View a markdown version of this page

Service-linked roles for IPAM - Amazon Virtual Private Cloud
Service-linked role permissions for IPAMCreate the service-linked role for IPAMEdit the service-linked role for IPAMDelete the service-linked role for IPAMService-linked role permissions for external providersCreate the service-linked role for external providersEdit the service-linked role for external providersDelete the service-linked role for external providers
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Service-linked roles for IPAM

IPAM uses Amazon Identity and Access Management (IAM) service-linked roles. A service-linked role is a unique type of IAM role. Service-linked roles are predefined by IPAM and include all the permissions that the service requires to call other Amazon services on your behalf.

A service-linked role makes setting up IPAM easier because you don't have to manually add the necessary permissions. IPAM defines the permissions of its service-linked roles, and unless defined otherwise, only IPAM can assume its roles. The defined permissions include the trust policy and the permissions policy, and that permissions policy cannot be attached to any other IAM entity.

IPAM uses the following service-linked roles:

Service-linked role permissions for IPAM

IPAM uses the AWSServiceRoleForIPAM service-linked role to call the actions in the attached AWSIPAMServiceRolePolicy managed policy. For more information on the allowed actions in that policy, see Amazon managed policies for IPAM.

Also attached to the service-linked role is an IAM trust policy that allows the ipam.amazonaws.com service to assume the service-linked role.

Create the service-linked role for IPAM

IPAM monitors the IP address usage in one or more accounts by assuming the service-linked role in an account, discovering the resources and their CIDRs, and integrating the resources with IPAM.

The service-linked role is created in one of two ways:

  • When you integrate with Amazon Organizations

    If you Integrate IPAM with accounts in an Amazon Organization using the IPAM console or using the enable-ipam-organization-admin-account Amazon CLI command, the AWSServiceRoleForIPAM service-linked role is automatically created in each of your Amazon Organizations member accounts. As a result, the resources within all member accounts are discoverable by IPAM.

    Important

    For IPAM to create the service-linked role on your behalf:

    • The Amazon Organizations management account that enables IPAM integration with Amazon Organizations must have an IAM policy attached to it that permits the following actions:

      • ec2:EnableIpamOrganizationAdminAccount

      • organizations:EnableAwsServiceAccess

      • organizations:RegisterDelegatedAdministrator

      • iam:CreateServiceLinkedRole

    • The IPAM account must have an IAM policy attached to it that permits the iam:CreateServiceLinkedRole action.

  • When you create an IPAM using a single Amazon account

    If you Use IPAM with a single account, the AWSServiceRoleForIPAM service-linked role is automatically created when you create an IPAM as that account.

    Important

    If you use IPAM with a single Amazon account, before you create an IPAM, you must ensure that the Amazon account you are using has an IAM policy attached to it that permits the iam:CreateServiceLinkedRole action. When you create the IPAM, you automatically create the AWSServiceRoleForIPAM service-linked role. For more information on managing IAM policies, see Editing a service-linked role description in the IAM User Guide.

Edit the service-linked role for IPAM

You can't edit the AWSServiceRoleForIPAM service-linked role.

Delete the service-linked role for IPAM

If you no longer need to use IPAM, we recommend that you delete the AWSServiceRoleForIPAM service-linked role.

Note

You can delete the service-linked role only after you delete all IPAM resources in your Amazon account. This ensures that you can't inadvertently remove the monitoring capability of IPAM.

Follow these steps to delete the service-linked role using the Amazon CLI:

  1. Delete your IPAM resources using deprovision-ipam-pool-cidr and delete-ipam. For more information, see Deprovision CIDRs from a pool and Delete an IPAM.

  2. Disable the IPAM account with disable-ipam-organization-admin-account.

  3. Disable the IPAM service with disable-aws-service-access using the --service-principal ipam.amazonaws.com option.

  4. Delete the service-linked role: delete-service-linked-role. When you delete the service-linked role, the IPAM managed policy is also deleted. For more information, see Deleting a service-linked role in the IAM User Guide.

Service-linked role permissions for external providers

IPAM uses the AWSServiceRoleForIPAMOutbound service-linked role to call the actions in the attached AWSIPAMOutboundServiceRolePolicy managed policy. With this policy, IPAM requests an Amazon web identity token (sts:GetWebIdentityToken). IPAM uses this token to federate into external providers of IPAM resources. The policy restricts the token audience to the external providers that IPAM supports. A request without an audience is denied. For more information about the managed policy, see Amazon managed policies for IPAM.

Also attached to the service-linked role is an IAM trust policy that permits the outbound.ipam.amazonaws.com service to assume the service-linked role.

Create the service-linked role for external providers

You don't need to manually create the AWSServiceRoleForIPAMOutbound service-linked role. IPAM creates the role in your account when you create a resource discovery with an external source. The account that creates the resource discovery must have an IAM policy attached to it that permits the iam:CreateServiceLinkedRole action.

Edit the service-linked role for external providers

You can't edit the AWSServiceRoleForIPAMOutbound service-linked role.

Delete the service-linked role for external providers

If you no longer need to discover resources in external providers, delete the AWSServiceRoleForIPAMOutbound service-linked role.

Note

You can delete the service-linked role only after you delete every resource discovery in your Amazon account that uses an external source. This ensures that you can't inadvertently stop the discovery of your resources in external providers.

Follow these steps to delete the service-linked role using the Amazon CLI:

  1. Delete each resource discovery that uses an external source with the delete-ipam-resource-discovery command. For more information, see delete IPAM resource discovery in the Amazon CLI Command Reference.

  2. Delete the service-linked role with the delete-service-linked-role command. For more information, see Deleting a service-linked role in the IAM User Guide.