{"id":1162,"date":"2026-09-08T07:28:25","date_gmt":"2026-09-08T07:28:25","guid":{"rendered":"https:\/\/www.devopsschool.com\/tutorials\/?p=1162"},"modified":"2026-09-08T07:28:27","modified_gmt":"2026-09-08T07:28:27","slug":"aws-elastic-ip-cross-account-cross-organization-transfer-runbook","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/tutorials\/aws-elastic-ip-cross-account-cross-organization-transfer-runbook\/","title":{"rendered":"AWS Elastic IP Cross-Account \/ Cross-Organization Transfer Runbook"},"content":{"rendered":"\n

Use case:<\/strong> AWS Organization A \/ Account A \u2192 AWS Organization B \/ Account B
Objective:<\/strong> Retain the exact same public IPv4 address while changing AWS account ownership.<\/p>\n\n\n\n

\n\n\n\n

1. Executive Summary<\/h1>\n\n\n\n

Final answer<\/h2>\n\n\n\n

Yes. AWS supports transferring a normal Amazon-provided Elastic IP address between AWS accounts that belong to completely different AWS Organizations.<\/strong><\/p>\n\n\n\n

The accounts do not need to belong to the same AWS Organization<\/strong>. AWS explicitly states that an Elastic IP can be transferred from any AWS account to any other AWS account in the same AWS Region<\/strong>. AWS also explicitly discusses an EIP being transferred to an account outside the Organization<\/strong>, confirming cross-Organization transfers are supported.<\/p>\n\n\n\n

For this migration:<\/p>\n\n\n\n

AWS Organization A\n\u2514\u2500\u2500 Source Account A\n    \u2514\u2500\u2500 EIP 1.2.3.4\n\n             \u2193 ownership transfer\n\nAWS Organization B\n\u2514\u2500\u2500 Destination Account B\n    \u2514\u2500\u2500 SAME public EIP 1.2.3.4\n<\/code><\/pre>\n\n\n\n
The public IPv4 address remains the same<\/strong>.<\/p>\n\n\n\n
However:<\/p>\n\n\n\n
    \n
  • the EIP’s AWS allocation ID changes after successful transfer<\/strong>;<\/li>\n\n\n\n
  • tags do not transfer;<\/li>\n\n\n\n
  • EC2\/ENI\/NAT associations do not transfer;<\/li>\n\n\n\n
  • VPCs do not transfer;<\/li>\n\n\n\n
  • NAT gateways do not transfer;<\/li>\n\n\n\n
  • DNS resources do not transfer;<\/li>\n\n\n\n
  • PTR\/reverse-DNS configuration must be removed before acceptance;<\/li>\n\n\n\n
  • the source and destination must use the same AWS Region<\/strong>.<\/li>\n<\/ul>\n\n\n\n
    AWS’s Knowledge Center specifically shows the destination receiving a new AllocationId<\/code><\/strong> after successful transfer.<\/p>\n\n\n\n
    Important distinction<\/h3>\n\n\n\n
    Operation<\/th>What it means<\/th><\/tr><\/thead>
    Transfer EIP<\/strong><\/td>Changes which AWS account owns the public IPv4 address<\/td><\/tr>
    Associate EIP<\/strong><\/td>Connects an EIP to an EC2 instance or ENI<\/td><\/tr>
    NAT Gateway EIP<\/strong><\/td>NAT gateway consumes an EIP; NAT gateway itself does not transfer<\/td><\/tr>
    Move EC2<\/strong><\/td>Separate migration operation<\/td><\/tr>
    Move NAT Gateway<\/strong><\/td>Not supported; recreate it<\/td><\/tr>
    Move VPC<\/strong><\/td>Not part of EIP transfer; recreate\/migrate networking independently<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
    \n\n\n\n
    2. Supported and Unsupported Scenarios<\/h1>\n\n\n\n
    Scenario<\/th>Supported?<\/th>Notes<\/th><\/tr><\/thead>
    Same AWS account<\/td>N\/A<\/td>No ownership transfer needed; just associate\/disassociate<\/td><\/tr>
    Different accounts, same Organization<\/td>\u2705<\/td>Supported<\/td><\/tr>
    Different accounts, different Organizations<\/td>\u2705<\/td>Explicitly supported<\/td><\/tr>
    Different Regions<\/td>\u274c<\/td>Source and destination must use same Region<\/td><\/tr>
    Standard Amazon-provided EC2 EIP<\/td>\u2705<\/td>Normal supported case<\/td><\/tr>
    BYOIP EIP<\/td>\u274c<\/td>AWS explicitly excludes BYOIP addresses<\/td><\/tr>
    Amazon-provided contiguous EIP from IPAM pool<\/td>\u274c<\/td>Use IPAM sharing instead<\/td><\/tr>
    Customer-owned IP \/ Outposts CoIP<\/td>\u274c<\/td>Cannot use EIP transfer<\/td><\/tr>
    EIP associated with EC2<\/td>\u26a0\ufe0f<\/td>Transfer can be enabled, but acceptance fails until disassociated<\/td><\/tr>
    EIP associated with ENI<\/td>\u26a0\ufe0f<\/td>Same restriction<\/td><\/tr>
    Primary EIP on NAT Gateway<\/td>\u26a0\ufe0f<\/td>Must be freed before transfer completion; normally delete NAT gateway<\/td><\/tr>
    Secondary EIP on NAT Gateway<\/td>\u26a0\ufe0f<\/td>Can be disassociated using NAT gateway address APIs<\/td><\/tr>
    Reverse DNS\/PTR configured<\/td>\u26a0\ufe0f<\/td>Transfer can start, but destination cannot accept until PTR is removed<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
    AWS documents the same-Region restriction, BYOIP\/IPAM\/CoIP exclusions, tags reset, reverse-DNS restriction, and cross-Organization behavior explicitly.<\/p>\n\n\n\n
    \n\n\n\n
    3. Requirements and Prerequisites<\/h1>\n\n\n\n
    Record these before starting:<\/p>\n\n\n\n
    Source Account ID\nDestination Account ID\nAWS Region\nPublic EIP\nSource Allocation ID\nAssociation ID\nNetwork Interface ID\nInstance ID\nNAT Gateway ID\nSubnet ID\nAvailability Zone\nNetwork Border Group\nRoute tables\nEIP tags\nPTR record\nExternal allowlists\nTerraform resource addresses\/state\n<\/code><\/pre>\n\n\n\n
    Use:<\/p>\n\n\n\n
    export AWS_REGION=ap-northeast-1\n\nexport SOURCE_PROFILE=evp-staging-old\nexport DEST_PROFILE=evp-staging-new\n\nexport SOURCE_ACCOUNT_ID=111111111111\nexport DEST_ACCOUNT_ID=222222222222\n\nexport EIP=1.2.3.4\nexport SOURCE_ALLOCATION_ID=eipalloc-xxxxxxxxxxxxxxxxx\n<\/code><\/pre>\n\n\n\n
    AWS CLI<\/h2>\n\n\n\n
    Use AWS CLI v2<\/strong>.<\/p>\n\n\n\n
    AWS’s EIP-transfer documentation does not state a specific minimum CLI-v2 version. Current CLI v2 contains all required commands:<\/p>\n\n\n\n
    enable-address-transfer\ndisable-address-transfer\naccept-address-transfer\ndescribe-address-transfers\n<\/code><\/pre>\n\n\n\n
    AWS CLI v1 entered maintenance mode in August 2026, so new production automation should use CLI v2.<\/p>\n\n\n\n
    Verify:<\/p>\n\n\n\n
    aws --version\n\naws ec2 enable-address-transfer help\naws ec2 accept-address-transfer help\n<\/code><\/pre>\n\n\n\n
    \n\n\n\n
    4. IAM Permissions<\/h1>\n\n\n\n
    The exact EC2 IAM actions exist in AWS’s current Service Authorization Reference.<\/p>\n\n\n\n
    Core source-account permissions<\/h2>\n\n\n\n
    ec2:EnableAddressTransfer\nec2:DisableAddressTransfer\nec2:DescribeAddressTransfers\nec2:DescribeAddresses\nec2:DescribeAddressesAttribute\n<\/code><\/pre>\n\n\n\n
    Depending on the attachment:<\/p>\n\n\n\n
    ec2:DisassociateAddress\nec2:ResetAddressAttribute\n\nec2:DescribeInstances\nec2:DescribeNetworkInterfaces\n\nec2:DescribeNatGateways\nec2:DeleteNatGateway\n\nec2:DescribeRouteTables\nec2:DescribeSubnets\n<\/code><\/pre>\n\n\n\n
    ec2:DisassociateAddress<\/code> is the documented action for EC2\/ENI EIP disassociation.<\/p>\n\n\n\n
    Core destination-account permissions<\/h2>\n\n\n\n
    ec2:AcceptAddressTransfer\nec2:DescribeAddresses\nec2:DescribeAddressTransfers\nec2:CreateTags\nec2:AssociateAddress\n<\/code><\/pre>\n\n\n\n
    NAT migration can additionally require:<\/p>\n\n\n\n
    ec2:CreateNatGateway\nec2:DescribeNatGateways\nec2:CreateRoute\nec2:ReplaceRoute\nec2:DeleteRoute\n<\/code><\/pre>\n\n\n\n
    Reverse DNS recreation can require:<\/p>\n\n\n\n
    ec2:ModifyAddressAttribute\nec2:DescribeAddressesAttribute\n<\/code><\/pre>\n\n\n\n
    AWS confirms AcceptAddressTransfer<\/code>, AssociateAddress<\/code>, EnableAddressTransfer<\/code>, DisableAddressTransfer<\/code>, ResetAddressAttribute<\/code>, and the related Describe actions in its authorization reference.<\/p>\n\n\n\n
    SCPs and permission boundaries<\/h2>\n\n\n\n
    AWS Organizations itself is not required to perform the transfer<\/strong>.<\/p>\n\n\n\n
    However, an SCP such as:<\/p>\n\n\n\n
    {\n  \"Effect\": \"Deny\",\n  \"Action\": \"ec2:*\",\n  \"Resource\": \"*\"\n}\n<\/code><\/pre>\n\n\n\n
    could block the migration even when the IAM role itself has AdministratorAccess.<\/p>\n\n\n\n
    Permissions boundaries, SCPs, session policies, and IAM policies are evaluated together; an explicit deny wins.<\/p>\n\n\n\n
    \n\n\n\n
    5. Destination EIP Quota<\/h1>\n\n\n\n
