Define public IPv4 allocation strategy with IPAM policies
Allocation rules in an IPAM policy define how public IPv4 addresses from IPAM pools are allocated to AWS resources. Each rule maps an AWS service to the IPAM pools that the service uses to get IP addresses. A single policy can have multiple rules and be applied to multiple AWS Regions. If an IPAM pool runs out of addresses, the service falls back to Amazon-provided IP addresses. If you bring your own IP (BYOIP), this helps reduce your AWS public IPv4 costs.
When to use allocation rules
Use allocation rules to:
-
Reduce public IPv4 costs by using BYOIP addresses
-
Centrally control which IP pools your AWS resources use
-
Ensure consistent IP allocation across your organization
How it works
The following occurs when you create an AWS resource that needs a public IP address in an account with IPAM policies enforced:
-
IPAM checks your policy rules in order.
-
If a rule matches the resource type, IPAM allocates an IP from the specified pool.
-
If the pool is empty and overflow is enabled, Amazon provides an IP address.
-
If no rules match, the default behavior applies.
Supported services and resources
You can create IPAM policies to define how public IPv4 addresses from IPAM pools are allocated to the following AWS services and resources:
-
Elastic IP addresses (EIPs)
-
Application Load Balancers (ALBs)
-
Amazon Relational Database Service (RDS)
-
Regional NAT gateways
Important
If you choose a specific IPAM pool or EIP allocation ID when creating an AWS resource, that will override the IPAM policy.
Prerequisites
-
An IPAM policy. For the IPAM requirements and how to create a policy, see IPAM policies.
-
A public IPAM pool with IPv4 addresses
Terminology
- Allocation rules
-
Optional configurations within an IPAM policy that map AWS resource types to specific IPAM pools. If no rules are defined, the resource types default to using Amazon-provided IP addresses.
Step 1: Add allocation rules
After you create the policy (see Create an IPAM policy), add allocation rules that define how IP addresses are allocated:
Using the AWS Console:
Follow these steps to add allocation rules by using the AWS Console:
-
In the left navigation pane, choose Policies.
-
Choose the policy that you created.
-
In your policy details page, choose the Allocation rules tab.
-
Choose Create allocation rules.
-
Configure the Service configuration:
-
Locale: Choose the AWS Region (us-east-1) or Local Zone where you want this policy to apply.
-
Resource type: Select the AWS service or resource type for this policy (Elastic IP addresses, RDS database instances, Application Load Balancers, or NAT gateways in regional availability mode).
-
-
Configure Rules configuration:
-
IPAM pool: Select the IPAM pool that will provide IP addresses.
-
Review the pool details (locale, public IP source, space available, and CIDR ranges available).
-
-
(Optional) Choose Add new rule to create additional rules.
-
Choose Create allocation rule.
Using the AWS CLI:
Use the modify-ipam-policy-allocation-rules command.
Step 2: Enable the policy
Specify which accounts should use this policy. See Enable an IPAM policy. If an account is in the scope of more than one enabled policy, see Which policy applies to an account.
Step 3: Test your policy
Create a new resource of the type you configured (like an EIP) in one of the target accounts. The resource will automatically use an IP address from your IPAM pool.
Important
If you choose a specific IPAM pool or EIP allocation ID when creating an AWS resource, that will override the IPAM policy.
Step 4: Monitor usage
Check your IPAM pool in the console to see IP addresses being allocated to your resources.
