diff --git a/update_prefix_lists_lambda/README.md b/update_prefix_lists_lambda/README.md
new file mode 100644
index 0000000..cbba554
--- /dev/null
+++ b/update_prefix_lists_lambda/README.md
@@ -0,0 +1,139 @@
+# Setup
+
+## update-prefix-lists
+
+A Lambda function for updating VPC managed prefix lists to permit ingress from Amazon CloudFront IPv4 addresses. You would typically use the prefix list as an ingress rule on a security group to allow CloudFront to reach an endpoint.
+
+## Prefix Lists
+
+This Lambda function updates managed prefix lists based on their tags. You will need to have 2 prefix lists groups (a *regional* and a *global* one).
+
+### Tagging Prefix Lists to be Managed by this Lambda Function
+Create 2 prefix lists and put the following 2 tags on each one.
+
+1. A global prefix list:
+  * **Name**: `cloudfront_g`
+  * **AutoUpdate**: `true`
+2. A regional prefix list:
+  * **Name**: `cloudfront_r`
+  * **AutoUpdate**: `true`
+
+
+## Event Source
+
+This lambda function is designed to be subscribed to the 
+[AmazonIpSpaceChanged](http://docs.aws.amazon.com/general/latest/gr/aws-ip-ranges.html#subscribe-notifications) 
+SNS topic. In the _Add Event Source_ dialog, select **SNS** in the *Event source type*, and populate *SNS Topic* with `arn:aws:sns:us-east-1:806199016981:AmazonIpSpaceChanged`.
+
+
+## Policy
+
+To be able to make sufficient use of this Lambda function, you will require a role with a number of permissions. An example policy is as follows:
+
+```
+{
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Effect": "Allow",
+            "Action": [
+                "ec2:ModifyManagedPrefixList",
+                "ec2:GetManagedPrefixListEntries"
+            ],
+            "Resource": "*",
+            "Condition": {
+                "StringEquals": {
+                    "aws:ResourceTag/Name": [
+                        "cloudfront_g",
+                        "cloudfront_r"
+                    ],
+                    "aws:ResourceTag/AutoUpdate": "true"
+                }
+            }
+        },
+        {
+            "Effect": "Allow",
+            "Action": "ec2:DescribeManagedPrefixLists",
+            "Resource": "*"
+        },
+        {
+            "Action": [
+                "logs:CreateLogGroup",
+                 "logs:CreateLogStream",
+                 "logs:PutLogEvents"
+            ],
+            "Effect": "Allow",
+            "Resource": "arn:aws:logs:*:*:*"
+        }
+    ]
+}
+```
+
+Be sure to replace `[region]` with the AWS Region for your prefix lists, and `[account-id]` with your account number.
+
+For more information on ip-ranges.json, read the documentation on [AWS IP Address Ranges](http://docs.aws.amazon.com/general/latest/gr/aws-ip-ranges.html).
+
+## Test Lambda Function
+Now that you have created your function, it’s time to test it and initialize your prefix lists:
+
+1.  In the Lambda console on the Functions page, choose your function, choose the Actions drop-down menu, and then Configure test event.
+2.  Enter the following as your sample event, which will represent an SNS notification.
+
+```
+{
+  "Records": [
+    {
+      "EventVersion": "1.0",
+      "EventSubscriptionArn": "arn:aws:sns:EXAMPLE",
+      "EventSource": "aws:sns",
+      "Sns": {
+        "SignatureVersion": "1",
+        "Timestamp": "1970-01-01T00:00:00.000Z",
+        "Signature": "EXAMPLE",
+        "SigningCertUrl": "EXAMPLE",
+        "MessageId": "95df01b4-ee98-5cb9-9903-4c221d41eb5e",
+        "Message": "{\"create-time\": \"yyyy-mm-ddThh:mm:ss+00:00\", \"synctoken\": \"0123456789\", \"md5\": \"7fd59f5c7f5cf643036cbd4443ad3e4b\", \"url\": \"https://ip-ranges.amazonaws.com/ip-ranges.json\"}",
+        "Type": "Notification",
+        "UnsubscribeUrl": "EXAMPLE",
+        "TopicArn": "arn:aws:sns:EXAMPLE",
+        "Subject": "TestInvoke"
+      }
+    }
+  ]
+}
+```
+3.  After you’ve added the test event, click Save and test. Your Lambda function will be invoked, and you should see log output at the bottom of the console similar to the following.
