An organization has many AWS accounts organized under AWS Organizations. A transit account hosts a shared Transit Gateway and Site-to-Site VPN connections from the company’s global offices. The networking team must centrally manage a list of internal IP ranges (the global offices’ networks) so developers in other accounts can reference that list when granting access. Which solution provides this centralized list with the least operational overhead?

The correct solution leverages a VPC prefix list, which is designed for managing collections of IP address ranges. Creating the prefix list in the transit account centralizes management. Sharing it via AWS Resource Access Manager (RAM) allows other accounts to reference it easily in their security group rules, ensuring consistency and reducing operational overhead. Storing a JSON file in S3 with SNS and Lambda introduces significant operational complexity for managing and updating security group rules across many accounts. An AWS Config managed rule is for evaluating compliance against existing rules, not for centrally defining IP ranges for security groups. Referencing a security group from another account directly is not supported across accounts in the manner described; security group references are typically within the same VPC or peered VPCs, not directly across unrelated accounts.