Today, AWS announced Virtual Private Cloud (VPC) Block Public Access (BPA), a new centralized declarative control that enables network and security administrators to authoritatively block Internet traffic for their VPCs. VPC BPA supersedes any other setting and ensures your VPC resources are protected from unfettered Internet access in compliance with your organizations security and governance policy. Amazon VPC allows customers to launch AWS resources in a logically isolated virtual network. Often times customers have thousands of AWS accounts and VPCs that are owned by multiple business units or application developer teams. Central administrators have the critical responsibility to ensure that resources in their VPCs are accessible to the public Internet in a highly controlled fashion. VPC BPA offers a single declarative control that allows admins to easily block Internet access to VPCs via the Internet Gateway or the Egress-only Internet Gateway and ensures that there is no unintended public exposure to their AWS resources regardless of their routing and security configuration. Admins can apply BPA across all or select VPCs in their account, block bi-directional or ingress-only Internet connectivity and exclude select subnets for resources that need Internet access. VPC BPA is integrated with AWS Network Access Analyzer and VPC Flow Logs to support impact analysis, provide advanced visibility and help customers meet audit and compliance requirements. VPC BPA is available in all AWS Regions where Amazon VPC is offered. There is no additional charge for using this feature. For additional information, visit the Amazon VPC documentation and blog post.

Amazon Web Services (AWS) now supports Internet Protocol version 6 (IPv6) addresses for AWS PrivateLink Gateway and Interface Virtual Private Cloud (VPC) endpoints for Amazon S3. The continued growth of the internet is exhausting available Internet Protocol version 4 (IPv4) addresses. IPv6 increases the number of available addresses by several orders of magnitude, and customers no longer need to manage overlapping address spaces in their VPCs. To get started with IPv6 connectivity on a new or existing S3 gateway or interface endpoint, configure IP address type for the endpoint to IPv6 or Dualstack. When enabled, Amazon S3 automatically updates the routing tables with IPv6 addresses for gateway endpoints and sets up an https://aws.amazon.com/blogs/aws/new-elastic-network-interfaces-in-the-virtual-private-cloud/ (ENI) with IPv6 addresses for interface endpoints. IPv6 support for VPC endpoints for Amazon S3 is now available in all AWS Commercial Regions and the AWS GovCloud (US) Regions, at no additional cost. You can set up IPv6 for new and existing VPC endpoints using the AWS Management Console, AWS CLI, AWS SDK, or AWS CloudFormation. To learn more, please refer to the service https://docs.aws.amazon.com/AmazonS3/latest/userguide/privatelink-interface-endpoints.html

Amazon Virtual Private Cloud (Amazon VPC) Traffic Mirroring is now supported on additional instance types. Amazon VPC Traffic Mirroring allows you to replicate the network traffic from EC2 instances within your VPC to security and monitoring appliances for use cases such as content inspection, threat monitoring, and troubleshooting. With this release, VPC Traffic Mirroring can be enabled on all Nitro v4 instances. You can see the complete list of instances that support VPC Traffic Mirroring in our documentation. You can see the complete list of instances built on different Nitro system versions in our AWS Nitro Systems documentation. VPC Traffic Mirroring is supported on these additional instance types in all regions. To learn more about VPC Traffic Mirroring, please visit the VPC Traffic Mirroring documentation.

Starting today, Amazon VPC Lattice lets you configure the number of IPv4 addresses assigned to resource gateway elastic network interfaces (ENIs). This enhancement builds on VPC Lattice's capability of providing access to resources on Layer-4 such as databases, clusters, domain names, etc. across multiple VPCs and accounts. When configuring a resource gateway, you can now specify the number of IPv4 addresses per ENI, which becomes immutable after setting. The IPv4 addresses are used for network address translation and determine the maximum number of concurrent IPv4 connections to a resource. You should consider your expected connection volume when configuring the IPv4 address count. By default, VPC Lattice assigns 16 IPv4 addresses per ENI. For IPv6, VPC Lattice always assigns a /80 CIDR per ENI. This feature is available at no additional cost in all AWS Regions where VPC Lattice is offered. For more information, visit the https://aws.amazon.com/vpc/lattice/ and https://docs.aws.amazon.com/vpc-lattice/latest/ug/resource-gateway.html#ipv4-address-type-per-eni.

