAM 管理，而不是靠 Allocation Rule 充当授权系统。CloudFormation 创建 VPC 时可提供 Ipv4IpamPoolId 与 Ipv4NetmaskLength，由 IPAM 选择可用 CIDR，避免模板硬编码。对 On-premises 或其他 Cloud，可用 Manual Allocation/Reservation 记录占用并参与规划，但 IPAM 不会替你部署或配置那些外部网络。
English
Pool allocation rules can define minimum, default, and maximum netmask lengths plus required resource tags; the locale constrains the region of allocations. Account or OU access is primarily governed by RAM and IAM, not by allocation rules as an authorization system. CloudFormation can create a VPC with Ipv4IpamPoolId and Ipv4NetmaskLength so IPAM selects an available CIDR instead of hard-coding one. Manual allocations or reservations can represent on-premises or other-cloud usage for planning, but IPAM does not deploy or configure those external networks.
Transcript
08:33 IPAM
08:34 also allows you to write rules, which means when you create the VPC,
08:39 you can specify that this IPAM
08:42 pool should only be allowed to be used if
08:47 you're having the right permissions. That means you have right
08:51 AWS account,
08:52 you're operating in a particular Region
08:54 and you are requesting for, you know, particular VPC size, so minimum and maximum
09:00 and your VPC has a particular tag.
09:03 So in
09:04 IPAM you can write the rules with all these conditions.
09:08 And now when a user is trying to create a VPC, these conditions can be evaluated.
09:14 And if all these conditions meet, then IPAM
09:17 will respond with the
09:19 CIDR from the
09:20 IPAM pool.
09:21 And then you can use this
09:23 to allocate to your resources, for example, to your VPC.
09:27 And if any of the rule doesn't meet the criteria, then of course, IPAM
09:32 won't be able to allocate CIDR
09:34 and then you won't be able to create the VPC.
09:38 And this doesn't really work only for the VPCs,
09:40 but you can use this
09:42 CIDR for non
09:43 AWS resources as well. For example, if you are setting up your on-premises network
09:49 and you want to have some private CIDR range, then you can also ask IPAM
09:54 to provide you the range
09:55 and then that range you can use to allocate to your on-premises network.
10:01 Okay. So once you have the IPAM
10:02 pools created and these rules configured,
10:05 then you can put everything into the automation.
10:09 For example,
10:10 in the beginning, maybe
10:12 you might have been asking your network admin for the CIDR
10:15 ranges and then you create a cloud formation template provide that
10:19 CIDR range and cloudformation will create the VPC.
10:23 This is a flow before
10:24 IPAM, I will say
10:26 and over the time
10:27 you will use the
10:29 IPAM
10:29 and now developer can directly ask
10:32 IPAM for the CIDR range and provide it to the
10:34 cloudformation and then cloudformation will create the VPC.
10:37 But here you can completely take out even this step.
10:41 And cloudformation itself can directly make an API call to the
10:45 IPAM
10:46 and get the available CIDR range and create the VPC.
10:49 So this is a way in which you can automate using the
10:53 IPAM.
6. 容量示例：/12 → Regional /16 → Environment /18 → VPC /24
时间范围：10:54–12:01
总结 / Summary
中文
课程示例先以 10.0.0.0/12 作为 Global Space，再为 Mumbai、N. Virginia、Ireland 各切 /16；每个 Region 内为 Dev/Test/Stage/Prod 切 /18，最后按 /24 分给 VPC。一个 /18 含 2^(24-18)=64 个 /24，而 /16 含 4 个 /18。计算 Prefix 数量时用 2^(child prefix-parent prefix)，但设计时还要为 AWS 保留地址、Subnet 切分与未来增长留空间。
English
The example starts with 10.0.0.0/12 as global space, assigns /16 pools to Mumbai, Northern Virginia, and Ireland, divides each region into /18 environment pools, and allocates /24s to VPCs. A /18 contains 2^(24-18), or 64, /24 networks, while a /16 contains four /18s. Use 2^(child prefix minus parent prefix) to count blocks, but capacity planning must also allow for subnet design, AWS-reserved addresses, and future growth.
Transcript
10:54 Okay. So with that, now, I just wanted to quickly show you how can you use
10:59 IPAM in your
11:00 AWS account.