    Default AWS VPC quota:<\/p>\n\n\n\n
    Elastic IP addresses per Region = 5\n<\/code><\/pre>\n\n\n\n
    It is adjustable.<\/p>\n\n\n\n
    The quota code is:<\/p>\n\n\n\n
    L-0263D0A3\n<\/code><\/pre>\n\n\n\n
    Check destination quota:<\/p>\n\n\n\n
    aws service-quotas get-service-quota \\\n  --service-code ec2 \\\n  --quota-code L-0263D0A3 \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$DEST_PROFILE\"\n<\/code><\/pre>\n\n\n\n
    Count destination EIPs:<\/p>\n\n\n\n
    aws ec2 describe-addresses \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$DEST_PROFILE\" \\\n  --query 'length(Addresses)'\n<\/code><\/pre>\n\n\n\n
    If quota is exhausted, acceptance can fail with:<\/p>\n\n\n\n
    AddressLimitExceeded\n<\/code><\/pre>\n\n\n\n
    AWS explicitly documents this failure mode.<\/p>\n\n\n\n
    \n\n\n\n
    6. Pre-Migration Discovery<\/h1>\n\n\n\n
    Confirm source identity<\/h2>\n\n\n\n
    aws sts get-caller-identity \\\n  --profile \"$SOURCE_PROFILE\"\n<\/code><\/pre>\n\n\n\n
    Expected account:<\/p>\n\n\n\n
    111111111111\n<\/code><\/pre>\n\n\n\n
    Do not continue if it differs.<\/p>\n\n\n\n
    Discover the EIP<\/h2>\n\n\n\n
    aws ec2 describe-addresses \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$SOURCE_PROFILE\"\n<\/code><\/pre>\n\n\n\n
    For a specific EIP:<\/p>\n\n\n\n
    aws ec2 describe-addresses \\\n  --public-ips \"$EIP\" \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$SOURCE_PROFILE\"\n<\/code><\/pre>\n\n\n\n
    Useful filtered output:<\/p>\n\n\n\n
    aws ec2 describe-addresses \\\n  --public-ips \"$EIP\" \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$SOURCE_PROFILE\" \\\n  --query 'Addresses[0].{\n    PublicIp:PublicIp,\n    AllocationId:AllocationId,\n    AssociationId:AssociationId,\n    InstanceId:InstanceId,\n    NetworkInterfaceId:NetworkInterfaceId,\n    PrivateIpAddress:PrivateIpAddress,\n    NetworkBorderGroup:NetworkBorderGroup,\n    PublicIpv4Pool:PublicIpv4Pool,\n    Tags:Tags\n  }'\n<\/code><\/pre>\n\n\n\n
    Check:<\/p>\n\n\n\n
    PublicIpv4Pool = amazon\n<\/code><\/pre>\n\n\n\n
    for a conventional Amazon-provided EIP.<\/p>\n\n\n\n
    \n\n\n\n
    7. Determine Whether EIP Belongs to a NAT Gateway<\/h1>\n\n\n\n
    aws ec2 describe-nat-gateways \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$SOURCE_PROFILE\" \\\n  --query \"NatGateways[?NatGatewayAddresses[?PublicIp=='${EIP}']].{\n    NatGatewayId:NatGatewayId,\n    State:State,\n    SubnetId:SubnetId,\n    VpcId:VpcId,\n    Addresses:NatGatewayAddresses\n  }\"\n<\/code><\/pre>\n\n\n\n
    If you get a NAT gateway ID:<\/p>\n\n\n\n
    export SOURCE_NAT_GW_ID=nat-xxxxxxxxxxxxxxxxx\n<\/code><\/pre>\n\n\n\n
    Inspect it:<\/p>\n\n\n\n
    aws ec2 describe-nat-gateways \\\n  --nat-gateway-ids \"$SOURCE_NAT_GW_ID\" \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$SOURCE_PROFILE\"\n<\/code><\/pre>\n\n\n\n
    Find routes using it:<\/p>\n\n\n\n
    aws ec2 describe-route-tables \\\n  --filters \"Name=route.nat-gateway-id,Values=$SOURCE_NAT_GW_ID\" \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$SOURCE_PROFILE\"\n<\/code><\/pre>\n\n\n\n
    \n\n\n\n
    8. Why a NAT Gateway Does Not Transfer<\/h1>\n\n\n\n
    An EIP transfer changes ownership of the IP address only<\/strong>.<\/p>\n\n\n\n
    The following remain in the source account:<\/p>\n\n\n\n
    VPC\nSubnet\nInternet Gateway\nRoute Table\nNAT Gateway\nNAT Gateway ENI\nSecurity configuration\n<\/code><\/pre>\n\n\n\n
    For a conventional zonal NAT gateway, the primary EIP cannot simply be detached and moved while keeping the gateway alive.<\/p>\n\n\n\n
    AWS provides DisassociateNatGatewayAddress<\/code> only for secondary<\/strong> EIPs. AWS explicitly states:<\/p>\n\n\n\n
    \n
    You cannot disassociate your primary EIP.<\/p>\n<\/blockquote>\n\n\n\n
    Deleting the NAT gateway:<\/p>\n\n\n\n
      \n
    • disassociates the EIP;<\/li>\n\n\n\n
    • does not<\/strong> release the EIP;<\/li>\n\n\n\n
    • leaves routes pointing to the deleted NAT gateway in blackhole<\/code> state until changed.<\/li>\n<\/ul>\n\n\n\n
      This is the crucial behavior for the migration.<\/p>\n\n\n\n
      \n\n\n\n
      9. Pre-Transfer Evidence \/ Backup<\/h1>\n\n\n\n
      Create a migration directory:<\/p>\n\n\n\n
      mkdir -p eip-transfer-backup\ncd eip-transfer-backup\n<\/code><\/pre>\n\n\n\n
      Save identity:<\/p>\n\n\n\n
      aws sts get-caller-identity \\\n  --profile \"$SOURCE_PROFILE\" \\\n  > source-account.json\n<\/code><\/pre>\n\n\n\n
      Save EIP:<\/p>\n\n\n\n
      aws ec2 describe-addresses \\\n  --public-ips \"$EIP\" \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$SOURCE_PROFILE\" \\\n  > source-eip.json\n<\/code><\/pre>\n\n\n\n
      Save tags separately:<\/p>\n\n\n\n
      aws ec2 describe-addresses \\\n  --public-ips \"$EIP\" \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$SOURCE_PROFILE\" \\\n  --query 'Addresses[0].Tags' \\\n  > eip-tags.json\n<\/code><\/pre>\n\n\n\n
      Inspect PTR:<\/p>\n\n\n\n
      aws ec2 describe-addresses-attribute \\\n  --allocation-ids \"$SOURCE_ALLOCATION_ID\" \\\n  --attribute domain-name \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$SOURCE_PROFILE\" \\\n  > reverse-dns.json 2>&1 || true\n<\/code><\/pre>\n\n\n\n
      Save NAT gateway:<\/p>\n\n\n\n
      aws ec2 describe-nat-gateways \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$SOURCE_PROFILE\" \\\n  > nat-gateways.json\n<\/code><\/pre>\n\n\n\n
      Save route tables:<\/p>\n\n\n\n
      aws ec2 describe-route-tables \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$SOURCE_PROFILE\" \\\n  > route-tables.json\n<\/code><\/pre>\n\n\n\n
      Save ENIs:<\/p>\n\n\n\n
      aws ec2 describe-network-interfaces \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$SOURCE_PROFILE\" \\\n  > network-interfaces.json\n<\/code><\/pre>\n\n\n\n
      Document outside AWS:<\/p>\n\n\n\n
      MongoDB Atlas IP allowlists\nConfluent Cloud IP allowlists\nPartner\/vendor firewalls\nThird-party SaaS allowlists\nOffice\/on-prem firewalls\nExternal DNS records\nMonitoring dependencies\nWebhook\/firewall restrictions\n<\/code><\/pre>\n\n\n\n
      Because the public IP remains identical<\/strong>, existing IP allowlists normally do not need to change, but they absolutely should be tested after cutover.<\/p>\n\n\n\n
      \n\n\n\n
      10. Reverse DNS \/ PTR Check<\/h1>\n\n\n\n
      Check:<\/p>\n\n\n\n
      aws ec2 describe-addresses-attribute \\\n  --allocation-ids \"$SOURCE_ALLOCATION_ID\" \\\n  --attribute domain-name \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$SOURCE_PROFILE\"\n<\/code><\/pre>\n\n\n\n
      Example:<\/p>\n\n\n\n
      {\n  \"Addresses\": [\n    {\n      \"PublicIp\": \"1.2.3.4\",\n      \"AllocationId\": \"eipalloc-...\",\n      \"PtrRecord\": \"mail.example.com.\"\n    }\n  ]\n}\n<\/code><\/pre>\n\n\n\n
      If a PTR exists, AWS allows transfer initiation, but destination acceptance fails until the PTR record is removed.<\/p>\n\n\n\n
      Remove it:<\/p>\n\n\n\n
      aws sts get-caller-identity \\\n  --profile \"$SOURCE_PROFILE\"\n\naws ec2 reset-address-attribute \\\n  --allocation-id \"$SOURCE_ALLOCATION_ID\" \\\n  --attribute domain-name \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$SOURCE_PROFILE\"\n<\/code><\/pre>\n\n\n\n
      AWS documents reset-address-attribute<\/code> for PTR removal.<\/p>\n\n\n\n
      After the migration, recreate it with the new destination allocation ID<\/strong>:<\/p>\n\n\n\n
      aws ec2 modify-address-attribute \\\n  --allocation-id \"$DEST_ALLOCATION_ID\" \\\n  --domain-name mail.example.com \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$DEST_PROFILE\"\n<\/code><\/pre>\n\n\n\n
      \n\n\n\n
      11. AWS Console \u2014 Source Account<\/h1>\n\n\n\n
      Use the source account.<\/p>\n\n\n\n
      Navigate:<\/p>\n\n\n\n
      AWS Console\n\u2192 EC2\n\u2192 Network & Security\n\u2192 Elastic IP addresses\n<\/code><\/pre>\n\n\n\n
      Then:<\/p>\n\n\n\n
      Select EIP\n\u2192 Actions\n\u2192 Enable transfer\n<\/code><\/pre>\n\n\n\n
      AWS currently calls the operation Enable transfer<\/strong>. UI wording can evolve slightly.<\/p>\n\n\n\n
      For multiple EIPs choose:<\/p>\n\n\n\n
      Single account\n<\/code><\/pre>\n\n\n\n
      or:<\/p>\n\n\n\n