Starting today, Amazon VPC Lattice lets you configure the number of IPv4 addresses assigned to resource gateway elastic network interfaces (ENIs). This enhancement builds on VPC Lattice's capability of providing access to resources on Layer-4 such as databases, clusters, domain names, etc. across multiple VPCs and accounts. When configuring a resource gateway, you can now specify the number of IPv4 addresses per ENI, which becomes immutable after setting. The IPv4 addresses are used for network address translation and determine the maximum number of concurrent IPv4 connections to a resource. You should consider your expected connection volume when configuring the IPv4 address count. By default, VPC Lattice assigns 16 IPv4 addresses per ENI. For IPv6, VPC Lattice always assigns a /80 CIDR per ENI. This feature is available at no additional cost in all AWS Regions where VPC Lattice is offered. For more information, visit the Amazon VPC Lattice product detail page and Amazon VPC Lattice documentation.

Amazon Web Services (AWS) now supports Internet Protocol version 6 (IPv6) addresses for AWS PrivateLink Gateway and Interface Virtual Private Cloud (VPC) endpoints for Amazon S3. The continued growth of the internet is exhausting available Internet Protocol version 4 (IPv4) addresses. IPv6 increases the number of available addresses by several orders of magnitude, and customers no longer need to manage overlapping address spaces in their VPCs. To get started with IPv6 connectivity on a new or existing S3 gateway or interface endpoint, configure IP address type for the endpoint to IPv6 or Dualstack. When enabled, Amazon S3 automatically updates the routing tables with IPv6 addresses for gateway endpoints and sets up an Elastic network interface (ENI) with IPv6 addresses for interface endpoints. IPv6 support for VPC endpoints for Amazon S3 is now available in all AWS Commercial Regions and the AWS GovCloud (US) Regions, at no additional cost. You can set up IPv6 for new and existing VPC endpoints using the AWS Management Console, AWS CLI, AWS SDK, or AWS CloudFormation. To learn more, please refer to the service documentation.

AWS launches VPC Encryption Controls to make it easy to audit and enforce encryption in transit within and across Amazon Virtual Private Clouds (VPC), and demonstrate compliance with encryption standards. You can turn it on your existing VPCs to monitor encryption status of traffic flows and identify VPC resources that are unintentionally allowing plaintext traffic. This feature also makes it easy to enforce encryption across different network paths by automatically (and transparently) turning on hardware-based AES-256 encryption on traffic between multiple VPC resources including AWS Fargate, Network Load Balancers, and Application Load Balancers. To meet stringent compliance standards like HIPAA and PCI DSS, customers rely on both application layer encryption and the hardware-based encryption that AWS offers across different network paths. AWS provides hardware-based AES-256 encryption transparently between modern EC2 Nitro instances. AWS also encrypts all network traffic between AWS data centers in and across Availability Zones, and AWS Regions before the traffic leaves our secure facilities. All inter-region traffic that uses VPC Peering, Transit Gateway Peering, or AWS Cloud WAN receives an additional layer of transparent encryption before leaving AWS data centers. Prior to this release, customers had to track and confirm encryption across all network paths. With VPC Encryption Controls, customers can now monitor, enforce and demonstrate encryption within and across Virtual Private Clouds (VPCs) in just a few clicks. Your information security team can turn it on centrally to maintain a secure and compliant environment, and generate audit logs for compliance and reporting. VPC Encryption Controls is now available in the following AWS Commercial regions: US East (N. Virginia), US East (Ohio), US West (Oregon), US West (N. California), Europe (Ireland), Europe (Frankfurt), Europe (London), Europe (Paris), Europe (Milan), Europe (Zurich), Europe (Stockholm), Asia Pacific (Sydney), Asia Pacific (Singapore), Asia Pacific (Tokyo), Asia Pacific (Melbourne), Asia Pacific (Hong Kong), Asia Pacific (Osaka), Asia Pacific (Mumbai), Asia Pacific (Hyderabad), Asia Pacific (Jakarta), Canada West (Calgary), Canada (Central), Middle East (UAE), Middle East (Bahrain), Africa (Cape Town) and South America (São Paulo). To learn more about this feature and its use cases, please see our documentation.

Amazon Virtual Private Cloud (Amazon VPC) Traffic Mirroring is now supported on additional instance types. Amazon VPC Traffic Mirroring allows you to replicate the network traffic from EC2 instances within your VPC to security and monitoring appliances for use cases such as content inspection, threat monitoring, and troubleshooting. With this release, VPC Traffic Mirroring can be enabled on all Nitro v4 instances. You can see the complete list of instances that support VPC Traffic Mirroring in our https://docs.aws.amazon.com/vpc/latest/mirroring/what-is-traffic-mirroring.html#supported-instance-types. You can see the complete list of instances built on different Nitro system versions in our https://docs.aws.amazon.com/ec2/latest/instancetypes/ec2-nitro-instances.html. VPC Traffic Mirroring is supported on these additional instance types in all regions. To learn more about VPC Traffic Mirroring, please visit the VPC Traffic Mirroring https://docs.aws.amazon.com/vpc/latest/mirroring/what-is-traffic-mirroring.html. 

AWS launches VPC Encryption Controls to make it easy to audit and enforce encryption in transit within and across Amazon Virtual Private Clouds (VPC), and demonstrate compliance with encryption standards. You can turn it on your existing VPCs to monitor encryption status of traffic flows and identify VPC resources that are unintentionally allowing plaintext traffic. This feature also makes it easy to enforce encryption across different network paths by automatically (and transparently) turning on hardware-based AES-256 encryption on traffic between multiple VPC resources including AWS Fargate, Network Load Balancers, and Application Load Balancers. To meet stringent compliance standards like HIPAA and PCI DSS, customers rely on both application layer encryption and the hardware-based encryption that AWS offers across different network paths. AWS provides hardware-based AES-256 encryption transparently between modern EC2 Nitro instances. AWS also encrypts all network traffic between AWS data centers in and across Availability Zones, and AWS Regions before the traffic leaves our secure facilities. All inter-region traffic that uses VPC Peering, Transit Gateway Peering, or AWS Cloud WAN receives an additional layer of transparent encryption before leaving AWS data centers. Prior to this release, customers had to track and confirm encryption across all network paths. With VPC Encryption Controls, customers can now monitor, enforce and demonstrate encryption within and across Virtual Private Clouds (VPCs) in just a few clicks. Your information security team can turn it on centrally to maintain a secure and compliant environment, and generate audit logs for compliance and reporting. VPC Encryption Controls is now available in the following AWS Commercial regions: US East (N. Virginia), US East (Ohio), US West (Oregon), US West (N. California), Europe (Ireland), Europe (Frankfurt), Europe (London), Europe (Paris), Europe (Milan), Europe (Zurich), Europe (Stockholm), Asia Pacific (Sydney), Asia Pacific (Singapore), Asia Pacific (Tokyo), Asia Pacific (Melbourne), Asia Pacific (Hong Kong), Asia Pacific (Osaka), Asia Pacific (Mumbai), Asia Pacific (Hyderabad), Asia Pacific (Jakarta), Canada West (Calgary), Canada (Central), Middle East (UAE), Middle East (Bahrain), Africa (Cape Town) and South America (São Paulo). To learn more about this feature and its use cases, please see our https://docs.aws.amazon.com/vpc/latest/userguide/vpc-encryption-controls.html.

With this launch, Amazon VPC Reachability Analyzer and Amazon VPC Network Access Analyzer are now available in Asia Pacific (New Zealand), Asia Pacific (Hyderabad), Asia Pacific (Melbourne), Asia Pacific (Taipei), Canada West (Calgary), Israel (Tel Aviv) and Mexico (Central). VPC Reachability Analyzer allows you to diagnose network reachability between a source resource and a destination resource in your virtual private clouds (VPCs) by analyzing your network configurations. For example, Reachability Analyzer can help you identify a missing route table entry in your VPC route table that could be blocking network reachability between an EC2 instance in Account A that is not able to connect to another EC2 instance in Account B in your AWS Organization. VPC Network Access Analyzer allows you to identify unintended network access to your AWS resources, helping you meet your security and compliance guidelines. For example, you can create a scope to verify that all paths from your web-applications to the internet, traverse the firewall, and detect any paths that bypass the firewall. For more information, visit documentation for https://docs.aws.amazon.com/vpc/latest/reachability/what-is-reachability-analyzer.html and https://docs.aws.amazon.com/vpc/latest/network-access-analyzer/what-is-network-access-analyzer.html For pricing, refer to the Network Analysis tab on the https://aws.amazon.com/vpc/pricing/. 

Today, AWS announced Virtual Private Cloud (VPC) Block Public Access (BPA), a new centralized declarative control that enables network and security administrators to authoritatively block Internet traffic for their VPCs. VPC BPA supersedes any other setting and ensures your VPC resources are protected from unfettered Internet access in compliance with your organizations security and governance policy. Amazon VPC allows customers to launch AWS resources in a logically isolated virtual network. Often times customers have thousands of AWS accounts and VPCs that are owned by multiple business units or application developer teams. Central administrators have the critical responsibility to ensure that resources in their VPCs are accessible to the public Internet in a highly controlled fashion. VPC BPA offers a single declarative control that allows admins to easily block Internet access to VPCs via the Internet Gateway or the Egress-only Internet Gateway and ensures that there is no unintended public exposure to their AWS resources regardless of their routing and security configuration. Admins can apply BPA across all or select VPCs in their account, block bi-directional or ingress-only Internet connectivity and exclude select subnets for resources that need Internet access. VPC BPA is integrated with AWS Network Access Analyzer and VPC Flow Logs to support impact analysis, provide advanced visibility and help customers meet audit and compliance requirements. VPC BPA is available in all AWS Regions where Amazon VPC is offered. There is no additional charge for using this feature. For additional information, visit the Amazon VPC https://docs.aws.amazon.com/vpc/latest/userguide/security-vpc-bpa.html and https://aws.amazon.com/blogs/networking-and-content-delivery/vpc-block-public-access/.  

Amazon Virtual Private Cloud https://docs.aws.amazon.com/vpc/latest/ipam/what-it-is-ipam.html that makes it easier for you to plan, track, and monitor IP addresses for your AWS workloads, is now available in Asia Pacific (Malaysia) Region. Amazon VPC IPAM allows you to easily organize your IP addresses based on your routing and security needs, and set simple business rules to govern IP address assignments. Using VPC IPAM, you can automate IP address assignment to Amazon VPCs and subnets, eliminating the need to use spreadsheet-based or homegrown IP address planning applications, which can be hard to maintain and time-consuming. VPC IPAM automatically tracks critical IP address information, eliminating the need to manually track or do bookkeeping for IP addresses. VPC IPAM keeps your IP address monitoring data (up to a maximum of three years), which you can use to do retrospective analysis and audits for your network security and routing policies. With this Region expansion, Amazon VPC IPAM is available in all AWS Regions, including the AWS GovCloud (US) Regions and China Regions. To learn more about IPAM, view the https://docs.aws.amazon.com/vpc/latest/ipam/what-it-is-ipam.html. For details on pricing, refer to the IPAM tab on the https://aws.amazon.com/vpc/pricing/.

AWS Transit Gateway now supports Policy-Based Routing (PBR), giving network administrators granular control over how traffic is forwarded across their AWS network. With PBR, forwarding decisions can be based on a combination of packet attributes including source and destination IP addresses, ports, and protocol rather than destination IP address alone. Previously, customers needing traffic steering or workload isolation had to build multi-VPC architectures with additional routing hops, adding complexity and operational overhead. PBR eliminates this by extending Transit Gateway's native routing capabilities, enabling security architects and enterprise network teams to classify and direct traffic inline without extra infrastructure. Customers associate a policy table with a Transit Gateway attachment and define an ordered set of rules. Each rule classifies traffic and directs matching packets to a specified route table using first-match-wins logic. This supports use cases such as steering sensitive workloads through AWS Network Firewall or third-party inspection appliances, routing application traffic over AWS Direct Connect or AWS VPN paths based on source, port, or protocol, and isolating production and development environments into separate routing domains to limit lateral movement. Policy-Based Routing for AWS Transit Gateway is available in all commercial AWS Regions where Transit Gateway is available. You can configure PBR using the AWS Management Console, AWS Command Line Interface (CLI), and the AWS Software Development Kit (SDK). PBR incurs no additional charge beyond standard Transit Gateway fees. To learn more about Policy-Based Routing for AWS Transit Gateway, visit the AWS Transit Gateway product page .

AWS Transit Gateway now supports Policy-Based Routing (PBR), giving network administrators granular control over how traffic is forwarded across their AWS network. With PBR, forwarding decisions can be based on a combination of packet attributes including source and destination IP addresses, ports, and protocol rather than destination IP address alone. Previously, customers needing traffic steering or workload isolation had to build multi-VPC architectures with additional routing hops, adding complexity and operational overhead. PBR eliminates this by extending Transit Gateway's native routing capabilities, enabling security architects and enterprise network teams to classify and direct traffic inline without extra infrastructure. Customers associate a policy table with a Transit Gateway attachment and define an ordered set of rules. Each rule classifies traffic and directs matching packets to a specified route table using first-match-wins logic. This supports use cases such as steering sensitive workloads through AWS Network Firewall or third-party inspection appliances, routing application traffic over AWS Direct Connect or AWS VPN paths based on source, port, or protocol, and isolating production and development environments into separate routing domains to limit lateral movement. Policy-Based Routing for AWS Transit Gateway is available in all commercial https://docs.aws.amazon.com/network-manager/latest/cloudwan/what-is-cloudwan.html#cloudwan-available-regions where Transit Gateway is available. You can configure PBR using the AWS Management Console, AWS Command Line Interface (CLI), and the AWS Software Development Kit (SDK). PBR incurs no additional charge beyond standard Transit Gateway fees. To learn more about Policy-Based Routing for AWS Transit Gateway, visit the https://aws.amazon.com/transit-gateway/.

Amazon VPC Route Server is now available in 16 new regions in addition to the 14 existing ones. VPC Route Server simplifies dynamic routing between virtual appliances in your Amazon VPC. It allows you to advertise routing information through Border Gateway Protocol (BGP) from virtual appliances and dynamically update the VPC route tables associated with subnets and internet gateway. With this launch, Amazon VPC Route Server is available in 30 AWS Regions: US East (Virginia), US East (Ohio), US West (Oregon), Europe (Ireland), Europe (Frankfurt), Asia Pacific (Tokyo), US West (N. California), Canada West (Calgary), Asia Pacific (Malaysia), Europe (Milan), Europe (Paris), Asia Pacific (Sydney), Europe (London), Canada (Central), Mexico (Central), South America (Sao Paulo),Asia Pacific (Seoul), Europe (Zurich), Europe (Stockholm), Middle East (UAE), Israel (Tel Aviv), Asia Pacific (Taipei), Asia Pacific (New Zealand), Asia Pacific (Melbourne), Middle East (Bahrain), Asia Pacific (Jakarta), Africa (Cape Town), Asia Pacific (Hong Kong), Asia Pacific (Osaka) and Asia Pacific (Thailand). To learn more about Amazon VPC Route Server, visit this https://docs.aws.amazon.com/vpc/latest/userguide/route-server-how-it-works.html.

Amazon VPC now allows customers to route inbound internet traffic destined for large pools of public IP addresses, to a single elastic network interface (ENI) within a VPC. Prior to this enhancement, internet gateways only accepted traffic destined to public IP addresses that were associated with network interfaces in the VPC. There are limits to the number of IP addresses that can be associated with network interfaces. These limits depend on the instance type and can be found in our https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AvailableIpPerENI.html. There are use cases in Telco, Internet of Things (IoT) and other industries that require customers to route inbound traffic destined for public IP pools, larger than the allowed limits, to a single network interface. Customers would earlier perform address translation to consolidate traffic for such large number of IP addresses. This enhancement removes the need to perform address translation on inbound internet connections for these Telco and IoT use cases. Customers can bring their own public IP pools (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-byoip.html) and configure their VPC Internet Gateway to accept traffic belonging to this BYOIP pool and route it to a network interface. They can also use this feature with VPC Route Server and dynamically update their routes in events of failure. Refer to our public https://docs.aws.amazon.com/vpc/latest/userguide/dynamic-routing-route-server.html for details on VPC Route Server. This enhancement is now available across all AWS commercial, AWS China and GovCloud regions. To learn more about this feature, please refer to our https://docs.aws.amazon.com/vpc/latest/userguide/advanced-routing.html.

