Dashboard
The Dashboard is the landing page for VPC IPAM once enablement completes. It summarizes the address space AWS has discovered across your enrolled accounts and Regions, shows which pools are closest to full, counts the compliance and overlap posture AWS reports, reports how healthy discovery is, and tells you what the capability is currently costing you, uniquely among Prism capabilities.
Accessing the Dashboard
In the Security Hub sidebar, click VPC IPAM. If IPAM is enabled you land directly on the Dashboard. If it is not, the same route renders the setup wizard.
Header
The header summarises the deployment on one line: the host account, the home Region, how many accounts are enrolled across how many operating Regions, and Data as of, a relative time such as 12 min ago.
Alongside it sits a Refresh button that pulls the latest inventory from AWS.
"Data as of" is AWS's sweep time, not Prism's fetch time, and the difference matters. Prism can re-read AWS as often as you like, but AWS's discovery is a periodic background sweep. Reading a five-minute-old sweep twice does not make it fresher. The label reports the newest sweep timestamp AWS attached to your data, which is the only honest freshness answer available for a sweep Prism does not control.
Cost and Metering
A dedicated panel reports what VPC IPAM is costing, because no other Prism capability puts a running charge on your own AWS bill.
| Stat | Meaning |
|---|---|
| Metered active IPs | How many active IP addresses AWS is currently metering across your enrolled accounts and operating Regions |
| Estimated monthly cost | That count at the Advanced-tier rate of $0.00027 per active IP per hour |
| Metered account | The account AWS charges, always the host account. Shown with a lock, because Prism cannot change it |
| Tier | Always Advanced while the capability is enabled |
The metered count includes addresses that are in no pool. IPAM meters everything it discovers, not only what it hands out. An account full of untouched default VPCs contributes to this figure exactly like an account you have carefully carved out of a pool hierarchy.
The two levers that move this number are which accounts are enrolled (Accounts) and which operating Regions are selected (Settings).
The monthly figure is an estimate at list price, computed from the current count projected across a month. Your actual bill depends on how the count changes over the month, on Region-specific rates, and on whether AWS prorates, which is not something Prism can observe. Treat it as a magnitude, not an invoice.
Address Space Totals
The main tile row summarizes what AWS has discovered.
| Stat | Meaning |
|---|---|
| Discovered CIDRs | Every VPC, subnet and other resource CIDR AWS found across the enrolled accounts and operating Regions |
| VPCs | How many of those are VPCs. This is the denominator for every posture figure below |
| Accounts discovered | How many enrolled accounts have actually appeared in a completed sweep. Compare with the enrolled count in the header: a gap here is the signal, not the totals |
| Public IPv4 addresses | Public addresses found by Public IP Insights, with the count of idle ones called out separately |
Tiles link through to the page that explains them: the CIDR tiles open Address Space, the accounts tile opens Accounts.
Idle public IPv4 addresses are a bill you can act on today. AWS charges for allocated public IPv4 addresses whether or not anything is attached to them, so a public address whose association status reads disassociated is money spent on nothing. The Public IPs view on Address Space lists them.
Utilization
A worst utilization panel lists the pools closest to full, highest first, each with a bar.
Bars are coloured by threshold, using the same palette the status chips elsewhere in the portal use, so a pool that is 92% full has a red bar and a "Nearly full" chip that are the same red:
| Utilization | Colour |
|---|---|
| Below 70% | Green |
| 70% to under 90% | Amber |
| 90% and above | Red |
Selecting a row opens that pool on the Pools page.
Utilization is not computable for IPv6, and that is not the same as 0%. AWS does not calculate IP usage for IPv6 address space, so IPv6 rows carry no figure at all. Prism renders those as a muted em dash with a tooltip, and no bar is drawn, in either direction.
This is deliberate. A 0% bar would say "this pool is empty", and an animated indeterminate bar would say "still loading". Both are lies about a number that is never going to arrive.
Thresholds are read differently on different screens, because 90% of a /16 is comfortable and 90% of a /28 is an outage. Pool rows use the 70/90 bands above; subnet rows on Address Space tighten to 80/95.
Compliance and Overlap
Two counts report the posture AWS computes for your address space.
| Count | Meaning |
|---|---|
| Overlapping | CIDRs that overlap another CIDR within the same IPAM scope. This is the flagship signal: two accounts that independently built on 172.31.0.0/16 are reported here, with no AWS Organizations integration required |
| Non-compliant | CIDRs that do not conform to the rules of the pool they were allocated from |
Both open Address Space filtered to the matching rows.