      Multiple accounts\n<\/code><\/pre>\n\n\n\n
      Enter:<\/p>\n\n\n\n
      Destination AWS Account ID\n<\/code><\/pre>\n\n\n\n
      Example:<\/p>\n\n\n\n
      222222222222\n<\/code><\/pre>\n\n\n\n
      AWS requires confirmation:<\/p>\n\n\n\n
      enable\n<\/code><\/pre>\n\n\n\n
      Then choose:<\/p>\n\n\n\n
      Submit\n<\/code><\/pre>\n\n\n\n
      The source account should show:<\/p>\n\n\n\n
      Transfer status = Pending\n<\/code><\/pre>\n\n\n\n
      AWS does not<\/strong> notify the destination account automatically.<\/p>\n\n\n\n
      \n\n\n\n
      12. AWS CLI \u2014 Source Account<\/h1>\n\n\n\n
      First verify identity:<\/p>\n\n\n\n
      aws sts get-caller-identity \\\n  --profile \"$SOURCE_PROFILE\"\n<\/code><\/pre>\n\n\n\n
      Then:<\/p>\n\n\n\n
      aws ec2 enable-address-transfer \\\n  --allocation-id \"$SOURCE_ALLOCATION_ID\" \\\n  --transfer-account-id \"$DEST_ACCOUNT_ID\" \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$SOURCE_PROFILE\"\n<\/code><\/pre>\n\n\n\n
      This exact command\/API is documented by AWS.<\/p>\n\n\n\n
      Example result:<\/p>\n\n\n\n
      {\n  \"AddressTransfer\": {\n    \"PublicIp\": \"1.2.3.4\",\n    \"AllocationId\": \"eipalloc-source...\",\n    \"TransferAccountId\": \"222222222222\",\n    \"TransferOfferExpirationTimestamp\": \"...\",\n    \"AddressTransferStatus\": \"pending\"\n  }\n}\n<\/code><\/pre>\n\n\n\n
      Verify:<\/p>\n\n\n\n
      aws ec2 describe-address-transfers \\\n  --allocation-ids \"$SOURCE_ALLOCATION_ID\" \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$SOURCE_PROFILE\"\n<\/code><\/pre>\n\n\n\n
      Look for:<\/p>\n\n\n\n
      AddressTransferStatus = pending\nTransferAccountId = destination account\nPublicIp = expected EIP\n<\/code><\/pre>\n\n\n\n
      \n\n\n\n
      13. Transfer Expiration<\/h1>\n\n\n\n
      The authoritative EC2 User Guide and EC2 API Reference state:<\/p>\n\n\n\n
      Destination has 7 days to accept the transfer.\n<\/code><\/pre>\n\n\n\n
      After seven days, the transfer expires and ownership remains\/returns to the source account. Accepted transfers remain visible to the source for 14 days.<\/p>\n\n\n\n
      AWS documentation inconsistency<\/h3>\n\n\n\n
      The currently generated AWS CLI reference contains a field description saying “seven hours”<\/strong> in some TransferOfferExpirationTimestamp<\/code> output documentation.<\/p>\n\n\n\n
      This conflicts with:<\/p>\n\n\n\n
        \n
      • EC2 User Guide;<\/li>\n\n\n\n
      • VPC User Guide;<\/li>\n\n\n\n
      • EC2 DescribeAddressTransfers<\/code> API Reference;<\/li>\n<\/ul>\n\n\n\n
        which consistently state seven days<\/strong>.<\/p>\n\n\n\n
        For operational planning, use the EC2 service documentation value:<\/p>\n\n\n\n
        7 days.<\/strong><\/p>\n\n\n\n
        Also inspect the actual:<\/p>\n\n\n\n
        TransferOfferExpirationTimestamp\n<\/code><\/pre>\n\n\n\n
        returned by AWS for your transfer.<\/p>\n\n\n\n
        \n\n\n\n
        14. Destination Validation Before Acceptance<\/h1>\n\n\n\n
        Confirm destination identity:<\/p>\n\n\n\n
        aws sts get-caller-identity \\\n  --profile \"$DEST_PROFILE\"\n<\/code><\/pre>\n\n\n\n
        It must show:<\/p>\n\n\n\n
        Account = 222222222222\n<\/code><\/pre>\n\n\n\n
        Confirm current Region:<\/p>\n\n\n\n
        aws configure get region \\\n  --profile \"$DEST_PROFILE\"\n<\/code><\/pre>\n\n\n\n
        Still pass the Region explicitly anyway:<\/p>\n\n\n\n
        --region ap-northeast-1\n<\/code><\/pre>\n\n\n\n
        Check target VPC:<\/p>\n\n\n\n
        aws ec2 describe-vpcs \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$DEST_PROFILE\"\n<\/code><\/pre>\n\n\n\n
        Check target public subnet:<\/p>\n\n\n\n
        aws ec2 describe-subnets \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$DEST_PROFILE\"\n<\/code><\/pre>\n\n\n\n
        Check Internet Gateway:<\/p>\n\n\n\n
        aws ec2 describe-internet-gateways \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$DEST_PROFILE\"\n<\/code><\/pre>\n\n\n\n
        Check EIP quota before acceptance.<\/p>\n\n\n\n
        \n\n\n\n
        15. What Happens to the Allocation ID?<\/h1>\n\n\n\n
        This point is critical.<\/p>\n\n\n\n
        Suppose source has:<\/p>\n\n\n\n
        Public IP:      1.2.3.4\nAllocation ID:  eipalloc-OLD111111\n<\/code><\/pre>\n\n\n\n
        After successful transfer:<\/p>\n\n\n\n
        Public IP:      1.2.3.4\nAllocation ID:  eipalloc-NEW222222\n<\/code><\/pre>\n\n\n\n
        AWS’s own Knowledge Center explicitly states:<\/p>\n\n\n\n
        A successful transfer generates a new AllocationId in the destination owner’s account.<\/strong><\/p>\n\n\n\n
        Therefore:<\/p>\n\n\n\n
        Public IPv4 = SAME\nAllocation ID = CHANGES\n<\/code><\/pre>\n\n\n\n
        Do not<\/strong> configure destination Terraform with the old allocation ID.<\/p>\n\n\n\n
        Do not<\/strong> assume the AllocationId<\/code> shown in the immediate accept-address-transfer<\/code> response is the destination resource ID.<\/p>\n\n\n\n
        After acceptance always run:<\/p>\n\n\n\n
        aws ec2 describe-addresses \\\n  --public-ips \"$EIP\" \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$DEST_PROFILE\"\n<\/code><\/pre>\n\n\n\n
        and obtain the authoritative destination allocation ID.<\/p>\n\n\n\n
        \n\n\n\n
        16. AWS Console \u2014 Destination Account<\/h1>\n\n\n\n
        Sign into the destination account.<\/p>\n\n\n\n
        Navigate:<\/p>\n\n\n\n
        AWS Console\n\u2192 EC2\n\u2192 Network & Security\n\u2192 Elastic IP addresses\n\u2192 Actions\n\u2192 Accept transfer\n<\/code><\/pre>\n\n\n\n
        AWS does not automatically expose a normal “pending EIP” resource in the destination EIP inventory beforehand.<\/p>\n\n\n\n
        Instead, enter the exact public IPv4 address:<\/p>\n\n\n\n
        1.2.3.4\n<\/code><\/pre>\n\n\n\n
        Then choose:<\/p>\n\n\n\n
        Submit\n<\/code><\/pre>\n\n\n\n
        AWS’s console workflow explicitly requires entering the transferred EIP.<\/p>\n\n\n\n
        After successful acceptance:<\/p>\n\n\n\n
        Destination owns EIP\nPublic IP remains identical\nEIP has new Allocation ID\nAddress is initially unassociated\nSource tags are absent\n<\/code><\/pre>\n\n\n\n
        \n\n\n\n
        17. AWS CLI \u2014 Destination Acceptance<\/h1>\n\n\n\n
        Before ownership-changing operation:<\/p>\n\n\n\n
        aws sts get-caller-identity \\\n  --profile \"$DEST_PROFILE\"\n<\/code><\/pre>\n\n\n\n
        Accept:<\/p>\n\n\n\n
        aws ec2 accept-address-transfer \\\n  --address \"$EIP\" \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$DEST_PROFILE\"\n<\/code><\/pre>\n\n\n\n
        The CLI syntax is current and documented.<\/p>\n\n\n\n
        Immediately discover destination allocation:<\/p>\n\n\n\n
        aws ec2 describe-addresses \\\n  --public-ips \"$EIP\" \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$DEST_PROFILE\"\n<\/code><\/pre>\n\n\n\n
        Capture it:<\/p>\n\n\n\n
        export DEST_ALLOCATION_ID=\"$(\n  aws ec2 describe-addresses \\\n    --public-ips \"$EIP\" \\\n    --region \"$AWS_REGION\" \\\n    --profile \"$DEST_PROFILE\" \\\n    --query 'Addresses[0].AllocationId' \\\n    --output text\n)\"\n<\/code><\/pre>\n\n\n\n
        Print:<\/p>\n\n\n\n
        echo \"$DEST_ALLOCATION_ID\"\n<\/code><\/pre>\n\n\n\n
        Verify:<\/p>\n\n\n\n
        aws ec2 describe-addresses \\\n  --allocation-ids \"$DEST_ALLOCATION_ID\" \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$DEST_PROFILE\" \\\n  --query 'Addresses[0].{\n    PublicIp:PublicIp,\n    AllocationId:AllocationId,\n    AssociationId:AssociationId,\n    NetworkBorderGroup:NetworkBorderGroup,\n    Tags:Tags\n  }'\n<\/code><\/pre>\n\n\n\n
        \n\n\n\n
        18. Tags<\/h1>\n\n\n\n
        AWS explicitly states:<\/p>\n\n\n\n
        EIP tags do not transfer.<\/strong><\/p>\n\n\n\n
        They are reset when ownership transfer completes.<\/p>\n\n\n\n
        Before migration:<\/p>\n\n\n\n
        aws ec2 describe-addresses \\\n  --allocation-ids \"$SOURCE_ALLOCATION_ID\" \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$SOURCE_PROFILE\" \\\n  --query 'Addresses[0].Tags' \\\n  > eip-tags.json\n<\/code><\/pre>\n\n\n\n