Amazon VPC Route Server is now available in 16 new regions in addition to the 14 existing ones. VPC Route Server simplifies dynamic routing between virtual appliances in your Amazon VPC. It allows you to advertise routing information through Border Gateway Protocol (BGP) from virtual appliances and dynamically update the VPC route tables associated with subnets and internet gateway. With this launch, Amazon VPC Route Server is available in 30 AWS Regions: US East (Virginia), US East (Ohio), US West (Oregon), Europe (Ireland), Europe (Frankfurt), Asia Pacific (Tokyo), US West (N. California), Canada West (Calgary), Asia Pacific (Malaysia), Europe (Milan), Europe (Paris), Asia Pacific (Sydney), Europe (London), Canada (Central), Mexico (Central), South America (Sao Paulo),Asia Pacific (Seoul), Europe (Zurich), Europe (Stockholm), Middle East (UAE), Israel (Tel Aviv), Asia Pacific (Taipei), Asia Pacific (New Zealand), Asia Pacific (Melbourne), Middle East (Bahrain), Asia Pacific (Jakarta), Africa (Cape Town), Asia Pacific (Hong Kong), Asia Pacific (Osaka) and Asia Pacific (Thailand). To learn more about Amazon VPC Route Server, visit this page.

With this launch, Amazon VPC Reachability Analyzer and Amazon VPC Network Access Analyzer are now available in Asia Pacific (New Zealand), Asia Pacific (Hyderabad), Asia Pacific (Melbourne), Asia Pacific (Taipei), Canada West (Calgary), Israel (Tel Aviv) and Mexico (Central). VPC Reachability Analyzer allows you to diagnose network reachability between a source resource and a destination resource in your virtual private clouds (VPCs) by analyzing your network configurations. For example, Reachability Analyzer can help you identify a missing route table entry in your VPC route table that could be blocking network reachability between an EC2 instance in Account A that is not able to connect to another EC2 instance in Account B in your AWS Organization. VPC Network Access Analyzer allows you to identify unintended network access to your AWS resources, helping you meet your security and compliance guidelines. For example, you can create a scope to verify that all paths from your web-applications to the internet, traverse the firewall, and detect any paths that bypass the firewall. For more information, visit documentation for VPC Reachability Analyzer and VPC Network Access Analyzer. For pricing, refer to the Network Analysis tab on the Amazon VPC Pricing Page.

Amazon VPC now allows customers to route inbound internet traffic destined for large pools of public IP addresses, to a single elastic network interface (ENI) within a VPC. Prior to this enhancement, internet gateways only accepted traffic destined to public IP addresses that were associated with network interfaces in the VPC. There are limits to the number of IP addresses that can be associated with network interfaces. These limits depend on the instance type and can be found in our documentation. There are use cases in Telco, Internet of Things (IoT) and other industries that require customers to route inbound traffic destined for public IP pools, larger than the allowed limits, to a single network interface. Customers would earlier perform address translation to consolidate traffic for such large number of IP addresses. This enhancement removes the need to perform address translation on inbound internet connections for these Telco and IoT use cases. Customers can bring their own public IP pools (BYOIP documentation) and configure their VPC Internet Gateway to accept traffic belonging to this BYOIP pool and route it to a network interface. They can also use this feature with VPC Route Server and dynamically update their routes in events of failure. Refer to our public documentation for details on VPC Route Server. This enhancement is now available across all AWS commercial, AWS China and GovCloud regions. To learn more about this feature, please refer to our documentation.

Amazon Virtual Private Cloud IP Address Manager (Amazon VPC IPAM) that makes it easier for you to plan, track, and monitor IP addresses for your AWS workloads, is now available in Asia Pacific (Malaysia) Region. Amazon VPC IPAM allows you to easily organize your IP addresses based on your routing and security needs, and set simple business rules to govern IP address assignments. Using VPC IPAM, you can automate IP address assignment to Amazon VPCs and subnets, eliminating the need to use spreadsheet-based or homegrown IP address planning applications, which can be hard to maintain and time-consuming. VPC IPAM automatically tracks critical IP address information, eliminating the need to manually track or do bookkeeping for IP addresses. VPC IPAM keeps your IP address monitoring data (up to a maximum of three years), which you can use to do retrospective analysis and audits for your network security and routing policies. With this Region expansion, Amazon VPC IPAM is available in all AWS Regions, including the AWS GovCloud (US) Regions and China Regions. To learn more about IPAM, view the IPAM documentation. For details on pricing, refer to the IPAM tab on the Amazon VPC Pricing Page.