Building Enterprise-Grade AWS VPC IPAM with Terraform

## The Challenge: Enterprise IP Management at Scale

Managing IP address space across large AWS environments is more complex than most organizations anticipate. When you're dealing with multiple AWS accounts, regions, and business units, traditional spreadsheet-based IP management quickly becomes a bottleneck that leads to conflicts, delays, and security gaps.

During my time at AWS, I've seen countless enterprises struggle with IP address allocation, especially when scaling across multiple regions or during cloud migrations. The manual processes, lack of automation, and absence of centralized governance create operational overhead that slows down development teams and increases risk.

That's why I built this comprehensive Amazon VPC IP Address Manager (IPAM) solution—to demonstrate how enterprise-grade network management can be automated, governed, and scaled using Infrastructure as Code.

## Solution Architecture: Four-Tier Hierarchical Design

The solution implements a sophisticated four-tier hierarchical pool structure that mirrors real-world organizational requirements. The diagram below illustrates the complete architecture and data flow from the IPAM Configurator through to deployment:

Complete AWS VPC IPAM Architecture and Data Flow

Top-Level Pool (Global CIDR: 10.0.0.0/8)
├── Regional Pools (per AWS region: 10.0.0.0/12, 10.16.0.0/12, …)
│   ├── Business Unit Pools (per BU: 10.0.0.0/14, 10.4.0.0/14, …)
│   │   └── Environment Pools (dev/qa/prod: 10.0.0.0/16, 10.1.0.0/16, …)

This hierarchy provides several key benefits:

• ▶Organizational Alignment: Matches business unit and environment structure
• ▶Scalable Governance: Policies applied at appropriate hierarchy levels
• ▶Conflict Prevention: Automatic CIDR containment validation
• ▶Multi-Region Consistency: Centralized control with regional allocation

## The Innovation: IPAM Configurator Tool

The standout feature of this solution is the "IPAM Configurator"—a Streamlit-based web application that revolutionizes how organizations plan and deploy their IPAM infrastructure.

Donny's IPAM Configurator: Demo

Traditional IPAM planning involves complex subnet math, spreadsheets, and manual validation that's error-prone and time-consuming. The IPAM Configurator eliminates these pain points with an interactive, visual approach to network design.

The tool is built using modern Python technologies including Streamlit for the web interface, Pandas for data manipulation, Plotly for visualization, and NetworkX for graph operations. The core logic handles complex CIDR validation and hierarchical allocation calculations that would typically require manual verification.

## Technical Implementation Deep Dive

The Terraform implementation follows enterprise-grade patterns with comprehensive validation, modular design, and operational excellence principles:

One of the most challenging aspects was implementing comprehensive validation logic to prevent configuration errors. The solution includes CIDR well-formedness checks, containment validation across hierarchy levels, and automated conflict detection.

The simplest, most portable guardrail validates a single variable — it works on every Terraform version because the condition only references the variable it's attached to:

variable "top_level_cidr" {
  type        = string
  description = "Global CIDR for the top-level IPAM pool (e.g. 10.0.0.0/8)."

  validation {
    # Must be a syntactically valid IPv4 CIDR...
    condition     = can(cidrhost(var.top_level_cidr, 0))
    error_message = "top_level_cidr must be a valid IPv4 CIDR, e.g. 10.0.0.0/8."
  }

  validation {
    # ...and broad enough to carve regional/BU/env pools beneath it.
    condition     = tonumber(split("/", var.top_level_cidr)[1]) <= 12
    error_message = "top_level_cidr prefix must be /12 or larger (smaller number) to leave room for the hierarchy."
  }
}

Validating that one pool actually fits inside another means comparing two variables in a single condition. That cross-variable reference requires Terraform 1.9+ (earlier versions reject a validation block that references anything but its own variable). Note the explicit tonumber() — split() returns strings:

# Terraform >= 1.9: a validation rule may reference other variables.
variable "regional_prefix_length" {
  type        = number
  description = "Prefix length for each regional pool (e.g. 12 for a /12)."

  validation {
    condition = (
      var.regional_prefix_length > tonumber(split("/", var.top_level_cidr)[1])
      && var.regional_prefix_length <= 28
    )
    error_message = "Regional prefix must be longer (more specific) than the top-level CIDR and no longer than /28."
  }
}

git clone https://github.com/aws-samples/sample-amazon-vpc-ipam-terraform

## Enterprise Integration Patterns

This IPAM solution is designed to integrate seamlessly with enterprise AWS environments and existing Infrastructure as Code workflows:

AWS Organizations Integration

The solution leverages AWS Resource Access Manager (RAM) to share IPAM pools across organizational accounts. This enables centralized governance while allowing distributed teams to provision VPCs using organization-managed IP space.

Account Factory for Terraform (AFT) Compatibility

For organizations using AFT, this IPAM solution can be deployed as a global customization, providing immediate IP management capabilities for newly provisioned accounts.

Downstream VPC Provisioning

VPC modules can directly reference IPAM pools using data sources, eliminating manual CIDR specification and ensuring automatic compliance with organizational IP allocation policies.

# VPC integration example
resource "aws_vpc" "main" {
  ipv4_ipam_pool_id   = data.aws_vpc_ipam_pool.environment.id
  ipv4_netmask_length = 18
  
  tags = {
    Name = "production-vpc"
    Environment = "prod"
  }
}

## Operational Excellence & Governance

Beyond the technical implementation, this solution addresses critical operational requirements for enterprise environments:

## Real-World Impact & Lessons Learned

Building this IPAM solution taught me several important lessons about enterprise infrastructure automation: