Needed because if check not done, we would include entire Subnet CIDR into new IPPolicy if allocation_pools is an empty list.