A company has an organization that has many AWS accounts in AWS Organizations. A solutions architect must improve how the company manages common security group rules for the AWS accounts in the organization. The company has a common set of IP CIDR ranges in an allow list in each AWS account to allow access to and from the company’s on-premises network. Developers within each account are responsible for adding new IP CIDR ranges to their security groups. The security team has its own AWS account. Currently, the security team notifies the owners of the other AWS accounts when changes are made to the allow list. The solutions architect must design a solution that distributes the common set of CIDR ranges across all accounts. Which solution meets these requirements with the LEAST amount of operational overhead?
Select one answer.
Marked answer: C
Community Discussion
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Chose C1
Why C is Best: Prefix lists allow you to define a group of CIDRs once and reference them in security group rules By using AWS Resource Access Manager (RAM), the central security team can share a single prefix list with the whole organization Developers in other accounts just reference the shared prefix list ID — no need to hardcode IPs When the security team updates the prefix list, all security groups using it are updated automatically Minimal ongoing ops: one central place to manage, no cross-account Lambda or custom logic needed
1
Human cost is major overhead. I will go A. This is one time setup.
Chose C1
Centralised management and standard use case for prefix lists and RAM
