Question

A financial services company is expanding from 3 to over 200 AWS accounts across 4 Regions using AWS Organizations. Currently, each team manually requests CIDR blocks via email, which has led to overlapping ranges that break Transit Gateway routing during account onboarding. The network team wants a centralized, automated way to allocate non-overlapping CIDR blocks to accounts and Regions, enforce allocation rules (such as maximum prefix size per pool), and monitor utilization to reclaim unused space. Which solution best meets these requirements with the least operational overhead?

Accepted Answer

Deploy Amazon VPC IP Address Manager (IPAM) with a top-level pool subdivided into Regional and per-team pools, share pools via AWS RAM across the organization, and apply allocation rules and monitoring.

Answer

Maintain a shared Amazon DynamoDB table that tracks assigned CIDRs and require each team to run a Lambda function that checks and reserves a block before creating a VPC.

Answer

Use a single large VPC in a central account with subnets allocated to each team, connected to other accounts through VPC peering to avoid overlap entirely.

Answer

Create separate Route 53 Resolver rules per account to detect overlapping ranges and reject VPC creation events using AWS Config custom rules.