        After acceptance:<\/p>\n\n\n\n
        aws ec2 create-tags \\\n  --resources \"$DEST_ALLOCATION_ID\" \\\n  --tags file:\/\/eip-tags.json \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$DEST_PROFILE\"\n<\/code><\/pre>\n\n\n\n
        Verify:<\/p>\n\n\n\n
        aws ec2 describe-addresses \\\n  --allocation-ids \"$DEST_ALLOCATION_ID\" \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$DEST_PROFILE\" \\\n  --query 'Addresses[0].Tags'\n<\/code><\/pre>\n\n\n\n
        \n\n\n\n
        19. EC2 Instance Migration Scenario<\/h1>\n\n\n\n
        Source:<\/p>\n\n\n\n
        EC2-A\n\u2514\u2500\u2500 EIP X\n<\/code><\/pre>\n\n\n\n
        Destination:<\/p>\n\n\n\n
        EC2-B\n\u2514\u2500\u2500 SAME EIP X\n<\/code><\/pre>\n\n\n\n
        Identify association:<\/p>\n\n\n\n
        aws ec2 describe-addresses \\\n  --public-ips \"$EIP\" \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$SOURCE_PROFILE\"\n<\/code><\/pre>\n\n\n\n
        Capture:<\/p>\n\n\n\n
        export ASSOCIATION_ID=eipassoc-xxxxxxxx\n<\/code><\/pre>\n\n\n\n
        Disassociate:<\/p>\n\n\n\n
        aws sts get-caller-identity \\\n  --profile \"$SOURCE_PROFILE\"\n\naws ec2 disassociate-address \\\n  --association-id \"$ASSOCIATION_ID\" \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$SOURCE_PROFILE\"\n<\/code><\/pre>\n\n\n\n
        AWS requires the EIP to be disassociated before destination acceptance; otherwise acceptance can fail with:<\/p>\n\n\n\n
        InvalidTransfer.AddressAssociated\n<\/code><\/pre>\n\n\n\n
        Accept from destination.<\/p>\n\n\n\n
        Then:<\/p>\n\n\n\n
        aws ec2 associate-address \\\n  --allocation-id \"$DEST_ALLOCATION_ID\" \\\n  --instance-id i-xxxxxxxxxxxxxxxxx \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$DEST_PROFILE\"\n<\/code><\/pre>\n\n\n\n
        \n\n\n\n
        20. ENI Migration Scenario<\/h1>\n\n\n\n
        Source:<\/p>\n\n\n\n
        ENI-A\n\u2514\u2500\u2500 EIP X\n<\/code><\/pre>\n\n\n\n
        Disassociate:<\/p>\n\n\n\n
        aws ec2 disassociate-address \\\n  --association-id \"$ASSOCIATION_ID\" \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$SOURCE_PROFILE\"\n<\/code><\/pre>\n\n\n\n
        After destination accepts:<\/p>\n\n\n\n
        aws ec2 associate-address \\\n  --allocation-id \"$DEST_ALLOCATION_ID\" \\\n  --network-interface-id eni-xxxxxxxxxxxxxxxxx \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$DEST_PROFILE\"\n<\/code><\/pre>\n\n\n\n
        If targeting a specific secondary private IP:<\/p>\n\n\n\n
        aws ec2 associate-address \\\n  --allocation-id \"$DEST_ALLOCATION_ID\" \\\n  --network-interface-id eni-xxxxxxxxxxxxxxxxx \\\n  --private-ip-address 10.20.1.100 \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$DEST_PROFILE\"\n<\/code><\/pre>\n\n\n\n
        An EIP cannot be associated with an interface whose network border group is incompatible with the EIP.<\/p>\n\n\n\n
        \n\n\n\n
        21. NAT Gateway Migration \u2014 Recommended Production Strategy<\/h1>\n\n\n\n
        This is the most important scenario.<\/p>\n\n\n\n
        Before<\/h2>\n\n\n\n
        Organization A\n\u2514\u2500\u2500 Source AWS Account\n    \u2514\u2500\u2500 VPC-A\n        \u251c\u2500\u2500 Public Subnet\n        \u2502   \u2514\u2500\u2500 NAT Gateway A\n        \u2502       \u2514\u2500\u2500 EIP X = 1.2.3.4\n        \u2502\n        \u2514\u2500\u2500 Private Subnets\n            \u2514\u2500\u2500 EKS \/ EC2 workloads\n<\/code><\/pre>\n\n\n\n
        After<\/h2>\n\n\n\n
        Organization B\n\u2514\u2500\u2500 Destination AWS Account\n    \u2514\u2500\u2500 VPC-B\n        \u251c\u2500\u2500 Public Subnet\n        \u2502   \u2514\u2500\u2500 NAT Gateway B\n        \u2502       \u2514\u2500\u2500 SAME EIP X = 1.2.3.4\n        \u2502\n        \u2514\u2500\u2500 Private Subnets\n            \u2514\u2500\u2500 EKS \/ EC2 workloads\n<\/code><\/pre>\n\n\n\n
        Can EIP X move together with NAT Gateway A?<\/h2>\n\n\n\n
        No.<\/strong><\/p>\n\n\n\n
        NAT Gateway A remains in source account.<\/p>\n\n\n\n
        Can primary EIP be manually disassociated?<\/h2>\n\n\n\n
        No.<\/strong><\/p>\n\n\n\n
        AWS allows explicit disassociation only for secondary NAT gateway EIPs; primary EIP cannot be removed that way.<\/p>\n\n\n\n
        What frees the primary EIP?<\/h2>\n\n\n\n
        Delete the source NAT gateway.<\/p>\n\n\n\n
        aws sts get-caller-identity \\\n  --profile \"$SOURCE_PROFILE\"\n\naws ec2 delete-nat-gateway \\\n  --nat-gateway-id \"$SOURCE_NAT_GW_ID\" \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$SOURCE_PROFILE\"\n<\/code><\/pre>\n\n\n\n
        AWS guarantees that deleting the NAT gateway:<\/p>\n\n\n\n
        disassociates its EIP\ndoes NOT release the EIP\n<\/code><\/pre>\n\n\n\n
        This is exactly what we need.<\/p>\n\n\n\n
        Never run<\/h3>\n\n\n\n
        aws ec2 release-address ...\n<\/code><\/pre>\n\n\n\n
        during this migration.<\/p>\n\n\n\n
        That is not part of ownership transfer.<\/p>\n\n\n\n
        \n\n\n\n
        22. NAT Gateway Minimum-Downtime Sequence<\/h1>\n\n\n\n
        Phase A \u2014 Days\/hours before maintenance<\/h2>\n\n\n\n
        Fully prepare destination:<\/p>\n\n\n\n
        VPC\nCIDRs\npublic\/private subnets\nInternet Gateway\nroute tables\nNACLs\nEKS\nsecurity\napplications\nTerraform\nvendor testing\nmonitoring\n<\/code><\/pre>\n\n\n\n
        Optionally create a temporary NAT gateway using a temporary EIP<\/strong> to validate destination connectivity.<\/p>\n\n\n\n
        This allows destination workloads to be tested before final cutover.<\/p>\n\n\n\n
        Important limitation<\/h3>\n\n\n\n
        A temporary EIP used as the primary EIP<\/strong> of a zonal NAT gateway cannot later simply be removed and replaced by the transferred EIP.<\/p>\n\n\n\n
        Therefore if the final NAT must use only the transferred EIP:<\/p>\n\n\n\n
        temporary NAT\n\u2192 validate\n\u2192 delete temporary NAT\n\u2192 create final NAT with transferred EIP\n<\/code><\/pre>\n\n\n\n
        Alternatively, a transferred EIP could be added as a secondary EIP, but the temporary primary remains. That is usually unsuitable when vendors require one deterministic egress IP.<\/p>\n\n\n\n
        \n\n\n\n
        23. Can Routes Be Prepared?<\/h1>\n\n\n\n
        Yes.<\/p>\n\n\n\n
        You can pre-create:<\/p>\n\n\n\n
        Route tables\nAssociations\nSubnet mappings\nInternet Gateway\nDestination subnet layout\n<\/code><\/pre>\n\n\n\n
        However, the actual route:<\/p>\n\n\n\n
        0.0.0.0\/0 \u2192 final NAT Gateway\n<\/code><\/pre>\n\n\n\n
        cannot point to a NAT gateway that does not yet exist.<\/p>\n\n\n\n
        If using a temporary NAT:<\/p>\n\n\n\n
        Before cutover:\n0.0.0.0\/0 \u2192 temporary NAT\n\nAfter final NAT available:\n0.0.0.0\/0 \u2192 final NAT\n<\/code><\/pre>\n\n\n\n
        Use:<\/p>\n\n\n\n
        aws ec2 replace-route \\\n  --route-table-id rtb-xxxxxxxx \\\n  --destination-cidr-block 0.0.0.0\/0 \\\n  --nat-gateway-id \"$DEST_NAT_GW_ID\" \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$DEST_PROFILE\"\n<\/code><\/pre>\n\n\n\n
        \n\n\n\n
        24. Strict NAT Cutover Runbook<\/h1>\n\n\n\n
        Phase 1 \u2014 Preparation<\/h2>\n\n\n\n
        Confirm:<\/p>\n\n\n\n
        [ ] Source account\n[ ] Destination account\n[ ] ap-northeast-1\n[ ] EIP\n[ ] Allocation ID\n[ ] NAT Gateway\n[ ] Routes\n[ ] tags\n[ ] PTR\n[ ] external allowlists\n[ ] destination quota\n[ ] target subnet\n[ ] target Internet Gateway\n[ ] Terraform\n<\/code><\/pre>\n\n\n\n
        Phase 2 \u2014 Pre-enable transfer<\/h2>\n\n\n\n
        The source can initiate the transfer handshake before final cutover.<\/p>\n\n\n\n
        aws sts get-caller-identity \\\n  --profile \"$SOURCE_PROFILE\"\n\naws ec2 enable-address-transfer \\\n  --allocation-id \"$SOURCE_ALLOCATION_ID\" \\\n  --transfer-account-id \"$DEST_ACCOUNT_ID\" \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$SOURCE_PROFILE\"\n<\/code><\/pre>\n\n\n\n
        Verify:<\/p>\n\n\n\n
        aws ec2 describe-address-transfers \\\n  --allocation-ids \"$SOURCE_ALLOCATION_ID\" \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$SOURCE_PROFILE\"\n<\/code><\/pre>\n\n\n\n
