Here’s a complete guide to Prefix List and PREFIX_LIST_ID – particularly useful in AWS networking contexts such as Route Tables, Security Groups, and Network ACLs.

---

What is a Prefix List in AWS?

A Prefix List in AWS is a set of CIDR blocks grouped under a logical name, managed by AWS or the user, and assigned a unique ID. It simplifies the management of IP-based rules across multiple AWS services.

---

Key Use Cases

Use Case	Description
Route Tables	Use a Prefix List to define destination CIDR blocks
Security Groups	Allow or restrict traffic from a known set of IP ranges
Network ACLs	Apply consistent rules across VPCs using prefix lists
Simplified Management	Update a prefix list once to affect all dependent resources

---

Types of Prefix Lists

Type	Description	Example
AWS-Managed	Created and maintained by AWS for common services	com.amazonaws.region.s3
Customer-Managed	Created by the user with specific CIDRs	pl-0123456789abcdef0

---

AWS-Managed Prefix List Examples

Service	Prefix List Name	Description
S3	com.amazonaws.<region>.s3	Access to S3 public endpoints
DynamoDB	com.amazonaws.<region>.dynamodb	Used for DynamoDB access
CloudFront	com.amazonaws.global.cloudfront.origin-facing	CloudFront IPs to allow through firewalls

---

PREFIX_LIST_ID

• A PREFIX_LIST_ID is a unique identifier for a Prefix List in AWS.
• Format: pl-xxxxxxxxxxxxxxxxx
• Used in Route Tables, Security Groups, and NACLs as a substitute for raw CIDRs.

Example:

If your S3 Prefix List ID is pl-1234abcd, you can use it in a route table like:

{
  "DestinationPrefixListId": "pl-1234abcd",
  "Target": "igw-0abc123de456"
}

---

How to Create a Customer-Managed Prefix List

Via Console

1. Go to VPC Dashboard → Prefix Lists
2. Click Create Prefix List
3. Enter name, maximum number of entries, and add CIDRs
4. Create and note the PREFIX_LIST_ID

Via AWS CLI

aws ec2 create-managed-prefix-list \
  --prefix-list-name my-app-cidrs \
  --max-entries 5 \
  --address-family IPv4 \
  --entries Cidr=192.168.1.0/24,Description="App subnet"

---

How to Use PREFIX_LIST_ID in Terraform

resource "aws_route" "example" {
  route_table_id         = aws_route_table.example.id
  destination_prefix_list_id = "pl-1234abcd"
  gateway_id             = aws_internet_gateway.example.id
}

Or dynamically:

data "aws_prefix_list" "s3" {
  name = "com.amazonaws.us-east-1.s3"
}

resource "aws_security_group_rule" "allow_s3" {
  type                     = "egress"
  security_group_id        = aws_security_group.example.id
  from_port                = 443
  to_port                  = 443
  protocol                 = "tcp"
  prefix_list_ids          = [data.aws_prefix_list.s3.id]
}

---

Benefits of Using Prefix Lists

Feature	Benefit
Consistency	No need to update CIDRs manually in multiple places
Simplification	Replace long IP lists with a single identifier
Scalability	One change affects all related security or routing rules
Security	Easier to audit and manage trusted IPs

---

Updating a Prefix List

• AWS-Managed: Automatically updated by AWS
• Customer-Managed:
  • Use CLI or Console to add/remove CIDRs
  • Affects all associated route/security rules immediately

---

Best Practices

• Use AWS-managed prefix lists for trusted AWS services.
• Use customer-managed prefix lists to organize:
  • Office IPs
  • Partner networks
  • Application subnets
• Tag your prefix lists for visibility and tracking.

---

Common Questions

How to find a prefix list ID?

aws ec2 describe-managed-prefix-lists

Are prefix lists secure?

Yes. They’re only a way to manage IP lists, and your actual resource access is controlled by security groups, NACLs, or route tables.

Are prefix lists region-specific?

Yes, prefix lists are region-specific, especially AWS-managed ones like S3 or DynamoDB.

---

How to Configure the EKS nodes' security group to receive traffic from the VPC Lattice network.

$ PREFIX_LIST_ID=$(aws ec2 describe-managed-prefix-lists --query "PrefixLists[?PrefixListName=="\'com.amazonaws.$AWS_REGION.vpc-lattice\'"].PrefixListId" | jq -r '.[]')

$ echo $PREFIX_LIST_ID

$ aws ec2 authorize-security-group-ingress --group-id $CLUSTER_SG --ip-permissions "PrefixListIds=[{PrefixListId=${PREFIX_LIST_ID}}],IpProtocol=-1"

$ PREFIX_LIST_ID_IPV6=$(aws ec2 describe-managed-prefix-lists --query "PrefixLists[?PrefixListName=="\'com.amazonaws.$AWS_REGION.ipv6.vpc-lattice\'"].PrefixListId" | jq -r '.[]')

$ echo $PREFIX_LIST_ID_IPV6

$ aws ec2 authorize-security-group-ingress --group-id $CLUSTER_SG --ip-permissions "PrefixListIds=[{PrefixListId=${PREFIX_LIST_ID_IPV6}}],IpProtocol=-1"