+<pre>
+Updating from https://ip-ranges.amazonaws.com/ip-ranges.json
+MD5 Mismatch: got <b>2e967e943cf98ae998efeec05d4f351c</b> expected 7fd59f5c7f5cf643036cbd4443ad3e4b: Exception
+Traceback (most recent call last):
+  File "/var/task/lambda_function.py", line 29, in lambda_handler
+    ip_ranges = json.loads(get_ip_groups_json(message['url'], message['md5']))
+  File "/var/task/lambda_function.py", line 50, in get_ip_groups_json
+    raise Exception('MD5 Missmatch: got ' + hash + ' expected ' + expected_hash)
+Exception: MD5 Mismatch: got <b>2e967e943cf98ae998efeec05d4f351c</b> expected 7fd59f5c7f5cf643036cbd4443ad3e4b
+</pre>
+You will see a message indicating there was a hash mismatch. Normally, a real SNS notification from the IP Ranges SNS topic will include the right hash, but because our sample event is a test case representing the event, you will need to update the sample event manually to have the expected hash.
+
+4.  Edit the sample event again, and this time change the md5 hash **that is bold** to be the first hash provided in the log output. In this example, we would update the sample event with the hash “2e967e943cf98ae998efeec05d4f351c”.
+
+
+5.  Click Save and test, and your Lambda function will be invoked.
+
+This time, you should see output indicating yourprefix list was properly updated. If you go back to the EC2 console and view the prefix list you created, you will now see all the CloudFront IP ranges added as allowed points of ingress. If your log output is different, it should help you identify the issue.
+
+## Configure your Lambda function’s trigger
+After you have validated that your function is executing properly, it’s time to connect it to the SNS topic for IP changes. To do this, use the AWS Command Line Interface (CLI). Enter the following command, making sure to replace <Lambda ARN> with the Amazon Resource Name (ARN) of your Lambda function. You will find this ARN at the top right when viewing the configuration of your Lambda function.
+
+`aws sns subscribe --topic-arn arn:aws:sns:us-east-1:806199016981:AmazonIpSpaceChanged --protocol lambda --notification-endpoint <Lambda ARN>`
+
+You should receive an ARN of your Lambda function’s SNS subscription. Your Lambda function will now be invoked whenever AWS publishes new IP ranges!
+***
+
+Copyright 2018 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+
+Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at
+
+    http://aws.amazon.com/apache2.0/
+
+or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
diff --git a/update_prefix_lists_lambda/update_prefix_lists.py b/update_prefix_lists_lambda/update_prefix_lists.py
new file mode 100644
index 0000000..5865040
--- /dev/null
+++ b/update_prefix_lists_lambda/update_prefix_lists.py
@@ -0,0 +1,177 @@
+'''
+Copyright 2018 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at
+    http://aws.amazon.com/apache2.0/
+or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
+'''
+
+
+GLOBAL_PL_TAGS = { 'Name': 'cloudfront_g', 'AutoUpdate': 'true' }
+REGION_PL_TAGS = { 'Name': 'cloudfront_r', 'AutoUpdate': 'true' }
+
+import boto3
+import hashlib
+import json
+import logging
+import urllib.request, urllib.error, urllib.parse
+import os
+
+
+def lambda_handler(event, context):
+    # Set up logging
+    if len(logging.getLogger().handlers) > 0:
+        logging.getLogger().setLevel(logging.INFO)
+    else:
+        logging.basicConfig(level=logging.DEBUG)
+    
+    # Set the environment variable DEBUG to 'true' if you want verbose debug details in CloudWatch Logs.
+    try:
+        if os.environ['DEBUG'] == 'true':
+            logging.getLogger().setLevel(logging.INFO)
+    except KeyError:
+        pass
+
+    # If you want a different service, set the SERVICE environment variable.
+    # It defaults to CLOUDFRONT. Using 'jq' and 'curl' get the list of possible
+    # services like this:
+    # curl -s 'https://ip-ranges.amazonaws.com/ip-ranges.json' | jq -r '.prefixes[] | .service' ip-ranges.json | sort -u 
+    SERVICE = os.getenv( 'SERVICE', "CLOUDFRONT")
+    
+    message = json.loads(event['Records'][0]['Sns']['Message'])
+
+    # Load the ip ranges from the url
+    ip_ranges = json.loads(get_ip_groups_json(message['url'], message['md5']))
+    logging.info(ip_ranges)
+
+    # Extract the service ranges
+    global_cf_ranges = get_ranges_for_service(ip_ranges, SERVICE, "GLOBAL")
+    region_cf_ranges = get_ranges_for_service(ip_ranges, SERVICE, "REGION")
+
+    # Update the prefix lists
