PrefixList

Source: src/AWS/EC2/PrefixList.ts

A managed prefix list is a named, reusable set of CIDR blocks that you reference by ID from security group rules and route tables. Instead of duplicating the same IP ranges across many rules, you maintain them in one place and every rule that references the list picks up changes automatically.

The list is versioned: each entry modification bumps version, and AWS limits a list to maxEntries CIDRs (you provision headroom up front and can only grow it, never shrink it, in place). addressFamily fixes whether the list holds IPv4 or IPv6 CIDRs and is immutable.

Creating a Prefix List

Basic IPv4 Prefix List

const corpNetworks = yield* AWS.EC2.PrefixList("CorpNetworks", {
  maxEntries: 10,
  entries: [
    { cidr: "10.0.0.0/16", description: "vpc-a" },
    { cidr: "10.1.0.0/16", description: "vpc-b" },
  ],
});

Creates a prefix list with two IPv4 CIDRs. The resulting prefixListId (prefixed pl-) can be referenced from security group rules and routes.

IPv6 Prefix List

const ipv6List = yield* AWS.EC2.PrefixList("Ipv6List", {
  addressFamily: "IPv6",
  maxEntries: 5,
  entries: [{ cidr: "2001:db8::/32" }],
});

addressFamily: "IPv6" makes the list accept IPv6 CIDRs. Because the family is intrinsic to the list, changing it later replaces the resource.

Referencing a Prefix List from a Security Group Rule

const corpNetworks = yield* AWS.EC2.PrefixList("CorpNetworks", {
  maxEntries: 10,
  entries: [{ cidr: "10.0.0.0/16" }],
});

const rule = yield* AWS.EC2.SecurityGroupRule("AllowCorp", {
  groupId: sg.groupId,
  type: "ingress",
  ipProtocol: "tcp",
  fromPort: 443,
  toPort: 443,
  prefixListId: corpNetworks.prefixListId,
});

The rule allows HTTPS from every CIDR in the list. Editing the list’s entries updates what the rule permits without touching the rule itself.