If your IPAM is integrated with AWS Organizations, you can exclude an organizational unit (OU) from being managed by IPAM. When you exclude an OU, IPAM will not manage the IP addresses in accounts in that OU. This feature gives you more flexibility in how you use IPAM.
You can use OU exclusions in the following ways:
-
Enable IPAM for specific parts of your business: If you have multiple business units or subsidiaries in AWS Organizations, you can now use IPAM just for the ones that need it.
-
Keep your sandbox accounts separate: You can exclude your sandbox accounts from IPAM, focusing only on the accounts that really matter for your IP management.
How OU exclusions work
The diagrams in this section demonstrate two use cases for adding OU exclusions in IPAM.
The first diagram shows the impact of adding an organization unit (OU) exclusion on a parent OU only. As a result, IPAM will not manage the IP addresses in accounts in the parent OU. IPAM will manage the IP addresses in accounts in the other OUs outside the exclusion.
The second diagram shows the impact of adding an organization unit (OU) exclusion on a parent OU and all child OUs. As a result, IPAM will not manage the IP addresses in accounts in the parent OU or in accounts in any child OUs. IPAM will manage the IP addresses in accounts in the OUs outside of the exclusion.
Add or remove OU exclusions
Complete the steps in this section to add or remove OU exclusions.
Note
The delegated IPAM admin account is not excluded even if it's within an OU that's excluded.
Your IPAM must be integrated with AWS Organizations to add an OU exclusion. The Organization must have OUs in it.
You must be the delegated IPAM admin to view, add, or remove OU exclusions.
It takes time for IPAM to discover recently created organizational units.
-
There is a default quota for the number of exclusions you can add per resource discovery. For more information, see Organizational unit exclusions per resource discovery in Quotas for your IPAM.
-
If you share a resource discovery with another account, that account can see the OU exclusions on it, which contains information such as the Org ID, Root ID, and organizational unit IDs of the resource discovery owner's Organization.
To add or remove OU exclusions
Open the IPAM console at https://console.aws.amazon.com/ipam/
. In the navigation pane, choose Resource discoveries.
Choose your default resource discovery.
Choose Edit.
Under Organizational unit exclusions, do the following:
-
To add an OU exclusion:
-
If you want to exclude the OU and all its child OUs:
-
Find the OU in the table and select the checkbox. All child OUs are automatically selected.
-
-
If you want to exclude only parent OU accounts:
-
Find the OU in the table and select the checkbox. All child OUs are automatically selected. Deselect all child OUs.
-
-
Alternatively, you can use the Actions column to select only a parent OU or parent and child OUs:
-
Select all child OUs: Include any child OUs in the exclusion. As a result of choosing an OU, the OU is added on screen. Each OU contains the ID and the entity path of the OU exclusion.
-
Select only this OU: Include only this OU in the exclusion. As a result of choosing an OU, the OU is added on screen. Each OU contains the ID and the entity path of the OU exclusion.
-
Copy OU entity path: Copy the AWS Organizations entity path to use as needed.
-
-
If you know the AWS Organizations entity path already or you want to build it:
-
Choose Input organizational unit exclusion and enter the entity path of the OU exclusion. Build the path for the OU(s) using AWS Organizations IDs separated by a
/. Include all child OUs by ending the path with/*.-
Example 1
-
Path to a child OU:
o-a1b2c3d4e5/r-f6g7h8i9j0example/ou-ghi0-awsccccc/ou-jkl0-awsddddd/ -
In this example,
o-a1b2c3d4e5is the organization ID,r-f6g7h8i9j0exampleis the root ID,ou-ghi0-awscccccis an OU ID, andou-jkl0-awsdddddis a child OU ID. -
IPAM will not manage the IP addresses in accounts in the child OU.
-
-
Example 2
-
Path where all child OUs will be part of the exclusion:
o-a1b2c3d4e5/r-f6g7h8i9j0example/ou-ghi0-awsccccc/* -
In this example, IPAM will not manage the IP addresses in accounts in the OU (
ou-ghi0-awsccccc) or in accounts in any OUs that are children of the OU.
-
-
-
-
-
To remove an OU exclusion:
-
Choose the X next to an OU that's already been added. The
/*after the OU ID indicates that it's a parent OU and that child OUs are part of the OU exclusion.
-
-
Choose Save changes.
