Settings
The Settings page is where you change the two levers that move your IPAM bill, see what the capability is costing and who is being charged, check and repair the permissions Prism needs in each account, and reach the teardown controls.
Accessing Settings
In the Security Hub sidebar, click VPC IPAM > Settings.
If IPAM has not been set up yet, the page shows an info banner with a Go to setup button that opens the setup wizard.
The page has four tabs: Operating regions, Tier & cost, Permissions, and Danger zone.
When Saving Is Unavailable
Saving requires a settled configuration, which means status Enabled or Partial Failure.
- While an IPAM operation is running, a progress bar at the top reads that settings are locked until it finishes, and the page polls until it does. You do not need to reload.
- If setup failed, a red banner says so and offers to re-run setup. Regions and tier cannot be changed until it is re-run, but the Danger zone still works, because it is the way out of that state.
Each Save is also disabled until you actually change something.
Operating Regions Tab
Adds or removes the AWS Regions VPC IPAM discovers in.
- Home Region: shown read-only. It is where the IPAM lives and it cannot be changed after enablement, because an IPAM belongs to the Region it was created in
- Operating Regions: a multi-select. The home Region is locked in the list and cannot be deselected
Change your selection and click Save regions. If the change removes any Region, a confirmation dialog opens first, naming exactly what will be torn down.
Operating Regions are a cost lever, not a display filter.
Adding a Region extends discovery (and therefore the Advanced-tier meter) into that Region for every enrolled account. Every active IP AWS finds there starts being billed.
Removing a Region stops discovery there and drops that Region's cached inventory from Prism. Adding it back later starts a fresh cold start rather than restoring what was dropped.
Removing a Region does not remove pools localised to it, and it does not release allocations. It stops the discovery. A pool whose locale you have removed from the operating-Region list still exists, still holds its allocations, and still blocks teardown exactly as it did before: it is simply no longer being inventoried.
VPC IPAM is not available in every AWS Region, and Prism validates your selection before making any AWS call, so an unsupported Region is rejected with a message naming the Region. Opt-in Regions are checked per account: an account that has not opted in is reported against that account rather than failing the whole update.
A Region change fans out across every enrolled account, so a save hands you off to the Accounts page. That is where a per-account failure becomes something you can act on.
Tier and Cost Tab
Reports what VPC IPAM is costing, what tier the IPAM is on, and who AWS is charging.
| Field | Meaning |
|---|---|
| Tier | Advanced while the capability is enabled. Advanced is mandatory for multi-account use |
| Rate | $0.00027 per active IP per hour, roughly $0.197 per IP per month (indicative us-east-1 list price) |
| Metered active IPs | The current count across your enrolled accounts and operating Regions |
| Estimated monthly cost | That count projected at the rate above |
| Metered account | The host account, shown with a lock |
| Enrolled accounts and Operating Regions | The two levers that move the count, each linking to where you change it |
The rate shown here and the rate shown in the setup wizard come from one place in the product, so the two screens cannot disagree with each other.
The meter counts every active IP in every enrolled account and operating Region, including IPs in no pool at all. Building a tidy pool hierarchy does not reduce the bill; enrolling fewer accounts or discovering fewer Regions does.
MeteredAccount Is Locked
AWS decides which account is charged for an IPAM through a setting called MeteredAccount. On an IPAM created the way Prism creates one, AWS defaults it to the IPAM's owner (the host account), so the host pays for every active IP across every account you enrol.
Prism does not set this value and cannot change it for you. The lock is not caution; it is structural:
- Moving the charge to each resource's own account requires the value
resource-owner. resource-ownerrequires AWS Organizations integration and an IPAM created by a delegated administrator.- Prism uses neither, by design and permanently. It holds no management-account access and registers no delegated administrator.
So the setting is displayed as a read-only mirror of what AWS reports, with a lock, and Prism never sends it.
Do not change MeteredAccount yourself in the AWS console expecting Prism to follow. AWS applies a lock after the change (a window in which it cannot be opted out of, followed by a longer period in which it cannot be changed again), and the target value is unreachable on an IPAM that has no Organizations integration behind it. Prism will report whatever AWS reports, but the change cannot give you per-account cost distribution on this deployment.
The scope of the charge is the accounts you enrolled, not your organization. Accounts Prism has not associated are neither discovered nor metered. In a shared-payer organization that distinction is the difference between a bounded cost and an alarming one.
Changing the Tier
A tier control exists, and the direction that matters is the one you cannot take.