Every count in this section is VPC-scoped, and the page says so on screen. AWS populates compliance, overlap and management state only on vpc rows. Subnets, which are usually the large majority of your discovered CIDRs, carry no posture at all, while still carrying a real utilization figure.
Prism marks those blanks as not applicable and excludes them from every denominator rather than folding them into a band. A rollup that counted blanks as "compliant" would understate overlap across most of your inventory. On the table they render as a muted em dash, never as a chip: an unknown state must never read as a clean one.
A freshly allocated resource can legitimately read as unmanaged for several minutes. Management state is an eventually consistent observation: a VPC created from a pool has been measured taking about 7 minutes to settle from absent to managed, and about 12 minutes cross-account. Prism holds a recently discovered row as pending rather than reporting it as non-compliant, so a VPC you created five minutes ago does not appear on this Dashboard as a problem you need to fix.
Discovery Health
A rollup of how many enrolled accounts are actually being discovered, and how many are not.
Health is judged by the absence of a failure code, not by a positive signal: AWS does not report "healthy", it reports problems. An account with no failure code and a successful sweep timestamp is healthy; an account with neither yet is cold, not broken. Accounts has the full grid and the reasoning.
When any account stops being discovered, a warning banner appears above everything else on this page, and it is not dismissible:
N of M accounts are no longer being discovered. Their resource discovery was deleted or their RAM share was revoked, so anything in those accounts is missing from every table on this page, however clean it looks. → Review on the Accounts page
A coverage gap is always drawn above the results, because the results look better when data is missing. Every total, every posture count and every utilization figure below the banner covers only the accounts that are still reporting.
Refreshing
Click Refresh to re-read AWS. The button is disabled while a refresh is already running, and a progress bar with a unit count appears beneath the header.
A refresh walks, in order:
- The IPAM itself, its scopes, and the state of every discovery association
- The pool hierarchy, provisioned CIDRs, and allocations
- The discovered inventory and public addresses, per discovery and Region
Rows AWS no longer reports are pruned, so a VPC you deleted drops out of the tables rather than lingering.
Pruning only happens for units the refresh walked completely. If a refresh is cut short for one account or Region, Prism keeps that unit's existing rows rather than deleting rows it simply did not reach. An interrupted refresh never looks like your address space suddenly shrank.
Refreshing pulls Prism's copy of AWS's data up to date. It does not make AWS sweep. If the underlying sweep is old, Data as of stays old however many times you press the button, and that is the correct behaviour, not a stuck refresh.
Partial and Failed Refreshes
Each account and Region is read independently, so a refresh finishing with gaps is an ordinary outcome. When that happens a warning banner reports how many units were read, how many could not be reached, and states that the figures below cover only what was read.
If the refresh job fails outright, an error panel replaces the progress bar with the job's message and a retry action.
A refresh that returns zero rows on a first sweep is not a failure, and Prism does not count it as one. Nothing on this page computes a degraded state from "no rows fetched". See the cold start below.
Empty States
Three states can leave this page without figures, and they never render identically, because acting on them differs completely.
| State | What you see | What to do |
|---|---|---|
| Cold start | "AWS is still taking its first inventory", an indeterminate progress bar, one status chip per account-and-Region association, and a Check for results button | Nothing. The first sweep can take up to about 20 minutes. The chips confirm the associations are healthy |
| Genuinely empty | A scoped message naming exactly what was searched: how many accounts, how many Regions, as of when | Confirm the accounts and Regions in scope are the ones you expected |
| Silent breakage | The non-dismissible coverage-gap banner above, naming the accounts that stopped reporting | Open Accounts and repair the affected accounts |
The cold state is decided by whether AWS has ever completed a sweep for this configuration, not by a timer in your browser. Reloading the page does not move it along, and it clears itself the moment the first discovered row lands.
Prism never renders a bare "No resources found" here. A zero that does not name its scope is indistinguishable from a broken pipeline, which is exactly the ambiguity these three states exist to remove.
Related Pages
- Address Space, Every discovered CIDR, its posture, and the public-IP inventory
- Pools, The pool hierarchy, provisioned CIDRs, and the allocation ledger
- Accounts, Enrollment and discovery health, and the cold start
- Settings, Operating Regions, tier and cost, and permissions
- VPC IPAM, The tier, the meter, and the architecture
- Security Hub Issues, Troubleshooting refresh and discovery problems