11:01 So this is kind of one of the way in which we can implement IPAM.
11:05 And as I said,
11:06 it's up to you how you want to create this IP address space and how you want to then
11:11 divide into multiple pools.
11:13 So if you see here, I have a Global pool
11:16 with /12 prefix which gives me around 1 million private IPS.
11:20 And then I'm creating the regional pool
11:23 with /16 prefix which gives around 65,000 IPS.
11:28 Now, within every Region,
11:30 I would have multiple environment pools and these pools are created with
11:35 /18
11:36 CIDR
11:36 which gives me around 16,000 IPS.
11:39 And then while creating the VPCs, I can restrict that VPC can be created with maximum
11:45 CIDR of /24.
11:47 So that no VPC is more than 256 IP addresses.
11:52 And which means that for every environment I can create
11:55 at least up to 64 VPCs of size 256 IP
12:00 addresses.
7. 创建 IPAM：Operating Region 决定发现范围，Scope 与顶层 Pool 构成骨架
时间范围：12:01–14:01
总结 / Summary
中文
Console Walkthrough 先创建 IPAM、选择 Operating Region，并允许服务在这些 Region 复制 Resource Discovery Data；随后系统建立默认 Public/Private Scope，再在 Private Scope 下 Provision 10.0.0.0/12 的顶层 Pool。Operating Region 不只是 UI Filter，它决定 IPAM 发现与监控资源的地域范围。录制时 Console 展示的 Free/Advanced Tier、功能边界与费用可能已经变化，考试与实施应核对当前 AWS IPAM Features/Pricing，而不要死记视频中的价格。
English
The console walkthrough creates an IPAM, selects operating regions, and permits replication of resource discovery data from those regions. IPAM then has default public and private scopes, and a top-level pool is provisioned with 10.0.0.0/12 in the private scope. Operating regions are not merely UI filters; they define where IPAM discovers and monitors resources. The tier names, feature boundaries, and pricing shown at recording time may change, so use current AWS IPAM feature and pricing documentation rather than memorizing the video.
Transcript
12:01 And now let's go to the
12:03 AWS console and see this in action.
12:05 Ok. So I'll just say IPAM
12:08 and then you can go to the VPC IP address manager
12:11 and then you land here. Now, very first thing we have to do is to create the
12:16 IPAM.
12:16 So you have to just make sure that you accept this.
12:16 And then there are 2 pricing options.
12:16 Now, the difference is that in free tier, you can only manage the public IPv4
12:16 addresses.
12:16 But in our case, of course,
12:16 we want to manage the private IP addresses and
12:16 that's where we will go with the advanced tier.
12:16 But which also means there will be some cost for this IPAM
12:16 use.
12:16 Now here you can say
12:16 the IPAM
12:16 name. So I will say MyIPAM
12:16 doesn't really matter.
12:16 And then here in the operating Region,
12:16 you should select all the Region in which you want to use the
12:16 IPAM. So by default, Mumbai is selected because we are operating in Mumbai.
12:16 So that's the base Region for the
12:16 IPAM,
12:16 but you should also add other regions in which you want to use IPAM.
12:16 So I will also select us-east-1
12:16 which is North Virginia
12:16 and then I'll create the
12:16 IPAM.
12:16 So this is just, you know, setting up the IPAM.
12:16 And as you do this, it automatically creates two scopes, as I said,
12:16 a public scope and a private scope.
12:16 And now for the next part, we are going to use our private scope only.
12:16 Okay. So the next step is to create the pools. So let's go here
12:16 and let's make sure that we use the private scope.
12:16 So let's create a pool
12:16 and let's call it
12:16 the Global pool.
13:38 So rest of the settings as default. And just one thing here is a local.
13:42 Now, local means that in which all
13:44 AWS Region you want to
13:46 use this pool. Now, this is a Global pool.
13:48 So I don't want to restrict it to a particular AWS
13:51 Region
13:52 because we will be creating a regional pool as a sub pool.
13:55 And at that time, we will select the local.
13:57 So as of now, let's leave it blank.