        Do not<\/strong> accept yet.<\/p>\n\n\n\n
        \n\n\n\n
        Phase 3 \u2014 Freeze<\/h2>\n\n\n\n
        Stop infrastructure changes involving:<\/p>\n\n\n\n
        EIP\nNAT\nroute tables\nsubnets\nTerraform\nVPC\n<\/code><\/pre>\n\n\n\n
        Pause automatic Terraform applies.<\/p>\n\n\n\n
        Record final rollback point.<\/p>\n\n\n\n
        \n\n\n\n
        Phase 4 \u2014 Reduce Traffic<\/h2>\n\n\n\n
        Where possible:<\/p>\n\n\n\n
        stop jobs\nstop batch traffic\ndrain application traffic\npause heavy outbound connections\nwait for Kafka\/Mongo long-lived connections to reduce\n<\/code><\/pre>\n\n\n\n
        Existing TCP connections will not survive the NAT replacement.<\/p>\n\n\n\n
        \n\n\n\n
        Phase 5 \u2014 Delete Source NAT<\/h2>\n\n\n\n
        aws sts get-caller-identity \\\n  --profile \"$SOURCE_PROFILE\"\n\naws ec2 delete-nat-gateway \\\n  --nat-gateway-id \"$SOURCE_NAT_GW_ID\" \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$SOURCE_PROFILE\"\n<\/code><\/pre>\n\n\n\n
        Monitor:<\/p>\n\n\n\n
        aws ec2 describe-nat-gateways \\\n  --nat-gateway-ids \"$SOURCE_NAT_GW_ID\" \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$SOURCE_PROFILE\" \\\n  --query 'NatGateways[0].State' \\\n  --output text\n<\/code><\/pre>\n\n\n\n
        Verify EIP is no longer associated:<\/p>\n\n\n\n
        aws ec2 describe-addresses \\\n  --public-ips \"$EIP\" \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$SOURCE_PROFILE\"\n<\/code><\/pre>\n\n\n\n
        You want no active association.<\/p>\n\n\n\n
        \n\n\n\n
        25. Accept the Transfer<\/h1>\n\n\n\n
        Destination identity:<\/p>\n\n\n\n
        aws sts get-caller-identity \\\n  --profile \"$DEST_PROFILE\"\n<\/code><\/pre>\n\n\n\n
        Accept:<\/p>\n\n\n\n
        aws ec2 accept-address-transfer \\\n  --address \"$EIP\" \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$DEST_PROFILE\"\n<\/code><\/pre>\n\n\n\n
        Discover new allocation ID:<\/p>\n\n\n\n
        export DEST_ALLOCATION_ID=\"$(\n  aws ec2 describe-addresses \\\n    --public-ips \"$EIP\" \\\n    --region \"$AWS_REGION\" \\\n    --profile \"$DEST_PROFILE\" \\\n    --query 'Addresses[0].AllocationId' \\\n    --output text\n)\"\n<\/code><\/pre>\n\n\n\n
        Verify:<\/p>\n\n\n\n
        echo \"Transferred EIP: $EIP\"\necho \"Destination allocation ID: $DEST_ALLOCATION_ID\"\n<\/code><\/pre>\n\n\n\n
        \n\n\n\n
        26. Create Destination NAT Gateway<\/h1>\n\n\n\n
        Assume:<\/p>\n\n\n\n
        export DEST_PUBLIC_SUBNET_ID=subnet-xxxxxxxxxxxxxxxxx\n<\/code><\/pre>\n\n\n\n
        Confirm destination:<\/p>\n\n\n\n
        aws sts get-caller-identity \\\n  --profile \"$DEST_PROFILE\"\n<\/code><\/pre>\n\n\n\n
        Create:<\/p>\n\n\n\n
        aws ec2 create-nat-gateway \\\n  --subnet-id \"$DEST_PUBLIC_SUBNET_ID\" \\\n  --allocation-id \"$DEST_ALLOCATION_ID\" \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$DEST_PROFILE\"\n<\/code><\/pre>\n\n\n\n
        Capture the returned:<\/p>\n\n\n\n
        NatGatewayId\n<\/code><\/pre>\n\n\n\n
        Example:<\/p>\n\n\n\n
        export DEST_NAT_GW_ID=nat-xxxxxxxxxxxxxxxxx\n<\/code><\/pre>\n\n\n\n
        Wait until:<\/p>\n\n\n\n
        State = available\n<\/code><\/pre>\n\n\n\n
        Check:<\/p>\n\n\n\n
        aws ec2 describe-nat-gateways \\\n  --nat-gateway-ids \"$DEST_NAT_GW_ID\" \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$DEST_PROFILE\" \\\n  --query 'NatGateways[0].{\n    State:State,\n    NatGatewayId:NatGatewayId,\n    Addresses:NatGatewayAddresses\n  }'\n<\/code><\/pre>\n\n\n\n
        The EIP network border group must match the NAT gateway’s AZ\/network border group.<\/p>\n\n\n\n
        \n\n\n\n
        27. Update Destination Routes<\/h1>\n\n\n\n
        Example:<\/p>\n\n\n\n
        export DEST_PRIVATE_ROUTE_TABLE_ID=rtb-xxxxxxxxxxxxxxxxx\n<\/code><\/pre>\n\n\n\n
        Update:<\/p>\n\n\n\n
        aws ec2 replace-route \\\n  --route-table-id \"$DEST_PRIVATE_ROUTE_TABLE_ID\" \\\n  --destination-cidr-block 0.0.0.0\/0 \\\n  --nat-gateway-id \"$DEST_NAT_GW_ID\" \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$DEST_PROFILE\"\n<\/code><\/pre>\n\n\n\n
        Verify:<\/p>\n\n\n\n
        aws ec2 describe-route-tables \\\n  --route-table-ids \"$DEST_PRIVATE_ROUTE_TABLE_ID\" \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$DEST_PROFILE\"\n<\/code><\/pre>\n\n\n\n
        Confirm:<\/p>\n\n\n\n
        0.0.0.0\/0\n    \u2192\nnew NAT Gateway\n<\/code><\/pre>\n\n\n\n
        \n\n\n\n
        28. Validation<\/h1>\n\n\n\n
        From EC2<\/h2>\n\n\n\n
        curl -s https:\/\/checkip.amazonaws.com\n<\/code><\/pre>\n\n\n\n
        Expected:<\/p>\n\n\n\n
        1.2.3.4\n<\/code><\/pre>\n\n\n\n
        From EKS<\/h2>\n\n\n\n
        kubectl run eip-test \\\n  --image=curlimages\/curl \\\n  --rm -it \\\n  --restart=Never \\\n  -- https:\/\/checkip.amazonaws.com\n<\/code><\/pre>\n\n\n\n
        Expected:<\/p>\n\n\n\n
        1.2.3.4\n<\/code><\/pre>\n\n\n\n
        The kubectl run<\/code> syntax is appropriate for creating a temporary one-shot curl pod.<\/p>\n\n\n\n
        For non-interactive CI-style validation:<\/p>\n\n\n\n
        kubectl run eip-test \\\n  --image=curlimages\/curl \\\n  --restart=Never \\\n  --command -- \\\n  curl -s https:\/\/checkip.amazonaws.com\n<\/code><\/pre>\n\n\n\n
        Then:<\/p>\n\n\n\n
        kubectl logs eip-test\nkubectl delete pod eip-test\n<\/code><\/pre>\n\n\n\n
        From multiple EKS namespaces<\/h2>\n\n\n\n
        kubectl run eip-test \\\n  -n YOUR_NAMESPACE \\\n  --image=curlimages\/curl \\\n  --rm -it \\\n  --restart=Never \\\n  -- https:\/\/checkip.amazonaws.com\n<\/code><\/pre>\n\n\n\n
        \n\n\n\n
        29. Vendor Validation<\/h1>\n\n\n\n
        Test at minimum:<\/p>\n\n\n\n
        MongoDB Atlas\nConfluent Cloud\nexternal REST APIs\nvendor allowlists\nwebhooks\ncontainer registries\nGitHub\nAWS APIs\nDatadog\nSentry\nthird-party SaaS endpoints\n<\/code><\/pre>\n\n\n\n
        Because the outbound IP remains the same, IP-based allowlists should continue to match.<\/p>\n\n\n\n
        However, new TCP\/TLS sessions will be created after NAT replacement.<\/p>\n\n\n\n
        \n\n\n\n
        30. DNS Behavior<\/h1>\n\n\n\n
        A normal Route 53 or external DNS record does not<\/strong> transfer automatically with an EIP.<\/p>\n\n\n\n
        Example:<\/p>\n\n\n\n
        api.example.com \u2192 1.2.3.4\n<\/code><\/pre>\n\n\n\n
        If it already points to 1.2.3.4<\/code>, no DNS-value change is required because the public EIP itself remains unchanged.<\/p>\n\n\n\n
        But the hosted zone and DNS record still belong wherever they were originally managed.<\/p>\n\n\n\n
        This migration:<\/p>\n\n\n\n
        transfers EIP ownership\n<\/code><\/pre>\n\n\n\n
        It does not:<\/p>\n\n\n\n
        transfer Route 53 hosted zones\ntransfer Route 53 records\ntransfer DNS provider ownership\n<\/code><\/pre>\n\n\n\n
        PTR\/reverse DNS is the special case and must be handled separately as described earlier.<\/p>\n\n\n\n
        \n\n\n\n
        31. Terraform \/ IaC \u2014 Critical Rules<\/h1>\n\n\n\n
        This deserves careful handling.<\/p>\n\n\n\n
        Suppose source Terraform contains:<\/p>\n\n\n\n
        resource \"aws_eip\" \"nat\" {\n  domain = \"vpc\"\n\n  lifecycle {\n    prevent_destroy = true\n  }\n}\n\nresource \"aws_nat_gateway\" \"this\" {\n  allocation_id = aws_eip.nat.id\n  subnet_id     = aws_subnet.public.id\n}\n<\/code><\/pre>\n\n\n\n
        Do not<\/strong> simply delete aws_eip.nat<\/code> from Terraform and run apply blindly.<\/p>\n\n\n\n
        The source state currently represents ownership of the EIP.<\/p>\n\n\n\n
        A safe migration separates:<\/p>\n\n\n\n
        AWS ownership operations\nTerraform state ownership\nTerraform configuration\n<\/code><\/pre>\n\n\n\n
        HashiCorp documents that terraform state rm<\/code> removes the Terraform binding while leaving the remote object intact.<\/p>\n\n\n\n
        \n\n\n\n
        32. Terraform Recommended Migration Sequence<\/h1>\n\n\n\n
        A. Back up state<\/h2>\n\n\n\n
        terraform state pull > source-state-before-eip-transfer.json\n<\/code><\/pre>\n\n\n\n
        List resources:<\/p>\n\n\n\n
        terraform state list\n<\/code><\/pre>\n\n\n\n
