Work with shared prefix lists - Amazon Virtual Private Cloud
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China.

Work with shared prefix lists

With Amazon Resource Access Manager (Amazon RAM), the owner of a prefix list can share a prefix list with the following:

  • Specific Amazon accounts inside or outside of its organization in Amazon Organizations

  • An organizational unit inside its organization in Amazon Organizations

  • An entire organization in Amazon Organizations

Consumers with whom a prefix list has been shared can view the prefix list and its entries, and they can reference the prefix list in their Amazon resources.

For more information about Amazon RAM, see the Amazon RAM User Guide.

Prerequisites for sharing prefix lists

  • To share a prefix list, you must own it. You cannot share a prefix list that has been shared with you. You cannot share an Amazon-managed prefix list.

  • To share a prefix list with your organization or an organizational unit in Amazon Organizations, you must enable sharing with Amazon Organizations. For more information, see Enable sharing with Amazon Organizations in the Amazon RAM User Guide.

Share a prefix list

To share a prefix list, you must add it to a resource share. If you do not have a resource share, you must first create one using the Amazon RAM console.

If you are part of an organization in Amazon Organizations, and sharing within your organization is enabled, consumers in your organization are automatically granted access to the shared prefix list. Otherwise, consumers receive an invitation to join the resource share and are granted access to the shared prefix list after accepting the invitation.

You can create a resource share and share a prefix list that you own using the Amazon RAM console, or the Amazon CLI.

To create a resource share and share a prefix list using the Amazon RAM console

Follow the steps in Create a resource share in the Amazon RAM User Guide. For Select resource type, choose Prefix Lists, and then select the check box for your prefix list.

To add a prefix list to an existing resource share using the Amazon RAM console

To add a managed prefix that you own to an existing resource share, follow the steps in Updating a resource share in the Amazon RAM User Guide. For Select resource type, choose Prefix Lists, and then select the check box for your prefix list.

To share a prefix list that you own using the Amazon CLI

Use the following commands to create and update a resource share:

Identify a shared prefix list

Owners and consumers can identify shared prefix lists using the Amazon VPC console and Amazon CLI.

To identify a shared prefix list using the Amazon VPC console

  1. Open the Amazon VPC console at https://console.amazonaws.cn/vpc/.

  2. In the navigation pane, choose Managed Prefix Lists.

  3. The page displays the prefix lists that you own and the prefix lists that are shared with you. The Owner ID column shows the Amazon account ID of the prefix list owner.

  4. To view the resource share information for a prefix list, select the prefix list and choose Sharing in the lower pane.

To identify a shared prefix list using the Amazon CLI

Use the describe-managed-prefix-lists command. The command returns the prefix lists that you own and the prefix lists that are shared with you. OwnerId shows the Amazon account ID of the prefix list owner.

Identify references to a shared prefix list

Owners can identify the consumer-owned resources that are referencing a shared prefix list.

To identify references to a shared prefix list using the Amazon VPC console

  1. Open the Amazon VPC console at https://console.amazonaws.cn/vpc/.

  2. In the navigation pane, choose Managed Prefix Lists.

  3. Select the prefix list and choose Associations in the lower pane.

  4. The IDs of the resources that are referencing the prefix list are listed in the Resource ID column. The owners of the resources are listed in the Resource Owner column.

To identify references to a shared prefix list using the Amazon CLI

Use the get-managed-prefix-list-associations command.

Unshare a shared prefix list

When you unshare a prefix list, consumers can no longer view the prefix list or its entries in their account, and they cannot reference the prefix list in their resources. If the prefix list is already referenced in the consumer's resources, those references continue to function as normal, and you can continue to view those references. If you update the prefix list to a new version, the references use the latest version.

To unshare a shared prefix list that you own, you must remove it from the resource share using Amazon RAM.

To unshare a shared prefix list that you own using the Amazon RAM console

See Updating a resource share in the Amazon RAM User Guide.

To unshare a shared prefix list that you own using the Amazon CLI

Use the disassociate-resource-share command.

Shared prefix list permissions

Permissions for owners

Owners are responsible for managing a shared prefix list and its entries. Owners can view the IDs of the Amazon resources that reference the prefix list. However, they cannot add or remove references to a prefix list in Amazon resources that are owned by consumers.

Owners cannot delete a prefix list if the prefix list is referenced in a resource that's owned by a consumer.

Permissions for consumers

Consumers can view the entries in a shared prefix list, and they can reference a shared prefix list in their Amazon resources. However, consumers can't modify, restore, or delete a shared prefix list.

Billing and metering

There are no additional charges for sharing prefix lists.

Quotas for Amazon RAM

For more information, see Service quotas.