AWS VPC IPAM Integration

Overview

The AWS VPC IPAM integration discovers IP address data from AWS VPC IP Address Manager (IPAM) and synchronizes it into NetBox through the Diode pipeline. It gives networking teams a single view of their IP space across on-premises and AWS infrastructure, so cloud allocations are visible alongside everything else in NetBox.

The integration queries the AWS EC2 IPAM APIs with boto3 and maps IPAM scopes, pools, provisioned CIDRs, allocated CIDRs, and resource CIDRs into NetBox VRFs, prefixes, and IP addresses. Data flows one way only: from AWS into NetBox. Nothing is written back to AWS.

What gets synchronized

• VRFs - one per IPAM scope, and one per VPC where resource CIDRs carry a VPC ID
• Prefixes - from IPAM pool provisioned CIDRs, pool allocations, and non-host resource CIDRs
• IP addresses - from single-host resource CIDRs (/32 IPv4 and /128 IPv6, for example Elastic IPs)

Key features

• IPAM discovery - reads IPAM instances, scopes, pools, and resource CIDRs from AWS VPC IPAM using the EC2 APIs
• Scope to VRF mapping - each IPAM scope becomes a NetBox VRF, with a scope Name tag used for the VRF name when present
• Per-VPC routing isolation - resource CIDRs that carry a VPC ID are placed in a VRF per VPC, so overlapping CIDRs across VPCs coexist in NetBox
• Multi-region synchronization - one policy can sync several AWS regions; each region is processed independently and a per-region failure does not abort the run
• Cross-account access - optionally assume an IAM role to read IPAM from a different AWS account
• Ingestion filters - narrow what is synced by scope type, scope ID, or resource type
• Region grouping via tags - every object is tagged with the AWS region so you can filter and group by region in NetBox
• NetBox Assurance integration - discovered data is staged as deviations in NetBox Assurance for review before being written to NetBox

Integration architecture

The AWS VPC IPAM integration is built using the NetBox Labs controller integrations framework:

• Standardized integration pattern - consistent approach across all controller integrations
• NetBox Assurance integration - uses NetBox Assurance for safe data ingestion and deviation management
• Agent based - runs as part of the NetBox Discovery agent ecosystem using the Orb Agent Pro image
• One-way sync - data flows from AWS VPC IPAM to NetBox only; no changes are written back to AWS

Compatibility

Supported NetBox versions

• Commercial editions (NetBox Cloud and NetBox Enterprise) v4.1 and later with NetBox Assurance

Supported AWS VPC IPAM versions

• The integration is maintained to remain compatible with the latest AWS APIs available in the boto3 library. AWS VPC IPAM must be enabled in your account, and the Advanced Tier is required for private IP management.