run this only after your share exists
The stack accepts a pending RAM share invitation sent to your account. If no invitation is waiting, it accepts nothing, and the quota request it files will be a request your account does not yet need. Run it only once slash0 has confirmed the lists are shared with your account ID.
If you have not been onboarded yet, this page is not your next step:
- Want the hosted lists? Onboarding is currently by arrangement. Request early access and slash0 will confirm your account ID and create the share. Marketplace self-serve purchasing is planned and is not available yet.
- Want the data only? The Terraform provider and the signed feed are free and need no onboarding at all. Start with the quickstart.
what it does
Two things, both scoped to your account, and nothing else:
- Accepts pending RAM invitations whose sender is a slash0
publisher account you name in the
PublisherAccountIdsparameter. Invitations from any other account are ignored. RAM invitations expire in about 12 hours; the publisher reissues expired ones, so a late run is safe. - Requests the rules-per-security-group quota
(
L-0EA8095F) at the value you pass inDesiredRulesPerSG, skipping the request when the account already has that much or when you pass0. Approval is asynchronous and large increases can need a support case.
Both run once per region named in Regions. Prefix lists are
regional and a security group can only reference one in its own region, so a
region left out of that list cannot use slash0. Naming a region you do not use
costs nothing: with no invitation pending there is nothing to accept, and the
quota is requested only where a slash0 share is live. A region your account has
not enabled is reported in the stack output and skipped.
It creates an IAM role and a Lambda-backed custom resource to do that work. It does not create security groups, VPC resources, or anything that carries traffic. Deleting the stack removes the role and the function and changes nothing else: accepted shares stay accepted and the quota stays raised.
launch it
Prefilled from the
quota calculator with
DesiredRulesPerSG=. You can edit it in the
console before creating the stack.
The link opens the CloudFormation quick-create form in your own console with
the template and parameters filled in. Nothing is created until you review the
parameters and confirm. Use the
quota calculator to work out the
DesiredRulesPerSG value for the services you plan to reference.
Whichever region the console opens in is where the role and function are
created. It does not limit which regions are onboarded: that is the
Regions parameter, and one stack covers all of them.
parameters
| parameter | meaning |
|---|---|
PublisherAccountIds | Comma-separated slash0 publisher account IDs whose invitations may be accepted. Invitations from anyone else are ignored. |
Regions | Regions to onboard, comma-separated. Defaults to the regions slash0 serves. A region left out cannot reference the prefix lists. |
DesiredRulesPerSG | Quota to request, in every
region where a slash0 share is live. 0 skips the request
entirely. |
RunCounter | Bump it and update the stack to re-run acceptance and the quota request, for example after a new subscription adds lists. |
after it runs
The shared prefix lists appear in your account as
slash0.<service>.<purpose>.v4 and .v6, ready
to reference by pl-… id in security group rules exactly like an
AWS-managed prefix list. The how it works page
covers how updates reach those rules. If a list later cannot grow because the
quota request was not approved, the publisher alarms rather than failing quietly.