Lecture 193: Security Groups Outbound Rules & Managed Prefixes
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：01:45
- 来源：Udemy Lecture 46847149
- Slide 数量：3
- 画面切换：00:29、01:15
扫描说明
逐条读取了 Udemy 页面中的 39 条英文 Transcript cue，并按时间轴扫描全长约 01:45 的视频。依据 Security Group Outbound 限制、Customer-managed Prefix List、AWS-managed Prefix List 划分为 3 个小节。截图均在 Transcript 侧栏关闭、播放器控件隐藏后复核，统一为 1364×770。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. Outbound Rule 可从 0.0.0.0/0 收紧为服务 Prefix
时间范围：00:00–00:29
总结 / Summary
中文
Security Group 默认 Outbound Rule 通常允许 0.0.0.0/0 Anywhere。可删除宽泛规则，改为只允许特定 Destination Prefix；示例仅允许 TCP/443 到 us-east-1 的 Amazon S3 Prefix List，从而让 Workload 访问 S3，同时阻止其他任意公网出站。
English
A security group normally starts with an outbound rule allowing 0.0.0.0/0 anywhere. Remove that broad rule and allow only selected destination prefixes instead. The example permits TCP/443 only to the Amazon S3 prefix list in us-east-1, enabling S3 access while blocking arbitrary public egress.
Transcript
00:00 So let's talk about security groups,
00:01 outbound rules for a second.
00:03 By default the outbound rules allow anywhere with this CIDR,
00:07 but we can remove and just allow specific prefixes.
00:11 So here is an example of an outbound rule,
00:13 and as you can see, it authorizes the port 443
00:17 of a destination to be Amazon S3 in the US East 1.
00:22 So it looks like from this we have used a prefix destination
00:26 so that the only amount authorized is to S3.
2. Customer-managed Prefix List 集中维护并跨账户共享 CIDR
时间范围：00:29–01:15
总结 / Summary
中文
Managed Prefix List 是一个或多个 CIDR Block 的集合，可被 Security Group 与 Route Table 引用。Customer-managed Prefix List 由用户定义和维护，并可共享到其他 AWS Account 或 AWS Organization。只需在 Account A 更新一次列表，所有引用它的规则都会获得新 CIDR，避免逐个修改大量 Security Group。
English
A managed prefix list is a collection of one or more CIDR blocks referenced by security groups and route tables. A customer-managed prefix list is defined and maintained by you and can be shared with other AWS accounts or an AWS Organization. Updating it once in Account A updates every rule that references the list, avoiding many individual security-group edits.
Transcript
00:29 And so as such, we can introduce the concept
00:31 of managed prefix lists.
00:32 So it's one or more CIDR blocks and it makes it easier
00:36 for you to configure your security groups
00:38 and your route tables.
00:39 So in your account, for example,
00:41 you can define your custom prefix list.
00:43 For example, this CIDR 1, CIDR 2, and CIDR 3.
00:47 You can share them to another account
00:49 such as in the security group, inbound rules.
00:52 You can actually reference the prefix list
00:54 that you've defined in Account A.
00:56 So these customer manage prefix lists are a set
01:00 of CIDR that you define and that you manage yourself,
01:02 and they can be shared with other accounts
01:04 or within your organization.
01:06 This allows you, for example, that if the Account A
01:08 wants to modify the prefix list once,
01:11 it will be applied to many security groups at once.
3. AWS-managed Prefix List 可直接使用但不能修改
时间范围：01:15–01:45
总结 / Summary
中文
AWS-managed Prefix List 由 AWS 为特定 Service 的 CIDR 集合维护。用户不能创建、修改、共享或删除，只能在支持的 Route/Security Rule 中引用。课程列出的重点服务包括 Amazon S3、CloudFront、DynamoDB 与 Ground Station；当服务地址变化时，由 AWS 更新列表，引用方无需手工追踪 CIDR。
English
AWS-managed prefix lists are maintained by AWS as CIDR sets for specific services. You cannot create, modify, share, or delete them; you can only reference them in supported routes and security rules. The course highlights Amazon S3, CloudFront, DynamoDB, and Ground Station. AWS updates the list as service addresses change, so consumers do not track CIDRs manually.
Transcript
01:15 The other option is to use the AWS managed prefix list.
01:19 So it's a set of CIDR for AWS services,
01:22 but you can't create, modify, share, or delete them.
01:25 You can only use them.
01:27 And some of the services that may be important
01:29 that you can already reference using this managed
01:32 prefix list are Amazon S3, Amazon CloudFront,
01:36 DynamoDB, and Ground Station, and they may be others,
01:39 but those are the most important.
01:40 All right, that's it for this lecture.
01:42 I hope you liked it and I will see you in the next lecture.
整讲总结 / Overall Summary
中文
Security Group Outbound 可用 Prefix List 替代 0.0.0.0/0，精确限制目的服务。Customer-managed List 可集中维护 CIDR 并跨 Account/Organization 共享；AWS-managed List 由 AWS 维护、只能引用，常见于 S3、CloudFront、DynamoDB 和 Ground Station。
English
Security-group egress can reference prefix lists instead of 0.0.0.0/0 to restrict destination services precisely. Customer-managed lists centralize CIDRs and can be shared across accounts or organizations. AWS-managed lists are maintained by AWS and can only be referenced, commonly for S3, CloudFront, DynamoDB, and Ground Station.
返回顶部 ↑