what does slash0 see about my environment?
No traffic, no data, no credentials. AWS shows a prefix-list owner two things about consumers: which account IDs accepted the share, and which security group IDs reference each list. That metadata is used to block share revocation while your rules still depend on a list. Details are on the security page.
what does it cost?
The feed and Terraform provider are free. The hosted tier is free for design partners during early access. Paid plans arrive at general availability, priced per account and region. For comparison, AWS Network Firewall costs roughly $288 per month per AZ before rule management.
which regions?
Prefix lists are regional, so publication is per region. Early access starts in
us-east-1. Additional regions are enabled per design-partner need;
state yours in the early-access request.
IPv6?
Yes. Prefix lists are per-address-family in AWS, so every purpose ships as up to
two lists: egress.stripe.api.v4, and .v6 where the vendor
publishes IPv6 ranges. IPv4 and IPv6 rules reference them separately, matching how
security groups treat the two families.
how fast do updates propagate?
Typically inside the hour of a vendor publishing, and within a minute of the change landing in the feed. Removals are intentionally slower: a range the vendor drops stays in the list through a grace window, so old and new ranges overlap during vendor rotations and traffic is not interrupted between them.
how does the quota math work?
Referencing a prefix list consumes the list's max_entries against
the rules-per-security-group quota (default 60). This is an AWS mechanic that
applies to any prefix list. slash0 handles it three ways:
max_entries is sized close to the actual entry count, since consumers
pay quota for the max rather than the actual; the onboarding stack computes the
quota a subscription set needs and files the Service Quotas request; and the
catalog lists every purpose's rule cost.
what about services behind Cloudflare or CloudFront?
IP pinning does not work for them. Pinning a shared CDN range allowlists the
entire CDN, including unrelated sites behind it. The catalog classifies every
service (dedicated, mixed, cdn-shared) so
this is visible before you build. A later phase addresses these services with
hostname-aware enforcement running in your VPC.
who runs slash0?
slash0 is independently built and operated. The delivery mechanism is AWS primitives end to end, the feed pipeline is open source, and the design goal throughout is that claims should be verifiable rather than taken on trust.
what happens if slash0 disappears?
Nothing stops working. The prefix lists live in AWS and your rules reference them directly. If slash0's systems stop, security groups keep enforcing the last-published ranges indefinitely. Nothing expires and no traffic is interrupted. Ranges would go stale over time, the same as hand-maintained rules that stop being maintained. Migrating off is also simple: list entries are visible in your console, so they can be copied into a prefix list you own and your rules repointed. There is no lock-in mechanism.