A company runs production applications in multiple AWS accounts in us-east-1. Each application sits on EC2 instances in private subnets behind an ALB. The ALB allows inbound port 80 traffic only from partner network IP ranges. When a new partner is added, the partner CIDR must be added to the ALB security group in each account. The network engineer needs a centralized, operationally efficient way to manage partner CIDR ranges across accounts. Which solution is best?

The best solution is to use a prefix list shared via AWS Resource Access Manager (RAM). AWS managed prefix lists allow you to group multiple CIDR blocks into a single object that can be referenced by security groups and route tables. By sharing this prefix list across accounts using RAM, you centralize the management of partner IP ranges. When a new partner is added, you only need to update the prefix list in the central account, and all security groups referencing it in other accounts will automatically reflect the change. The other options are less efficient. Storing IP ranges in DynamoDB or S3 and using Lambda functions in each account requires deploying and maintaining the same automation in every account, which is not centralized or operationally efficient. Creating a prefix list and using EventBridge/Lambda in every account still requires per-account deployment of the automation, rather than leveraging the native sharing capabilities of prefix lists with RAM.