        Identify:<\/p>\n\n\n\n
        aws_eip.nat\naws_nat_gateway.this\n<\/code><\/pre>\n\n\n\n
        Use the real module paths if applicable:<\/p>\n\n\n\n
        module.vpc.aws_eip.nat[0]\nmodule.vpc.aws_nat_gateway.this[0]\n<\/code><\/pre>\n\n\n\n
        \n\n\n\n
        B. Handle source NAT intentionally<\/h2>\n\n\n\n
        The NAT gateway must actually be deleted as part of the operational migration.<\/p>\n\n\n\n
        The EIP itself must not be released<\/strong>.<\/p>\n\n\n\n
        If lifecycle contains:<\/p>\n\n\n\n
        prevent_destroy = true\n<\/code><\/pre>\n\n\n\n
        do not casually remove it merely to satisfy Terraform.<\/p>\n\n\n\n
        Separate NAT deletion from EIP state transition.<\/p>\n\n\n\n
        \n\n\n\n
        C. After EIP ownership moves<\/h2>\n\n\n\n
        The source Terraform state must no longer claim ownership of the transferred EIP.<\/p>\n\n\n\n
        For example:<\/p>\n\n\n\n
        terraform state rm 'aws_eip.nat'\n<\/code><\/pre>\n\n\n\n
        or:<\/p>\n\n\n\n
        terraform state rm 'module.vpc.aws_eip.nat[0]'\n<\/code><\/pre>\n\n\n\n
        This removes Terraform’s binding without attempting to destroy the remote resource.<\/p>\n\n\n\n
        Remove\/update the corresponding source configuration so a subsequent plan does not attempt to recreate an EIP.<\/p>\n\n\n\n
        \n\n\n\n
        33. Destination Terraform Import<\/h1>\n\n\n\n
        Create the destination configuration first:<\/p>\n\n\n\n
        resource \"aws_eip\" \"nat\" {\n  domain = \"vpc\"\n\n  tags = {\n    Name = \"evp-staging-nat\"\n  }\n}\n<\/code><\/pre>\n\n\n\n
        Then import using the new destination allocation ID<\/strong>:<\/p>\n\n\n\n
        terraform import \\\n  aws_eip.nat \\\n  \"$DEST_ALLOCATION_ID\"\n<\/code><\/pre>\n\n\n\n
        Current HashiCorp AWS Provider documentation explicitly imports aws_eip<\/code> resources using their allocation ID.<\/p>\n\n\n\n
        Modern Terraform can also use:<\/p>\n\n\n\n
        import {\n  to = aws_eip.nat\n  id = \"eipalloc-NEW...\"\n}\n<\/code><\/pre>\n\n\n\n
        HashiCorp recommends one remote object be bound to one Terraform resource address.<\/p>\n\n\n\n
        After import:<\/p>\n\n\n\n
        terraform plan\n<\/code><\/pre>\n\n\n\n
        Expected:<\/p>\n\n\n\n
        no EIP replacement\nno EIP release\nno unexpected allocation\n<\/code><\/pre>\n\n\n\n
        Investigate any EIP destroy\/replace action before applying.<\/p>\n\n\n\n
        \n\n\n\n
        34. Destination NAT Terraform<\/h1>\n\n\n\n
        Then configure:<\/p>\n\n\n\n
        resource \"aws_nat_gateway\" \"this\" {\n  allocation_id = aws_eip.nat.id\n  subnet_id     = aws_subnet.public.id\n\n  depends_on = [\n    aws_internet_gateway.this\n  ]\n\n  tags = {\n    Name = \"evp-staging-nat\"\n  }\n}\n<\/code><\/pre>\n\n\n\n
        Current AWS provider documentation warns against trying to attach NAT gateway EIPs through the generic EIP network_interface<\/code> argument; NAT association should be managed by the NAT resource.<\/p>\n\n\n\n
        \n\n\n\n
        35. Rollback<\/h1>\n\n\n\n
        Rollback depends on where you are.<\/p>\n\n\n\n
        Stage A \u2014 Transfer not initiated<\/h2>\n\n\n\n
        Nothing to reverse.<\/p>\n\n\n\n
        \n\n\n\n
        Stage B \u2014 Transfer pending, destination has not accepted<\/h2>\n\n\n\n
        Source still controls the transfer.<\/p>\n\n\n\n
        Check identity:<\/p>\n\n\n\n
        aws sts get-caller-identity \\\n  --profile \"$SOURCE_PROFILE\"\n<\/code><\/pre>\n\n\n\n
        Cancel:<\/p>\n\n\n\n
        aws ec2 disable-address-transfer \\\n  --allocation-id \"$SOURCE_ALLOCATION_ID\" \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$SOURCE_PROFILE\"\n<\/code><\/pre>\n\n\n\n
        AWS explicitly supports disabling a transfer whose status is pending.<\/p>\n\n\n\n
        If old NAT still exists, service continues normally.<\/p>\n\n\n\n
        \n\n\n\n
        Stage C \u2014 Old NAT deleted, but EIP not accepted<\/h2>\n\n\n\n
        Disable transfer:<\/p>\n\n\n\n
        aws ec2 disable-address-transfer \\\n  --allocation-id \"$SOURCE_ALLOCATION_ID\" \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$SOURCE_PROFILE\"\n<\/code><\/pre>\n\n\n\n
        Then recreate source NAT using the EIP:<\/p>\n\n\n\n
        aws ec2 create-nat-gateway \\\n  --subnet-id \"$SOURCE_PUBLIC_SUBNET_ID\" \\\n  --allocation-id \"$SOURCE_ALLOCATION_ID\" \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$SOURCE_PROFILE\"\n<\/code><\/pre>\n\n\n\n
        Update source routes.<\/p>\n\n\n\n
        \n\n\n\n
        Stage D \u2014 Destination has accepted<\/h2>\n\n\n\n
        disable-address-transfer<\/code> can no longer restore source ownership.<\/p>\n\n\n\n
        The destination now owns the public IP.<\/p>\n\n\n\n
        To return it:<\/p>\n\n\n\n
        Destination account\n\u2192 frees EIP\n\u2192 EnableAddressTransfer back to original account\n\u2192 Original account accepts\n<\/code><\/pre>\n\n\n\n
        Because AWS supports transfer between any two accounts in the same Region, the process can be reversed.<\/p>\n\n\n\n
        Destination:<\/p>\n\n\n\n
        aws ec2 enable-address-transfer \\\n  --allocation-id \"$DEST_ALLOCATION_ID\" \\\n  --transfer-account-id \"$SOURCE_ACCOUNT_ID\" \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$DEST_PROFILE\"\n<\/code><\/pre>\n\n\n\n
        Original source then accepts:<\/p>\n\n\n\n
        aws ec2 accept-address-transfer \\\n  --address \"$EIP\" \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$SOURCE_PROFILE\"\n<\/code><\/pre>\n\n\n\n
        The source will again receive a new allocation ID<\/strong>.<\/p>\n\n\n\n
        \n\n\n\n
        Stage E \u2014 Destination NAT already created<\/h2>\n\n\n\n
        Because the EIP is the primary EIP of the destination NAT gateway, first:<\/p>\n\n\n\n
        delete destination NAT\nwait for EIP to become free\nreverse-transfer EIP\naccept in source\nobtain new allocation ID\nrecreate source NAT\nrestore source routes\n<\/code><\/pre>\n\n\n\n
        Rollback therefore causes another interruption.<\/p>\n\n\n\n
        \n\n\n\n
        36. Downtime Analysis<\/h1>\n\n\n\n
        AWS-documented facts<\/h2>\n\n\n\n
        AWS does not publish an exact duration guarantee for:<\/p>\n\n\n\n
        AcceptAddressTransfer completion\nNAT gateway deletion\nNAT gateway creation\nroute convergence\n<\/code><\/pre>\n\n\n\n
        Do not design the runbook around an assumed AWS SLA for these steps.<\/p>\n\n\n\n
        AWS does document that deleting a NAT gateway disassociates the EIP and leaves routes targeting it in blackhole<\/code> state.<\/p>\n\n\n\n
        AWS also warns in related NAT migrations that changing NAT routing or disassociating the EIP drops existing connections and they must reconnect.<\/p>\n\n\n\n
        Operational expectation<\/h2>\n\n\n\n
        Typically the following are quick:<\/p>\n\n\n\n
        enable transfer\naccept transfer\ndescribe-addresses\nroute-table API update\n<\/code><\/pre>\n\n\n\n
        NAT gateway deletion\/creation tends to be the largest component and should be measured during staging rather than assigned an invented production duration.<\/p>\n\n\n\n
        Existing connections<\/h2>\n\n\n\n
        Expect:<\/p>\n\n\n\n
        TCP sessions reset\/lost\nKafka connections reconnect\nMongoDB connections reconnect\nHTTPS connections reconnect\nHTTP keepalive connections rebuild\nDNS unaffected if same EIP\n<\/code><\/pre>\n\n\n\n
        \n\n\n\n
        37. Can This Be Zero Downtime?<\/h1>\n\n\n\n
        For the strict requirement:<\/p>\n\n\n\n
        Source NAT\n\u2192 SAME sole EIP\n\u2192 Destination NAT\n<\/code><\/pre>\n\n\n\n
        true zero downtime should not be promised.<\/strong><\/p>\n\n\n\n
        There is a point where:<\/p>\n\n\n\n
        old NAT must stop owning EIP\n\u2193\nEIP ownership changes\n\u2193\nnew NAT is created\n<\/code><\/pre>\n\n\n\n
        The exact same EIP cannot simultaneously be the active primary EIP of both NAT gateways in two accounts.<\/p>\n\n\n\n
        Therefore classify the design as:<\/p>\n\n\n\n
        Minimum downtime\n<\/code><\/pre>\n\n\n\n
        not:<\/p>\n\n\n\n
        Zero downtime\n<\/code><\/pre>\n\n\n\n