8. Regional/Environment Child Pool 用 Locale、CIDR 与 Compliance Rule 收紧边界
时间范围：14:01–17:07
总结 / Summary
中文
演示在 Global Pool 下创建 Mumbai Regional Pool，设置 Locale 并 Provision 10.0.0.0/16；再建立 Development /18 Child Pool。Development Pool 规定 VPC 必须使用 /24，并要求 Environment=development Tag。父 Pool 决定可用 Address Space，Child Pool 只能从父级空间中 Provision；Locale、Netmask 与 Tag Rule 共同形成可验证的 Allocation Contract。
English
The demo creates a Mumbai regional pool under the global pool, sets its locale, and provisions 10.0.0.0/16, then creates a development /18 child pool. The development pool requires VPC allocations to be /24 and requires the tag Environment=development. The parent defines available address space and the child can provision only from that space; locale, netmask, and tag rules form a verifiable allocation contract.
Transcript
14:01 Now see CIDRs. So as we know, we want to create 10.0.0.0/12,
14:07 which gives me around 1 million IP addresses
14:10 rest of the settings as default and let's create the pool.
14:14 Okay. So this is my top level pool
14:17 and now we want to create the sub pools.
14:20 So let's refer to our CIDR allocation slide.
14:24 So we just created this one and now let's create a regional pool.
14:27 So we'll just do it for one Region, but you can definitely
14:30 replicate this for other regions if you want.
14:33 So in Mumbai, we will create a regional pool with /16 CIDR
14:39 and within that, we will create environments specific pool with /18 CIDR.
14:44 So let's do that.
14:46 OK. So I'm in the pools and now I will say create a pool within this pool
14:51 and I will say a
14:53 Mumbai pool
14:56 and here most of the settings as default.
14:59 And here in the local, I will say I want to enable it for Mumbai.
15:03 So let's select that.
15:04 And as an input
15:06 CIDR,
15:06 I will say 10.0.0.0/16 for my Mumbai which gives me around 65,000 IP addresses.
15:15 That's it. And let's create the pool.
15:18 Now, once you create the Mumbai pool,
15:20 now you can create the environment specific pools, right?
15:24 So
15:25 once it happens, we will create the next level of pool.
15:29 Okay. So now if you go to the pools, you select the Mumbai pools and then in action
15:34 say create a pool within this pool
15:36 and this is my
15:38 development pool
15:40 and I'm just going here, I'm
15:43 keeping the things as default.
15:45 OK?
15:46 So this is my development environment and I want to allocate
15:49 16,000 IP addresses out of 65,000 for the Mumbai pool.
15:54 So I'll say 10.0.0.0/18.
15:58 And at this time, I also want to make sure that all the
16:01 VPCs which are created in the development environment,
16:05 they are of size
16:06 /24
16:08 and they have the specific tag which says environment equal to development,
16:12 so I can enforce this kind of rules for my
16:16 IPAM usage.
16:17 And if you remember we had seen that in the earlier slide.
16:20 So let's configure the allocation rule setting for this
16:24 IPAM pool.
16:25 So here we say that the minimum net mask for my VPC
16:29 is /24. The default is also /24 and maximum is also /24.
16:36 But if you want,
16:37 you can define the minimum and maximum different
16:40 and then default as a different length.
16:42 And additionally, we will say
16:44 every VPC that you create
16:47 should have the environment tag
16:50 as a development.
16:52 Then only IPAM
16:54 can allocate this
16:55 to the VPC,
16:57 right?
16:58 And rest of the settings as it is and let's create the pool.
9. VPC 从 IPAM Pool 获取 Next Available CIDR，Tag 错误会触发校验
时间范围：17:07–20:02
总结 / Summary
中文
创建 VPC 时选择 IPAM-allocated IPv4 CIDR Block、目标 Development Pool 与 /24，而不是手工输入具体 Network。第一次请求因缺少 Required Tag 失败，第二次因 Tag Key 拼写错误仍失败，修正后 VPC 获得可用 /24；下一个 VPC 自动获得后续不重叠的 /24。这里的价值不仅是 Auto-numbering，更是把 Provisioning 与 Policy/Compliance 绑定在同一流程。
English
When creating a VPC, the demo selects an IPAM-allocated IPv4 CIDR block, the development pool, and a /24 length instead of entering a specific network. The first request fails for a missing required tag, a second fails because the tag key is misspelled, and the corrected request receives an available /24. The next VPC receives another non-overlapping /24. The benefit is not only automatic numbering but coupling provisioning with policy and compliance.
