- [Instructor] In this video,
you'll see how to set up Amazon VPC IP Address Manager,
or Amazon VPC IPAM for AWS Control Tower.
With this integration,
you can set up IPAM in a multi-account environment,
create VPCs while avoiding CIDR conflicts,
and ensure visibility of IP resources and utilization
across your environment.
We'll begin an AWS Control Tower in our management account.
We have a multi-account structure
with a security organizational unit, or OU,
a workloads OU containing three business accounts,
and an infrastructure OU for a shared network account.
We also have an AWS single sign-on login page
so that we can easily navigate
between our Control Tower accounts.
Let's navigate to the Amazon VPC IP Address Manager
to start the configuration.
Let's go to settings.
First, we'll create a dedicated administrator for IPAM.
Since our network account
will manage all our networking resources,
we'll delegate the administration of IPAM to that account.
Let's copy the network account ID and paste it in here.
Next, we'll log into the network account.
From the network account,
we'll open Amazon VPC IP Address Manager
and create an IPAM instance.
In this example, our workflows are going to operate
in two regions, us-west-2 and us-east-1,
so that's where we want IPAM
to discover resources and manage IPs.
As you can see, two default scopes will be created,
one for private addressing and one for public addressing.
Now that the IPAM instance is created,
we'll create our pools.
Pools are collections of CIDRs
and help to organize the IP space.
We'll start by creating
a top level pool for the organization.
This pool will be the parent
for our account and regional pools.
Since this is the top level pool,
we won't specify a source pool or a locale.
We'll add a CIDR and then create the pool.
Now that we have the top level pool, we can create pools
for each business account in our workloads OU.
We'll begin with business A.
In this case,
the source pool will be the top level pool we just created.
Let's specify a CIDR and create the pool.
Now that we have an IPAM pool for our business A account,
we'll create sub pools for our two regions.
Let's start with us-west-2.
In this case,
the source pool will be the business A pool we just created.
We'll specify the locale setting as us-west-2,
since this pool will only be used in that region.
We'll add a specific CIDR that is part
of the CIDR block of our parent pool.
Let's also configure the pool's allocation rules.
We'll allow automatic import of discovered resources.
Let's retain these default settings and create the pool.
The pool has been created.
Let's skip ahead to after we've finished creating
all the necessary pools
for our business A and business B accounts.
Here is our pool hierarchy so far.
The pools used by the business A account
and the business B account do not overlap,
and they can communicate
over a shared network without IP conflicts.
Now let's turn to our business C account.
For this example,
we need to keep that account completely separate
from the other two.
To support that we can create a new scope.
This will allow us to reuse the IP space,
since business C won't share the network
with the other accounts.
Next, we'll create a top level pool for this scope.
Since this pool will be in a different network,
we can use the same CIDR block
that was used by other applications.
Let's view our pools.
To see the business C pool,
we need to change the scope.
Let's return to the default scope.
Now that these pools are created,
we'll wanna make them available to the individual accounts
so they can be used for creating VPCs.
To do that, we'll use AWS Resource Access Manager.
We are now in Resource Access Manager
in our network account.
Let's create a resource share.
We'll share IPAM pools for our business A account.
For our purposes, we'll share the pool for us-east-1.
We'll retain the default permissions.
We'll share only within the organization.
Let's copy and paste the ID
for the business A account we're sharing with.
Now we'll review the details and create the resource share.
After this IPAM pool is shared,
it will be visible in our business A account,
and we should be able to use it for creating VPCs.
Let's sign into the business A account.
We'll use the VPC wizard to create a VPC.
Instead of manually inputting a CIDR block,
we can now use our IPAM pool
to create a CIDR block for our VPC.
We can choose the appropriate net mask
and the IP block will be assigned automatically
from the IPAM pool.
As you can see,
a CIDR block from the IPAM pool has been allocated
to our newly created VPC.
Returning to Amazon VPC IP Address Manager,
we can see IP usage
across our multi-account environment on the dashboard.
We can also check
whether any resources have overlapping conflicts
and whether resources are compliant
with the rules we've defined.
We can also look at IP historical insights
to find out how a particular CIDR block was utilized.
Finally, we can select a pool
from the list to view its utilization and other details
letting us determine how efficiently
the IP space has been employed.
You've just seen how to set up Amazon VPC IPA
for AWS Control Tower.
You can learn more about this topic
in the description and links for this video.
Thanks for watching.
Now it's your turn to try.