Prefix Lists

Configuring rules for security groups or routes for route tables can sometimes be difficult to manage. When an organization has several CIDR blocks they need to allow access from or route to, maintaining all those entries can come with a management overhead to keep up with them. This can become quite cumbersome when you are responsible for maintaining these entries in multiple VPCs and potentially across multiple regions. Using managed prefix lists to maintain an up-to-date list of these CIDR blocks can make this process easier.

Prefix lists are lists that contain multiple IP CIDR blocks, which can be IPv4- or IPv6-based. These lists can then be referenced in rules belonging to security groups and route tables. In turn, if you have a prefix list containing 10 prefixes, a single security group rule or route table route entry will apply for all 10 of those prefixes. Prefix lists can be a good way to maintain consistency with security groups and/or route tables across all your resources and even between AWS accounts.

There are two types of prefix lists within AWS: customer-managed and AWS-managed.

Customer-Managed Prefix Lists

Customer-managed prefix lists are created and maintained by you within your AWS account(s). You are responsible for adding/removing IP prefixes from these lists as necessary. As prefixes are added/removed, any references to them in a security group rule or route table entry will automatically be updated in place.

A customer-managed prefix list is a regional construct, meaning it only exists within a single AWS Region. Here are a few other characteristics of customer-managed prefix lists to consider. A prefix list supports either IPv4 or IPv6 addressing, but not both. If you require the use of both, this task will require two separate prefix lists. A prefix list also requires a limit of the maximum number of prefix entries to be set. By default, the maximum number this value can be set to is 1,000. To help manage the life cycle of a prefix list, it also supports versioning. When entries are added/removed, a new version of the prefix list is automatically created and promoted. This allows for simple restoration to previous versions.

Be careful when referencing a prefix list in another resource. The number of prefix entries applies to the service quota for that resource. For example, if a prefix list with 25 entries is referenced in a VPC route table, then that is equivalent to 25 separate route entries. This can quickly consume entries and is inefficient.

Refer to Figure 1.13 for an example of a customer-managed prefix list within the AWS dashboard. Make note of the prefix list version, max entries, and address family.

Figure 1.13: Customer-managed prefix list

Customer-managed prefix lists offer granular logical grouping based on specific needs, but as with all custom features in the cloud, this granularity comes with strict limitations such as low maximum entries.

Note

Customer-managed prefix lists are also supported within AWS Transit Gateway (TGW) route tables, which will be covered later in this chapter.

AWS-Managed Prefix Lists

In addition to customer-managed prefix lists, there are also AWS-managed prefix lists. These can be referenced in a very similar fashion to customer-managed ones, but all the entries are owned and maintained by AWS. These prefix lists are automatically created within each AWS region and can be referenced as needed.

These prefix lists are created for several AWS services and are populated with all the IP prefixes associated with those services. These lists can be referenced by security groups or route tables to ensure resources can interact with these services in a secure manner.

Refer to Table 1.1 for a list of AWS-managed prefix lists and their corresponding names:

Table 1.1: AWS-managed prefix lists

These AWS-managed prefix lists make it simpler for customers to reference them when creating a policy that needs to reference AWS services.

Note

You can find more details about AWS-managed prefix lists here: https://docs.aws.amazon.com/vpc/latest/userguide/working-with-aws-managed-prefix-lists.html

Configuring Customer-Managed Prefix Lists

This section details the creation of a customer-managed prefix list from either the AWS console or AWS CLI.

To create a customer-managed prefix list, navigate to the VPC console of the AWS dashboard and select Managed prefix lists. This section contains both customer-managed and AWS-managed prefix lists. Select the Create prefix list option to create a new customer-managed prefix list. Next, you will define the name of the prefix list, the maximum number of entries, and any specific prefix entries. This process is shown in Figure 1.14:

Figure 1.14: Create prefix list details

The prefix list is a custom way to maintain a list of interesting prefixes that should be referenced in the same way – for example, you may wish to create a prefix list with the prefixes of all development resources across your VPCs; a prefix list can do this.

A customer-managed prefix list can be created using the AWS CLI aws ec2 create-managed-prefix-list command.

For example, to create a custom prefix list using the AWS CLI, follow the given code:

aws ec2 create-managed-prefix-list --prefix-list-name MyPrefixList --max-entries 10 --address-family IPv4 --entries Cidr=10.0.0.0/16,Description="My CIDR block"

The next section will cover how to connect VPCs together.