An organization uses multiple AWS accounts for VPC-hosted internal applications. A security team maintains a central allow list of internal IP CIDR ranges and currently notifies other account owners when the allow list changes. Developers in each account add CIDR ranges into their security groups. The solutions architect must distribute the common CIDR ranges across all accounts with the least operational overhead. Which approach meets this requirement?

The correct approach leverages AWS managed prefix lists and AWS Resource Access Manager (RAM) for centralized management and distribution. Creating a customer-managed prefix list in the security account allows the security team to maintain a single, authoritative list of internal CIDR ranges. Sharing this prefix list via AWS RAM with the entire organization ensures that all accounts have access to the most current allow list. Account owners then simply reference this shared prefix list ID in their security groups, eliminating the need for manual updates in each account and significantly reducing operational overhead. Incorrect options: Using SNS and Lambda for updates introduces more complexity and requires custom development and maintenance for each account's Lambda function. Manually creating and populating prefix lists in each account is exactly what the question aims to avoid, as it requires individual updates and notifications. Deploying a Lambda in the security account to assume roles in other accounts and update security groups is overly complex, requires extensive IAM permissions, and still involves custom code for security group updates rather than leveraging a managed feature.