Advanced to Free is not an undo. AWS blocks the downgrade until all of the following are cleaned up:
- Private-scope pools
- Non-default private scopes
- Pools whose locale is not the home Region
- Non-default resource discovery associations
- Allocations not owned by the IPAM owner
In other words: a real multi-account deployment cannot be downgraded without dismantling itself first, at which point the capability no longer does anything. Teardown is the exit, not a tier flip.
A tier change is a long precondition chain that can fail several minutes in, on any of the five conditions above. Prism narrates it as its own operation rather than as a settings save, so a multi-minute failure is not captioned as though a checkbox did not stick.
If someone flips the IPAM to the Free tier outside Prism, every association becomes invalid. The Free tier is single-account and single-Region, so a Free IPAM cannot hold more than one resource discovery. Prism detects the drift on its next refresh and says so on the configuration rather than reporting an inventory that has quietly stopped updating.
Permissions Tab
Prism needs an enumerated set of EC2, RAM and Service Quotas permissions in each enrolled account, attached as a policy named CKPrism-IPAM-Permissions on that account's access role. This tab reports whether that policy is in place and correct everywhere, and repairs it where it is not.
Opening the tab starts a scan. Each account is listed with its permissions state:
| State | Meaning |
|---|---|
| Current | The expected policy is attached and up to date |
| Needs update | A policy is attached but does not match what Prism expects |
| Missing | No policy is attached |
Fix roles re-applies the policy to the accounts that need it and re-runs the scan. Re-check re-runs the scan without changing anything.
Use this tab when an account failed enrollment with a permissions or access-denied error, when the policy was edited or removed directly in AWS, or after a Prism update changed the required permission set.
Two Documents, One Policy Name
The host account and the member accounts get different policies under the same name, and that is deliberate least privilege:
| Account | What its policy carries |
|---|---|
| Member | Read the IPAM and its discoveries, create and delete its own resource discovery, and share that discovery to the host through AWS RAM |
| Host | All of the above, plus creating and deleting the IPAM, its scopes and its pools, provisioning and deprovisioning CIDRs, allocating and releasing, associating discoveries, and reading the association quota |
A single combined document would leave the permission to delete the IPAM standing permanently on every member account, for an IPAM those accounts do not own. That is not a size question; it is the reason the host account is immutable for the life of the configuration.
What Is Deliberately Absent
Three things are not in the policy, and each omission is load-bearing:
| Absent | Why |
|---|---|
| Every AWS Organizations action | Prism has no route to your management account. No delegated administrator is registered, no trusted access is enabled, and RAM organization-sharing is never turned on. This is the boundary the whole architecture rests on |
| Organizational-unit exclusions on a resource discovery | A resource discovery covers exactly one account (the account that owns it), so under Prism's model there is literally nothing for an exclusion to exclude. The fields would be a no-op |
| Modifying a discovered resource's IPAM tracking | Prism will not turn off IPAM monitoring on your VPC. That would be a data-plane write on a customer-owned resource that silently removes it from overlap tracking in your own IPAM view |
Alongside them, the policy permits creation of the AWS service-linked role VPC IPAM requires, AWSServiceRoleForIPAM, restricted by a condition to the IPAM service and to no other.
This is a standing grant, not a temporary escalation. The policy stays attached for as long as the account is enrolled, and is detached when the account is removed or when IPAM is cleanly disabled.
Danger Zone Tab
Disables VPC IPAM for your entire organization. This tab stays available even when setup has failed, and even after a teardown that did not finish, because re-running teardown is how a still-metering IPAM finally dies.
IPAM's teardown is not a one-shot operation, and it has an outcome no other capability has. It runs as a long-lived, resumable job; it can legitimately end blocked on resources Prism must not delete; it offers a separate escape hatch that destroys data irreversibly; and it leaves residue neither path removes.
All of that has its own page. Read it before you press anything here.
If teardown does not complete, you are still being billed. Advanced-tier charges run until AWS reports the IPAM deleted. A teardown that ends in blocked or partial failure with the IPAM alive leaves a meter running across your whole enrolled footprint, and Prism keeps saying so, persistently and non-dismissibly, until it is resolved.
Related Pages
- Teardown, The blocked outcome, force delete, and the residue ledger
- Accounts, Add, retry and remove accounts, and read discovery health
- Dashboard, The running cost estimate and the posture rollups
- Enabling VPC IPAM, The consent flow and the Region rules
- VPC IPAM, The tier, the meter, and the architecture
- Security Hub Issues, Troubleshooting failed updates and disable operations