+    result = update_prefix_lists(global_cf_ranges, "GLOBAL")
+    result = result + update_prefix_lists(region_cf_ranges, "REGION")
+    
+    return result
+
+
+def get_ip_groups_json(url, expected_hash):
+    
+    logging.debug("Updating from " + url)
+
+    response = urllib.request.urlopen(url)
+    ip_json = response.read()
+
+    m = hashlib.md5()
+    m.update(ip_json)
+    hash = m.hexdigest()
+
+    if hash != expected_hash:
+        raise Exception('MD5 Mismatch: got ' + hash + ' expected ' + expected_hash)
+
+    return ip_json
+
+def get_ranges_for_service(ranges, service, subset):
+    
+    service_ranges = list()
+    for prefix in ranges['prefixes']:
+        if prefix['service'] == service and ((subset == prefix['region'] and subset == "GLOBAL") or (subset != 'GLOBAL' and prefix['region'] != 'GLOBAL')):
+            logging.info(('Found ' + service + ' region: ' + prefix['region'] + ' range: ' + prefix['ip_prefix']))
+            service_ranges.append(prefix['ip_prefix'])
+
+    return service_ranges
+
+def update_prefix_lists(new_ranges, rangeType):
+    
+    client = boto3.client('ec2')
+    result = list()
+
+    tagToFind = {}
+    if rangeType == "GLOBAL":
+        tagToFind = GLOBAL_PL_TAGS
+    else:
+        tagToFind = REGION_PL_TAGS    
+    rangeToUpdate = get_prefix_lists_for_update(client, tagToFind)
+    msg = 'tagged Name: {} to update'.format( tagToFind["Name"] )
+    logging.info('Found {} prefix lists {}'.format( str(len(rangeToUpdate)), msg ) )
+
+    if len(rangeToUpdate) == 0:
+        result.append( 'No prefix lists {}'.format(msg) )
+        logging.warning( 'No prefix lists {}'.format(msg) )
+    else:
+        for prefixListToUpdate in rangeToUpdate:
+            if update_prefix_list(client, prefixListToUpdate, new_ranges ):
+                result.append('Prefix List {} updated.'.format( prefixListToUpdate['PrefixListId'] ) )
+            else:
+                result.append('Prefix List {} unchanged.'.format( prefixListToUpdate['PrefixListId'] ) )
+
+    return result
+
+
+def update_prefix_list(client, prefix_list, new_ranges):
+    prefix_list_entries = client.get_managed_prefix_list_entries(
+        PrefixListId=prefix_list["PrefixListId"]
+    ).get("Entries")
+
+    old_prefixes = list()
+    to_revoke = list()
+    to_add = list()
+
+    for entry in prefix_list_entries:
+        cidr = entry['Cidr']
+        old_prefixes.append(cidr)
+        if new_ranges.count(cidr) == 0:
+            to_revoke.append(cidr)
+            logging.debug((prefix_list['PrefixListId'] + ": Revoking " + cidr ))
+
+    for range in new_ranges:
+        if old_prefixes.count(range) == 0:
+            to_add.append(range)
+            logging.debug((prefix_list['PrefixListId'] + ": Adding " + range))
+
+    added, removed = len(to_add), len(to_revoke)
+    changed = (added or removed)
+
+    if changed:
+        client.modify_managed_prefix_list(
+            PrefixListId=prefix_list['PrefixListId'],
+            CurrentVersion=prefix_list['Version'],
+            AddEntries=[{"Cidr": cidr} for cidr in to_add],
+            RemoveEntries=[{"Cidr": cidr} for cidr in to_revoke]
+        )
+
+    logging.debug((prefix_list['PrefixListId'] + ": Added " + str(added) + ", Revoked " + str(removed)))
+    return changed
+
+
+def get_prefix_lists_for_update(client, tags):
+    filters =[{ 'Name': "prefix-list-name", 'Values': [ tags.get("Name") ] }]
+
+    response = client.describe_managed_prefix_lists(Filters=filters)
+
+    return [pl for pl in response['PrefixLists'] if all({"Key": tag_key, "Value": tag_value} in pl["Tags"] for tag_key, tag_value in tags.items())]
+
+# This is a handy test event you can use when testing your lambda function.
+'''
+Sample Event From SNS:
+{
+  "Records": [
+    {
+      "EventVersion": "1.0",
+      "EventSubscriptionArn": "arn:aws:sns:EXAMPLE",
+      "EventSource": "aws:sns",
+      "Sns": {
+        "SignatureVersion": "1",
+        "Timestamp": "1970-01-01T00:00:00.000Z",
+        "Signature": "EXAMPLE",
+        "SigningCertUrl": "EXAMPLE",
+        "MessageId": "95df01b4-ee98-5cb9-9903-4c221d41eb5e",
+        "Message": "{\"create-time\": \"yyyy-mm-ddThh:mm:ss+00:00\", \"synctoken\": \"0123456789\", \"md5\": \"45be1ba64fe83acb7ef247bccbc45704\", \"url\": \"https://ip-ranges.amazonaws.com/ip-ranges.json\"}",
+        "Type": "Notification",
+        "UnsubscribeUrl": "EXAMPLE",
+        "TopicArn": "arn:aws:sns:EXAMPLE",
+        "Subject": "TestInvoke"
+      }
+    }
+  ]
+}
+'''
\ No newline at end of file