        Higher-availability alternative<\/h3>\n\n\n\n
        Pre-run destination through:<\/p>\n\n\n\n
        temporary EIP\n+\ntemporary NAT\n<\/code><\/pre>\n\n\n\n
        and temporarily allowlist both:<\/p>\n\n\n\n
        OLD\/STABLE EIP\nTEMPORARY EIP\n<\/code><\/pre>\n\n\n\n
        This allows destination workloads to be validated and activated independently.<\/p>\n\n\n\n
        At final transfer, switch to the permanent EIP.<\/p>\n\n\n\n
        This can reduce application migration risk<\/strong>, although the final same-EIP NAT transition still resets active connections.<\/p>\n\n\n\n
        \n\n\n\n
        38. Security and Governance<\/h1>\n\n\n\n
        Use:<\/p>\n\n\n\n
        separate AWS CLI profiles\nexplicit --profile on every command\nexplicit --region on every command\nSTS identity check before every write\nchange ticket\nmaintenance window\nTerraform freeze\nCloudTrail\npeer review\nrollback owner\n<\/code><\/pre>\n\n\n\n
        Never rely on:<\/p>\n\n\n\n
        AWS_PROFILE\n<\/code><\/pre>\n\n\n\n
        alone for a high-impact migration if commands can easily run against the wrong account.<\/p>\n\n\n\n
        Explicitly specify:<\/p>\n\n\n\n
        --profile \"$SOURCE_PROFILE\"\n<\/code><\/pre>\n\n\n\n
        or:<\/p>\n\n\n\n
        --profile \"$DEST_PROFILE\"\n<\/code><\/pre>\n\n\n\n
        \n\n\n\n
        39. CloudTrail Audit<\/h1>\n\n\n\n
        CloudTrail records API operations using:<\/p>\n\n\n\n
        eventSource = ec2.amazonaws.com\neventName   = requested EC2 API operation\n<\/code><\/pre>\n\n\n\n
        Important event names should therefore include:<\/p>\n\n\n\n
        EnableAddressTransfer\nDisableAddressTransfer\nAcceptAddressTransfer\nDeleteNatGateway\nCreateNatGateway\nDisassociateAddress\nAssociateAddress\nResetAddressAttribute\nModifyAddressAttribute\nCreateTags\nReplaceRoute\n<\/code><\/pre>\n\n\n\n
        Example:<\/p>\n\n\n\n
        aws cloudtrail lookup-events \\\n  --lookup-attributes \\\n    AttributeKey=EventName,AttributeValue=EnableAddressTransfer \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$SOURCE_PROFILE\"\n<\/code><\/pre>\n\n\n\n
        Destination:<\/p>\n\n\n\n
        aws cloudtrail lookup-events \\\n  --lookup-attributes \\\n    AttributeKey=EventName,AttributeValue=AcceptAddressTransfer \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$DEST_PROFILE\"\n<\/code><\/pre>\n\n\n\n
        CloudTrail supports searching recent management events by EventName<\/code>.<\/p>\n\n\n\n
        \n\n\n\n
        40. Troubleshooting<\/h1>\n\n\n\n
        Problem<\/th>Likely cause<\/th>Validation<\/th>Fix<\/th><\/tr><\/thead>
        Transfer action unavailable<\/td>IAM\/SCP\/unsupported EIP<\/td>Check caller and EIP pool<\/td>Correct permissions \/ verify EIP type<\/td><\/tr>
        UnauthorizedOperation<\/code><\/td>IAM, boundary, SCP<\/td>STS + IAM\/SCP review<\/td>Grant EC2 transfer action<\/td><\/tr>
        Destination cannot accept<\/td>Still associated \/ PTR \/ quota<\/td>Inspect EIP, PTR, quota<\/td>Remove blocker<\/td><\/tr>
        AddressLimitExceeded<\/code><\/td>Destination EIP quota reached<\/td>Service Quotas<\/td>Increase quota\/free EIP<\/td><\/tr>
        InvalidTransfer.AddressAssociated<\/code><\/td>EIP still attached<\/td>describe-addresses<\/code><\/td>Disassociate\/delete NAT<\/td><\/tr>
        InvalidTransfer.AddressCustomPtrSet<\/code><\/td>PTR exists<\/td>describe-addresses-attribute<\/code><\/td>Reset PTR<\/td><\/tr>
        Wrong account<\/td>Bad profile<\/td>sts get-caller-identity<\/code><\/td>Stop immediately<\/td><\/tr>
        Wrong Region<\/td>Source\/dest Region mismatch<\/td>explicit Region<\/td>Both must use ap-northeast-1<\/code><\/td><\/tr>
        Transfer expired<\/td>>7 days<\/td>describe-address-transfers<\/code><\/td>Re-enable transfer<\/td><\/tr>
        NAT EIP will not detach<\/td>Primary EIP<\/td>NAT address inspection<\/td>Delete NAT gateway<\/td><\/tr>
        Terraform wants new EIP<\/td>Old state\/config mismatch<\/td>terraform plan<\/code><\/td>State reconcile\/import<\/td><\/tr>
        Terraform wants destroy<\/td>Wrong ownership\/config<\/td>plan\/state inspection<\/td>Stop; reconcile state<\/td><\/tr>
        NAT creation fails<\/td>EIP\/subnet\/NBG\/IGW\/quota issue<\/td>NAT failure message<\/td>Correct target networking<\/td><\/tr>
        Traffic has wrong outbound IP<\/td>Route uses wrong NAT<\/td>route + curl<\/code><\/td>Fix route<\/td><\/tr>
        Vendor blocks traffic<\/td>Allowlist\/session issue<\/td>vendor logs<\/td>Validate allowlist\/connectivity<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
        AWS specifically documents the three major transfer-acceptance errors:<\/p>\n\n\n\n
        AddressLimitExceeded\nInvalidTransfer.AddressCustomPtrSet\nInvalidTransfer.AddressAssociated\n<\/code><\/pre>\n\n\n\n
        \n\n\n\n
        41. Complete Command Cheat Sheet<\/h1>\n\n\n\n
        Define:<\/p>\n\n\n\n
        export AWS_REGION=ap-northeast-1\n\nexport SOURCE_PROFILE=evp-staging-old\nexport DEST_PROFILE=evp-staging-new\n\nexport SOURCE_ACCOUNT_ID=111111111111\nexport DEST_ACCOUNT_ID=222222222222\n\nexport EIP=1.2.3.4\nexport SOURCE_ALLOCATION_ID=eipalloc-OLDXXXXXXXX\n<\/code><\/pre>\n\n\n\n
        1. Verify source<\/h2>\n\n\n\n
        aws sts get-caller-identity \\\n  --profile \"$SOURCE_PROFILE\"\n<\/code><\/pre>\n\n\n\n
        2. Inspect EIP<\/h2>\n\n\n\n
        aws ec2 describe-addresses \\\n  --public-ips \"$EIP\" \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$SOURCE_PROFILE\"\n<\/code><\/pre>\n\n\n\n
        3. Inspect PTR<\/h2>\n\n\n\n
        aws ec2 describe-addresses-attribute \\\n  --allocation-ids \"$SOURCE_ALLOCATION_ID\" \\\n  --attribute domain-name \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$SOURCE_PROFILE\"\n<\/code><\/pre>\n\n\n\n
        4. Export tags<\/h2>\n\n\n\n
        aws ec2 describe-addresses \\\n  --allocation-ids \"$SOURCE_ALLOCATION_ID\" \\\n  --query 'Addresses[0].Tags' \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$SOURCE_PROFILE\" \\\n  > eip-tags.json\n<\/code><\/pre>\n\n\n\n
        5. Enable transfer<\/h2>\n\n\n\n
        aws sts get-caller-identity \\\n  --profile \"$SOURCE_PROFILE\"\n\naws ec2 enable-address-transfer \\\n  --allocation-id \"$SOURCE_ALLOCATION_ID\" \\\n  --transfer-account-id \"$DEST_ACCOUNT_ID\" \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$SOURCE_PROFILE\"\n<\/code><\/pre>\n\n\n\n
        6. Verify pending<\/h2>\n\n\n\n
        aws ec2 describe-address-transfers \\\n  --allocation-ids \"$SOURCE_ALLOCATION_ID\" \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$SOURCE_PROFILE\"\n<\/code><\/pre>\n\n\n\n
        7. Free source EIP<\/h2>\n\n\n\n
        EC2\/ENI:<\/p>\n\n\n\n
        aws ec2 disassociate-address \\\n  --association-id \"$ASSOCIATION_ID\" \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$SOURCE_PROFILE\"\n<\/code><\/pre>\n\n\n\n
        NAT primary EIP:<\/p>\n\n\n\n
        aws sts get-caller-identity \\\n  --profile \"$SOURCE_PROFILE\"\n\naws ec2 delete-nat-gateway \\\n  --nat-gateway-id \"$SOURCE_NAT_GW_ID\" \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$SOURCE_PROFILE\"\n<\/code><\/pre>\n\n\n\n
        8. Confirm destination<\/h2>\n\n\n\n
        aws sts get-caller-identity \\\n  --profile \"$DEST_PROFILE\"\n<\/code><\/pre>\n\n\n\n
        9. Accept<\/h2>\n\n\n\n
        aws ec2 accept-address-transfer \\\n  --address \"$EIP\" \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$DEST_PROFILE\"\n<\/code><\/pre>\n\n\n\n
        10. Obtain NEW allocation ID<\/h2>\n\n\n\n
        export DEST_ALLOCATION_ID=\"$(\n  aws ec2 describe-addresses \\\n    --public-ips \"$EIP\" \\\n    --query 'Addresses[0].AllocationId' \\\n    --output text \\\n    --region \"$AWS_REGION\" \\\n    --profile \"$DEST_PROFILE\"\n)\"\n<\/code><\/pre>\n\n\n\n
        11. Verify<\/h2>\n\n\n\n
        aws ec2 describe-addresses \\\n  --allocation-ids \"$DEST_ALLOCATION_ID\" \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$DEST_PROFILE\"\n<\/code><\/pre>\n\n\n\n
        12. Restore tags<\/h2>\n\n\n\n
        aws ec2 create-tags \\\n  --resources \"$DEST_ALLOCATION_ID\" \\\n  --tags file:\/\/eip-tags.json \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$DEST_PROFILE\"\n<\/code><\/pre>\n\n\n\n
