{"id":48977,"date":"2025-04-04T01:32:27","date_gmt":"2025-04-04T01:32:27","guid":{"rendered":"https:\/\/www.devopsschool.com\/blog\/?p=48977"},"modified":"2025-04-04T01:32:27","modified_gmt":"2025-04-04T01:32:27","slug":"aws-tutorials-what-is-a-prefix-list-in-aws","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/blog\/aws-tutorials-what-is-a-prefix-list-in-aws\/","title":{"rendered":"AWS Tutorials: What is a Prefix List in AWS?"},"content":{"rendered":"\n

Here’s a complete guide to Prefix List and PREFIX_LIST_ID<\/code><\/strong> \u2013 particularly useful in AWS networking<\/strong> contexts such as Route Tables, Security Groups, and Network ACLs<\/strong>.<\/p>\n\n\n\n

\n\n\n\n

\ud83d\udd30 What is a Prefix List in AWS?<\/h1>\n\n\n\n

A Prefix List<\/strong> in AWS is a set of CIDR blocks grouped under a logical name<\/strong>, managed by AWS or the user, and assigned a unique ID. It simplifies the management of IP-based rules<\/strong> across multiple AWS services.<\/p>\n\n\n\n

\n\n\n\n

\u2705 Key Use Cases<\/h2>\n\n\n\n
Use Case<\/th>Description<\/th><\/tr><\/thead>
\u2705 Route Tables<\/td>Use a Prefix List to define destination CIDR blocks<\/td><\/tr>
\u2705 Security Groups<\/td>Allow or restrict traffic from a known set of IP ranges<\/td><\/tr>
\u2705 Network ACLs<\/td>Apply consistent rules across VPCs using prefix lists<\/td><\/tr>
\u2705 Simplified Management<\/td>Update a prefix list once to affect all dependent resources<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
\n\n\n\n

\ud83d\udce6 Types of Prefix Lists<\/h2>\n\n\n\n
Type<\/th>Description<\/th>Example<\/th><\/tr><\/thead>
AWS-Managed<\/strong><\/td>Created and maintained by AWS for common services<\/td>com.amazonaws.region.s3<\/code><\/td><\/tr>
Customer-Managed<\/strong><\/td>Created by the user with specific CIDRs<\/td>pl-0123456789abcdef0<\/code><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
\n\n\n\n

\ud83d\udd10 AWS-Managed Prefix List Examples<\/h2>\n\n\n\n
Service<\/th>Prefix List Name<\/th>Description<\/th><\/tr><\/thead>
S3<\/td>com.amazonaws.<region>.s3<\/code><\/td>Access to S3 public endpoints<\/td><\/tr>
DynamoDB<\/td>com.amazonaws.<region>.dynamodb<\/code><\/td>Used for DynamoDB access<\/td><\/tr>
CloudFront<\/td>com.amazonaws.global.cloudfront.origin-facing<\/code><\/td>CloudFront IPs to allow through firewalls<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
\n\n\n\n

\ud83d\udd22 PREFIX_LIST_ID<\/h2>\n\n\n\n
    \n
  • A PREFIX_LIST_ID<\/code> is a unique identifier<\/strong> for a Prefix List in AWS.<\/li>\n\n\n\n
  • Format: pl-xxxxxxxxxxxxxxxxx<\/code><\/li>\n\n\n\n
  • Used in Route Tables, Security Groups, and NACLs as a substitute for raw CIDRs.<\/li>\n<\/ul>\n\n\n\n
    \n

    \u2705 Example:<\/p>\n\n\n\n

    If your S3 Prefix List ID is pl-1234abcd<\/code>, you can use it in a route table like:<\/p>\n\n\n