Transcript
17:07 Okay. So development environment has been created.
17:10 So you can create, for example, testing with 10.0.64.0/18.
17:16 And then you can also apply the similar rules for the tagging
17:20 and VPC prefix size as well.
17:23 But it's just a repeatation of what we did for development environment.
17:26 So I'm skipping that part.
17:28 Now let's go to our VPC console.
17:31 So we have required pool created. So let's go to the VPC
17:36 and let's go to the Mumbai Region and let's create the VPC
17:41 and let's call it, say
17:44 MyVPC.
17:45 And here you can select that I want to create a VPC
17:48 with
17:49 IPAM
17:49 allocated IPv4 CIDR
17:51 block
17:52 and
17:53 it shows you all the blocks which are available.
17:55 So within Mumbai, we know that there is a development block which we want to use
18:00 and here it automatically picks /24 prefix
18:03 because we had configured that as a rule.
18:06 Now, rest of the settings as default. Now to begin with,
18:10 I'm not putting the tag for the VPC and now I'm trying to create this VPC
18:16 and it says that there was an error
18:18 because the resource is missing one or more resource tag required by the IPAM
18:23 pool,
18:24 right? Which was expected. So let's go here and say
18:30 environments
18:31 equal to development
18:35 and create this VPC.
18:37 Okay. It did not work.
18:39 Maybe because we made some mistake somewhere. So let's go back and check our
18:45 IPAM
18:46 and in the pools, if you just go to the development pool,
18:50 let's look at the compliance requirement and is key OK?
18:55 So I made a spelling mistake there and that's where it's not allowing,
18:59 sorry for that.
19:00 But now let's use this as an environment.
19:03 So let's go here and modify this and create the VPC.
19:09 OK?
19:09 So you can see that VPC has been created successfully
19:12 and it automatically allocated this CIDR range.
19:16 Now let's do one more thing.
19:18 Let's create another VPC in the same pool. So let's call it, say my
19:24 project X
19:26 VPC. And we are allocating from the same development pool.
19:31 And again, we need to add,
19:34 I would tag
19:35 as
19:37 development and then create the VPC.
19:42 And this time you see that it allocated the next available CIDR in /24 range.
19:48 So this makes our life much, much easier. That means you don't have to worry about.
19:53 Now, this CIDR ranges, it will automatically be allocated by
19:57 IPAM.
19:58 So that was a short demo for this.
20:00 And now let's go back to our discussion.
10. Dashboard、CloudWatch、History 与 Public IP Insights 支撑持续治理
时间范围：20:02–23:44
总结 / Summary
中文
IPAM Dashboard 可查看 CIDR Utilization、Pool/Resource 状态、Overlap 与 Noncompliant Allocation；CloudWatch Metric/Alarm 用来预警 Pool 即将耗尽；IP Address History 帮助追溯某个地址在何时分配给哪个资源；Public IP Insights 汇总 Public IPv4 使用情况。IPAM 还能区分 Managed 与 Discovered/Unmanaged Resource，并支持 BYOIP 相关的组织化管理。History Retention、Tier、Quota、支持资源和 Public IPv4 费用会随服务演进，落地前应查当前文档。
English
IPAM dashboards expose CIDR utilization, pool and resource status, overlaps, and noncompliant allocations. CloudWatch metrics and alarms warn when a pool approaches exhaustion. IP address history helps trace when an address was assigned to a resource, and Public IP Insights summarizes public IPv4 usage. IPAM can distinguish managed resources from discovered or unmanaged resources and supports organizational management related to BYOIP. History retention, tiers, quotas, supported resource types, and public IPv4 charges evolve, so confirm current documentation before implementation.
Transcript
20:02 So if you are designing
20:04 IPAM for your organization, what I will suggest that first you plan it
20:08 and for that, I would say put everything onto the paper,
20:11 like how exactly you want to create these pools and how
20:14 many IP addresses you should be allocating to these pools.