        13. Create new NAT<\/h2>\n\n\n\n
        aws sts get-caller-identity \\\n  --profile \"$DEST_PROFILE\"\n\naws ec2 create-nat-gateway \\\n  --subnet-id \"$DEST_PUBLIC_SUBNET_ID\" \\\n  --allocation-id \"$DEST_ALLOCATION_ID\" \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$DEST_PROFILE\"\n<\/code><\/pre>\n\n\n\n
        14. Update route<\/h2>\n\n\n\n
        aws ec2 replace-route \\\n  --route-table-id \"$DEST_PRIVATE_ROUTE_TABLE_ID\" \\\n  --destination-cidr-block 0.0.0.0\/0 \\\n  --nat-gateway-id \"$DEST_NAT_GW_ID\" \\\n  --region \"$AWS_REGION\" \\\n  --profile \"$DEST_PROFILE\"\n<\/code><\/pre>\n\n\n\n
        15. Test EKS<\/h2>\n\n\n\n
        kubectl run eip-test \\\n  --image=curlimages\/curl \\\n  --rm -it \\\n  --restart=Never \\\n  -- https:\/\/checkip.amazonaws.com\n<\/code><\/pre>\n\n\n\n
        Expected:<\/p>\n\n\n\n
        1.2.3.4\n<\/code><\/pre>\n\n\n\n
        \n\n\n\n
        42. Architecture Diagram<\/h1>\n\n\n\n
        flowchart LR\n\n    subgraph ORGA[\"AWS Organization A\"]\n        subgraph SRCA[\"Source AWS Account\"]\n            VPC1[\"Source VPC\"]\n            SUB1[\"Public Subnet\"]\n            NAT1[\"NAT Gateway A\"]\n            EIP1[\"EIP X<br\/>1.2.3.4<br\/>Old Allocation ID\"]\n\n            VPC1 --> SUB1\n            SUB1 --> NAT1\n            NAT1 --> EIP1\n        end\n    end\n\n    EIP1 -->|\"EIP ownership transfer<br\/>Same Region\"| EIP2\n\n    subgraph ORGB[\"AWS Organization B\"]\n        subgraph DSTA[\"Destination AWS Account\"]\n            VPC2[\"Destination VPC\"]\n            SUB2[\"Public Subnet\"]\n            NAT2[\"NAT Gateway B\"]\n            EIP2[\"SAME EIP X<br\/>1.2.3.4<br\/>NEW Allocation ID\"]\n\n            VPC2 --> SUB2\n            SUB2 --> NAT2\n            NAT2 --> EIP2\n        end\n    end\n\n    VPC1 -. \"DOES NOT TRANSFER\" .-> VPC2\n    NAT1 -. \"DOES NOT TRANSFER\" .-> NAT2\n<\/code><\/pre>\n\n\n\n
        The transfer boundary is:<\/p>\n\n\n\n
        TRANSFERRED\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nPublic IPv4 ownership\n\n\nNOT TRANSFERRED\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nVPC\nNAT Gateway\nSubnet\nENI\nEC2\nRoute tables\nDNS\ntags\nassociation\nold allocation ID\n<\/code><\/pre>\n\n\n\n
        \n\n\n\n
        43. Final Production Checklist<\/h1>\n\n\n\n
        PREPARATION\n\n[ ] Source account ID confirmed\n[ ] Destination account ID confirmed\n[ ] AWS Region confirmed as ap-northeast-1\n[ ] Public EIP recorded\n[ ] Source Allocation ID recorded\n[ ] PublicIpv4Pool verified\n[ ] Network Border Group verified\n[ ] Association ID recorded\n[ ] ENI\/EC2 association checked\n[ ] NAT Gateway association checked\n[ ] NAT primary\/secondary status checked\n[ ] Source routes exported\n[ ] Tags exported\n[ ] PTR\/reverse DNS checked\n[ ] MongoDB Atlas allowlists documented\n[ ] Confluent allowlists documented\n[ ] Vendor allowlists documented\n[ ] DNS dependencies documented\n[ ] Destination EIP quota validated\n[ ] Destination VPC ready\n[ ] Destination public subnet ready\n[ ] Destination Internet Gateway ready\n[ ] Destination route tables ready\n[ ] Destination Terraform ready\n[ ] Source Terraform state backed up\n[ ] Rollback procedure reviewed\n[ ] Change window approved\n\n\nTRANSFER\n\n[ ] Terraform\/apply freeze active\n[ ] Source caller identity checked\n[ ] EIP transfer enabled\n[ ] Pending transfer verified\n[ ] Destination account ID verified in transfer\n[ ] Traffic drained where applicable\n[ ] PTR removed if applicable\n[ ] EC2\/ENI EIP disassociated OR source NAT deleted\n[ ] EIP confirmed free\n[ ] Destination caller identity checked\n[ ] Transfer accepted\n[ ] Destination ownership verified\n[ ] NEW Allocation ID recorded\n\n\nTARGET\n\n[ ] Tags recreated\n[ ] Destination NAT created\n[ ] NAT state = available\n[ ] NAT shows SAME public EIP\n[ ] Destination routes updated\n[ ] Private subnet route correct\n[ ] EKS outbound EIP verified\n[ ] EC2 outbound EIP verified\n[ ] MongoDB connectivity verified\n[ ] Kafka connectivity verified\n[ ] External APIs verified\n[ ] Vendor allowlists verified\n[ ] Application health verified\n[ ] Monitoring healthy\n\n\nIAC \/ CLEANUP\n\n[ ] Source Terraform no longer manages EIP\n[ ] Destination EIP imported using NEW Allocation ID\n[ ] terraform plan clean in source\n[ ] terraform plan clean in destination\n[ ] Temporary NAT\/EIP removed if applicable\n[ ] Old route-table entries removed\n[ ] Old infrastructure cleanup approved\n[ ] CloudTrail evidence captured\n[ ] Runbook updated\n[ ] Change ticket completed\n<\/code><\/pre>\n\n\n\n
        \n\n\n\n
        44. Final Decision Table<\/h1>\n\n\n\n
        Question<\/th>Answer<\/th><\/tr><\/thead>
        Cross-account transfer?<\/td>YES<\/strong><\/td><\/tr>
        Cross-Organization transfer?<\/td>YES<\/strong><\/td><\/tr>
        Same Organization required?<\/td>NO<\/strong><\/td><\/tr>
        Same Region required?<\/td>YES<\/strong><\/td><\/tr>
        Exact public IPv4 retained?<\/td>YES<\/strong><\/td><\/tr>
        Allocation ID retained?<\/td>NO \u2014 new allocation ID after transfer<\/strong><\/td><\/tr>
        Tags retained?<\/td>NO<\/strong><\/td><\/tr>
        Standard DNS records transferred?<\/td>NO<\/strong><\/td><\/tr>
        Existing EIP association transferred?<\/td>NO<\/strong><\/td><\/tr>
        EC2 transferred?<\/td>NO<\/strong><\/td><\/tr>
        ENI transferred?<\/td>NO<\/strong><\/td><\/tr>
        NAT Gateway transferred?<\/td>NO<\/strong><\/td><\/tr>
        VPC transferred?<\/td>NO<\/strong><\/td><\/tr>
        BYOIP transferable using this mechanism?<\/td>NO<\/strong><\/td><\/tr>
        Outposts CoIP transferable?<\/td>NO<\/strong><\/td><\/tr>
        PTR may remain during acceptance?<\/td>NO<\/strong><\/td><\/tr>
        Transfer expires?<\/td>YES \u2014 7 days<\/strong><\/td><\/tr>
        Can pending transfer be cancelled?<\/td>YES<\/strong><\/td><\/tr>
        Can completed transfer simply be cancelled?<\/td>NO<\/strong><\/td><\/tr>
        Can ownership be transferred back afterward?<\/td>YES \u2014 perform another transfer<\/strong><\/td><\/tr>
        Can primary NAT EIP be manually removed?<\/td>NO<\/strong><\/td><\/tr>
        Does deleting NAT release the EIP?<\/td>NO<\/strong><\/td><\/tr>
        Does deleting NAT disassociate the EIP?<\/td>YES<\/strong><\/td><\/tr>
        True zero downtime with same sole NAT EIP?<\/td>No practical guarantee; design for minimum downtime<\/strong><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
        \n\n\n\n
        Primary References<\/h1>\n\n\n\n
        AWS EC2 \u2014 Elastic IP transfers:
        AWS: Transfer an Elastic IP address between AWS accounts<\/a><\/p>\n\n\n\n
        AWS VPC \u2014 NAT gateway lifecycle:
        AWS: Work with NAT gateways<\/a><\/p>\n\n\n\n
        AWS EC2 \u2014 Reverse DNS:
        AWS: Reverse DNS for Elastic IP addresses<\/a><\/p>\n\n\n\n
        AWS IAM \u2014 EC2 actions:
        AWS: Actions, resources and condition keys for Amazon EC2<\/a><\/p>\n\n\n\n
        AWS VPC quotas:
        AWS: Amazon VPC quotas<\/a><\/p>\n\n\n\n
        AWS Knowledge Center \u2014 transfer verification\/new AllocationId:
        AWS: Transfer an Elastic IP between accounts<\/a><\/p>\n\n\n\n
        HashiCorp \u2014 aws_eip<\/code> import\/current provider behavior:
        HashiCorp AWS Provider: aws_eip<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
        Use case: AWS Organization A \/ Account A \u2192 AWS Organization B \/ Account BObjective: Retain the exact same public IPv4 address while changing AWS account ownership…. <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1162","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/1162","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/comments?post=1162"}],"version-history":[{"count":1,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/1162\/revisions"}],"predecessor-version":[{"id":1163,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/1162\/revisions\/1163"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/media?parent=1162"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/categories?post=1162"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/tags?post=1162"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}