VPC IP Address Manager's 'Public IP Insights': A free and simple feature for customers to get insights on their public IPv4 usage

Background:

AWS is introducing a new charge of $0.005 per IP per hour for public IPv4 addresses starting February 1, 2024 [1]. This charge will be for in-use Public IPv4 addresses that are assigned to resources with in your VPC, Amazon Global Accelerator, and AWS site-to-site VPN tunnel. Primary, in-use, public IPv4 addresses are not charged today where as there is already a charge of $0.005 per IP per hour, for any secondary/additional elastic IP addresses running on an EC2 instance and also for elastic IP addresses that are idle/unattached in the account. So, A single IP address will cost half a cent per hour ($3.6 per month, $43.8 per year). This move from AWS comes as a result of increasing scarcity of public IPv4 addresses and also costs to secure public IPv4 addresses, that have increased by more than 300% in the last five years. There will be no charge however, for IP addresses that customers own and bring to AWS (BYOIP). Owing to this, customers are encouraged to actively monitor their usage of public IPv4 addresses and delete them if no longer needed. As an alternative to using public IPv4 addresses to connect to EC2 instances, customers can use EC2 Instance Connect Endpoint, which allows you to connect to an instance via SSH or RDP without requiring the instance to have a public IPv4 address [2,3]. Customers can view the IPv4 usage information in Amazon VPC IPAM Public IP Insights (once configured) as well as in their AWS Cost and Usage Reports, starting July 28, 2023.

You can use Public IP insights feature for the following:

• If your IPAM is integrated with accounts in an AWS Organization, you can view all public IPv4 addresses used by services across all AWS Regions for your entire AWS Organization.
  

• If your IPAM is integrated with accounts outside an AWS Organization, you can view all public IPv4 addresses used by services across all AWS Regions for those accounts.
  

• If your IPAM is integrated with a single account, you can view all public IPv4 addresses used by services across all AWS Regions in your account. 
  

The scope of this document is to help you integrate IPAM with accounts in AWS Organization (first use case listed above) [4].

Configuration Steps:

Note: Steps 1-4 must be carried out in the Management Account and steps 5-7 must be carried out in the IPAM delegated administrator account.

1. From your AWS Organizations management account, log into Amazon VPC IP Address Manager.

2. From the menu on the left, under Planning, click on Organization settings.

3. Click on the Delegate button to enter an account that will be the IPAM delegated administrator. There are two things to keep in mind while choosing an IPAM delegated administrator account:

--> Your management account cannot be an IPAM delegated administrator.

--> The non-management account that you would choose to be the IPAM delegated administrator should be a part of your AWS Organization that you want to use this IPAM in.

More importantly, if you create an IPAM in an account that is not the IPAM delegated administrator account, it will monitor resources only in that account and not across accounts in the Organization.

4. Provide the account number and click on save changes. This action lets IPAM automatically create a service-linked IAM role in all member accounts in your organization. Your work on the management account is complete at this stage.

5. Log in to the IPAM delegated admin account to create IPAM. Navigate to VPC IP Address Manager and in the menu on the left, under Planning, click on IPAMs.

6. In the Create IPAM section, check the box below Allow data replication, to give permission to VPC IP Address Manager to replicate data from all member accounts of the organization into the delegated account. In the IPAM Tier, select Free Tier to view and manage public IPv4 usage across your Organization. In the IPAM Settings section, give a name tag (optional) to your IPAM and under Operating Regions, click on Add all Regions, if you operate in multiple regions. Lastly, click on Create IPAM.

7. Under the Monitoring section on the left, click on Public IP Insights, to view public IPv4 information across your Organization's member accounts across all regions. It may take some time depending on the size of your Organization (number of accounts and operating regions) for IPAM to pull the IPv4 usage from all the member accounts and replicate to IPAM delegated administrator account.

Public IP Insights is the only feature under Monitoring section of Amazon VPC IPAM that falls under the Free Tier (all other features in that section are a part of Advanced Tier, which is a paid option.) However, Public IP Insights gives you all the necessary information you need to monitor and evaluate your usage of public IPv4 addresses. This includes:

• Public IP types (EC2 public IPs, Amazon-owned IPs, BYOP, etc.)
  

• EIP usage (Associated, Unassociated, etc.)
  

• Breakdown of Regions by total public IPs.
  

• Breakdown of Accounts by total public IPs.
  

• Public IP address details, including Service they are associated with, network interface ID they are associated with, EC2 Instance ID, Region, Account ID owning those IPs, etc. You can also Export this data to CSV.
  

Outcome:

This document will help customers create and integrate Amazon VPC IP Address Manager with accounts in their AWS Organizations. Following this integration, customers can use the Public IP Insights feature of the Amazon VPC IP Address Manager, as a single dashboard (that is also free) to watch over the public IPv4 addresses across their accounts and regions in AWS Organization and manage them to save costs.

References:

[1] https://aws.amazon.com/blogs/aws/new-aws-public-ipv4-address-charge-public-ip-insights/

[2] https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/connect-using-eice.html

[3] https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/connecting_to_windows_instance.html

[4] https://docs.aws.amazon.com/vpc/latest/ipam/enable-integ-ipam.html