20:18 And while you do that,
20:19 don't just consider the current
20:21 AWS landscape
20:22 but also consider the future state as well as your on-premises network
20:27 with that. Let's just quickly talk about a few more features of the
20:30 IPAM.
20:30 So
20:31 IPAM
20:32 also allows you to track and monitor the IP address usage.
20:36 And for that, you can go to the
20:37 IPAM dashboard and you can see everything out there.
20:40 So I leave it up to you to explore the
20:43 IPAM dashboard,
20:44 you can also filter the CIDR ranges as per the resources.
20:48 For example, if you want to see the allocation to VPCs or to the subnets or to the ENIs
20:53 all that can be done through the dashboard.
20:56 Now,
20:56 IPAM is also integrated with cloudwatch,
20:58 that means if you're close to exhausting the IP ranges from a particular pool,
21:02 then you can create an alarm for that and then you can take necessary action.
21:08 Further
21:09 IPAM also allows you to see the IP address history.
21:12 So you can track down for a particular resource which all IPs
21:16 were used in the past or if you have an IP address,
21:19 then you can see this IP was allocated to this ENI and then it was
21:23 allocated to some different ENI
21:25 all that can be traced down using the IP address history.
21:30 And finally
21:30 IPAM also provides you public IP insights. So this is applicable for all the public IPs
21:36 that
21:37 AWS provides to you as well as the public IPs
21:39 that you bring in as a Bring Your Own IP (BYOIP),
21:43 which means you get to see what all public IP addresses are there in use.
21:48 And this is particularly useful from February 2024
21:53 because AWS
21:54 will charge you for the use of public IPs.
21:57 So using this public IP insights,
21:59 you can figure out how many public IPs are there,
22:02 how many are unassociated and then you can
22:05 go and release those public or elastic IPs.
22:09 So in order to get an entire view of public IPs, this feature will be very useful.
22:15 OK? So essentially those are the additional features of the
22:18 IPAM.
22:18 Now, for completeness,
22:19 I have provided few slides for every feature that I just talked about.
22:24 So if you want, you can refer to these slides for the same.
22:28 OK. So quickly, the
22:30 IPAM summary
22:31 IPAM
22:31 allows you to organize IP address space into separate domains.
22:34 This could be business Domain or security Domain or Environmental Domain.
22:38 It is up to you how you design your
22:41 IPAM.
22:41 Then it automatically allocates the CIDRs
22:44 to your VPCs with specific business rules
22:47 and then it also monitors your IP address space that's in use
22:51 and monitor the resources that are using this IP against the set business rule,
22:56 which means it can also show you the compliant and non compliant resources.
23:02 Further, you can see the history of the IP address assignments
23:05 and one more point that we probably did not touch upon, but you can
23:10 share your, bring your own IP addresses across the Region and across
23:15 AWS account
23:16 using the
23:17 IPAM.
23:18 And finally
23:19 IPAM
23:19 provides you two pricing option in free tier. You can manage the public IP space
23:24 and for private IP space, you have to enable the advanced tier
23:28 and there is a small cost when you enable the advanced tier.
23:32 Okay. So that's it about the IP.
23:35 So I hope this helps you for any questions in the exam around IP address management
23:41 in AWS.
23:42 Thanks for watching and stay tuned.
整讲总结 / Overall Summary
中文
IPAM 的考试主线是 Scope 隔离 Address Realm、Pool Hierarchy 表达治理边界、Allocation Rule 约束 Prefix/Tag、Organizations Delegated Administrator 集中管理、RAM/IAM 授权成员账号使用、SCP 防止绕过，以及 Dashboard/CloudWatch/History 持续发现容量与合规问题。它既能为 VPC/IaC 自动分配不重叠 CIDR，也能记录外部网络占用，但不负责实际 Routing 或 On-premises Deployment。
English
The IPAM exam path is to use scopes for address realms, pool hierarchies for governance boundaries, allocation rules for prefixes and tags, an Organizations delegated administrator for central management, RAM and IAM for member-account access, SCPs to prevent bypass, and dashboards, CloudWatch, and history for ongoing capacity and compliance. IPAM can allocate non-overlapping CIDRs to VPCs and infrastructure as code and record external usage, but it does not perform routing or deploy on-premises networks.
返回顶部 ↑