    {\n  \"DestinationPrefixListId\"<\/span>: \"pl-1234abcd\"<\/span>,\n  \"Target\"<\/span>: \"igw-0abc123de456\"<\/span>\n}\n<\/code><\/span>Code language:<\/span> JSON \/ JSON with Comments<\/span> (<\/span>json<\/span>)<\/span><\/small><\/pre><\/blockquote>\n\n\n\n
    \n\n\n\n
    \ud83d\udee0\ufe0f How to Create a Customer-Managed Prefix List<\/h2>\n\n\n\n
    \ud83d\udd27 Via Console<\/h3>\n\n\n\n
      \n
    1. Go to VPC Dashboard \u2192 Prefix Lists<\/strong><\/li>\n\n\n\n
    2. Click Create Prefix List<\/strong><\/li>\n\n\n\n
    3. Enter name, maximum number of entries, and add CIDRs<\/li>\n\n\n\n
    4. Create and note the PREFIX_LIST_ID<\/code><\/li>\n<\/ol>\n\n\n\n
      \ud83e\udde9 Via AWS CLI<\/h3>\n\n\n
      aws ec2 create-managed-prefix-list<\/span> \\\n  --prefix-list<\/span>-name my-app-cidrs \\\n  --max-entries 5<\/span> \\\n  --address-family IPv4 \\\n  --entries Cidr=192.168<\/span>.1<\/span>.0<\/span>\/24<\/span>,Description=\"App subnet\"<\/span>\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
      \n\n\n\n
      \ud83d\udcdd How to Use PREFIX_LIST_ID in Terraform<\/h2>\n\n\n
      resource \"aws_route\"<\/span> \"example\"<\/span> {\n  route_table_id         = aws_route_table.example.id\n  destination_prefix_list_id = \"pl-1234abcd\"<\/span>\n  gateway_id             = aws_internet_gateway.example.id\n}\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
      Or dynamically:<\/p>\n\n\n
      data \"aws_prefix_list\"<\/span> \"s3\"<\/span> {\n  name = \"com.amazonaws.us-east-1.s3\"<\/span>\n}\n\nresource \"aws_security_group_rule\"<\/span> \"allow_s3\"<\/span> {\n  type                     = \"egress\"<\/span>\n  security_group_id        = aws_security_group.example.id\n  from_port                = 443<\/span>\n  to_port                  = 443<\/span>\n  protocol                 = \"tcp\"<\/span>\n  prefix_list_ids          = [data.aws_prefix_list.s3.id]\n}\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n
      \n\n\n\n
      \ud83d\udccc Benefits of Using Prefix Lists<\/h2>\n\n\n\n
      Feature<\/th>Benefit<\/th><\/tr><\/thead>
      Consistency<\/strong><\/td>No need to update CIDRs manually in multiple places<\/td><\/tr>
      Simplification<\/strong><\/td>Replace long IP lists with a single identifier<\/td><\/tr>
      Scalability<\/strong><\/td>One change affects all related security or routing rules<\/td><\/tr>
      Security<\/strong><\/td>Easier to audit and manage trusted IPs<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
      \n\n\n\n
      \ud83d\udd04 Updating a Prefix List<\/h2>\n\n\n\n
        \n
      • AWS-Managed<\/strong>: Automatically updated by AWS<\/li>\n\n\n\n
      • Customer-Managed<\/strong>:\n
          \n
        • Use CLI or Console to add\/remove<\/strong> CIDRs<\/li>\n\n\n\n
        • Affects all associated route\/security rules immediately<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
          \n\n\n\n
          \ud83e\udde0 Best Practices<\/h2>\n\n\n\n
            \n
          • Use AWS-managed prefix lists<\/strong> for trusted AWS services.<\/li>\n\n\n\n
          • Use customer-managed prefix lists<\/strong> to organize:\n
              \n
            • Office IPs<\/li>\n\n\n\n
            • Partner networks<\/li>\n\n\n\n
            • Application subnets<\/li>\n<\/ul>\n<\/li>\n\n\n\n
            • Tag<\/strong> your prefix lists for visibility and tracking.<\/li>\n<\/ul>\n\n\n\n
              \n\n\n\n
              \u2753 Common Questions<\/h2>\n\n\n\n
              \ud83d\udd0d How to find a prefix list ID?<\/h3>\n\n\n
              aws ec2 describe-managed-prefix-lists\n<\/code><\/span><\/pre>\n\n\n
              \ud83d\udd10 Are prefix lists secure?<\/h3>\n\n\n\n
              Yes. They’re only a way to manage IP lists, and your actual resource access is controlled by security groups, NACLs, or route tables.<\/p>\n\n\n\n
              \ud83c\udf0d Are prefix lists region-specific?<\/h3>\n\n\n\n
              Yes, prefix lists are region-specific<\/strong>, especially AWS-managed ones like S3 or DynamoDB.<\/p>\n\n\n\n
              \n\n\n
              How to Configure the EKS nodes' security group to receive traffic from the VPC Lattice network.\n\n$ PREFIX_LIST_ID=$(aws ec2 describe-managed-prefix-lists --query \"PrefixLists[?PrefixListName==\"\\'com.amazonaws.$AWS_REGION.vpc-lattice\\'\"].PrefixListId\" | jq -r '<\/span>.[]')\n\n$ echo $PREFIX_LIST_ID\n\n$ aws ec2 authorize-security-group-ingress --group-id $CLUSTER_SG --ip-permissions \"PrefixListIds=[{PrefixListId=${PREFIX_LIST_ID}}],IpProtocol=-1\"\n\n$ PREFIX_LIST_ID_IPV6=$(aws ec2 describe-managed-prefix-lists --query \"PrefixLists[?PrefixListName==\"\\'com.amazonaws.$AWS_REGION.ipv6.vpc-lattice\\'\"].PrefixListId\" | jq -r '<\/span>.[]')\n\n$ echo $PREFIX_LIST_ID_IPV6\n\n$ aws ec2 authorize-security-group-ingress --group-id $CLUSTER_SG --ip-permissions \"PrefixListIds=[{PrefixListId=${PREFIX_LIST_ID_IPV6}}],IpProtocol=-1\"<\/span><\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
              <\/p>\n","protected":false},"excerpt":{"rendered":"
              Here’s a complete guide to Prefix List and PREFIX_LIST_ID \u2013 particularly useful in AWS networking contexts such as Route Tables, Security Groups, and Network ACLs. \ud83d\udd30 What is a Prefix… <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"_joinchat":[],"footnotes":""},"categories":[2],"tags":[],"class_list":["post-48977","post","type-post","status-publish","format-standard","hentry","category-uncategorised"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/48977","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/comments?post=48977"}],"version-history":[{"count":1,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/48977\/revisions"}],"predecessor-version":[{"id":48978,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/48977\/revisions\/48978"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/media?parent=48977"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/categories?post=48977"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/tags?post=48977"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}