Repository: aws/aws-cdk
Pull request #33619: feat(ec2): support `PrefixList.fromLookup()`
Author: login: Tietew
Labels: name: p2
name: feature-request
description: A feature should be added or improved.
name: effort/medium
description: Medium work item – several days of effort
name: star-contributor
description: [Pilot] contributed between 25-49 PRs to the CDK
name: pr/needs-maintainer-review
description: This PR needs a review from a Core Team Member
Created: 2025-02-28T04:06:18Z | Merged: 2025-03-24T18:58:34Z

### Issue # (if applicable)

Closes aws/aws-cdk#33606.
Closes aws/aws-cdk#15115.

### Reason for this change

AWS-managed prefix lists are useful to control traffic VPC and AWS managed services.
The name of the AWS-managed prefix list is documented but the id should be copy&paste by hand.

### Description of changes

This PR implements `PrefixList.fromLookup()` to look up an existing managed prefix list by name.
``` ts
ec2.PrefixList.fromLookup(this, 'CloudFrontOriginFacing', {
  prefixListName: 'com.amazonaws.global.cloudfront.origin-facing',
});
```

Uses the new CloudControl context provider: https://github.com/aws/aws-cdk-cli/pull/138 and https://github.com/cdklabs/cloud-assembly-schema/pull/124.

### Describe any new or updated permissions being added

Nothing.

### Description of how you validated changes

Added unit tests and an integ test.

### Checklist
- [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md)

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*



Diff:
diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-ec2/test/integ.prefix-list-lookup.js.snapshot/cdk.out b/packages/@aws-cdk-testing/framework-integ/test/aws-ec2/test/integ.prefix-list-lookup.js.snapshot/cdk.out
new file mode 100644
index 0000000000000..1e02a2deb191b
--- /dev/null
+++ b/packages/@aws-cdk-testing/framework-integ/test/aws-ec2/test/integ.prefix-list-lookup.js.snapshot/cdk.out
@@ -0,0 +1 @@
+{"version":"40.0.0"}
\ No newline at end of file
diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-ec2/test/integ.prefix-list-lookup.js.snapshot/integ.json b/packages/@aws-cdk-testing/framework-integ/test/aws-ec2/test/integ.prefix-list-lookup.js.snapshot/integ.json
new file mode 100644
index 0000000000000..c963a35df51a4
--- /dev/null
+++ b/packages/@aws-cdk-testing/framework-integ/test/aws-ec2/test/integ.prefix-list-lookup.js.snapshot/integ.json
@@ -0,0 +1,13 @@
+{
+  "enableLookups": true,
+  "version": "40.0.0",
+  "testCases": {
+    "prefixlist-from-lookup-integ/DefaultTest": {
+      "stacks": [
+        "prefixlist-from-lookup"
+      ],
+      "assertionStack": "prefixlist-from-lookup-integ/DefaultTest/DeployAssert",
+      "assertionStackName": "prefixlistfromlookupintegDefaultTestDeployAssertE62179E7"
+    }
+  }
+}
\ No newline at end of file
diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-ec2/test/integ.prefix-list-lookup.js.snapshot/manifest.json b/packages/@aws-cdk-testing/framework-integ/test/aws-ec2/test/integ.prefix-list-lookup.js.snapshot/manifest.json
new file mode 100644
index 0000000000000..33c0e7c6b89b8
--- /dev/null
+++ b/packages/@aws-cdk-testing/framework-integ/test/aws-ec2/test/integ.prefix-list-lookup.js.snapshot/manifest.json
@@ -0,0 +1,136 @@
+{
+  "version": "40.0.0",
+  "artifacts": {
+    "prefixlist-from-lookup.assets": {
+      "type": "cdk:asset-manifest",
+      "properties": {
+        "file": "prefixlist-from-lookup.assets.json",
+        "requiresBootstrapStackVersion": 6,
+        "bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version"
+      }
+    },
+    "prefixlist-from-lookup": {
+      "type": "aws:cloudformation:stack",
+      "environment": "aws://12345678/test-region",
+      "properties": {
+        "templateFile": "prefixlist-from-lookup.template.json",
+        "terminationProtection": false,
+        "validateOnSynth": false,
+        "assumeRoleArn": "arn:${AWS::Partition}:iam::12345678:role/cdk-hnb659fds-deploy-role-12345678-test-region",
+        "cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::12345678:role/cdk-hnb659fds-cfn-exec-role-12345678-test-region",
+        "stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-12345678-test-region/fb53e1a8369dd717f797defd1b48d8b95c0d2e0770a86d5e704d37084c2e963f.json",
+        "requiresBootstrapStackVersion": 6,
+        "bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version",
+        "additionalDependencies": [
+          "prefixlist-from-lookup.assets"
+        ],
+        "lookupRole": {
+          "arn": "arn:${AWS::Partition}:iam::12345678:role/cdk-hnb659fds-lookup-role-12345678-test-region",
+          "requiresBootstrapStackVersion": 8,
+          "bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version"
+        }
+      },
+      "dependencies": [
+        "prefixlist-from-lookup.assets"
+      ],
+      "metadata": {
+        "/prefixlist-from-lookup/PrefixListId": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "PrefixListId"
+          }
+        ],
+        "/prefixlist-from-lookup/BootstrapVersion": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "BootstrapVersion"
+          }
+        ],
+        "/prefixlist-from-lookup/CheckBootstrapVersion": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "CheckBootstrapVersion"
+          }
+        ]
+      },
+      "displayName": "prefixlist-from-lookup"
+    },
+    "prefixlistfromlookupintegDefaultTestDeployAssertE62179E7.assets": {
+      "type": "cdk:asset-manifest",
+      "properties": {
+        "file": "prefixlistfromlookupintegDefaultTestDeployAssertE62179E7.assets.json",
+        "requiresBootstrapStackVersion": 6,
+        "bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version"
+      }
+    },
+    "prefixlistfromlookupintegDefaultTestDeployAssertE62179E7": {
+      "type": "aws:cloudformation:stack",
+      "environment": "aws://unknown-account/unknown-region",
+      "properties": {
+        "templateFile": "prefixlistfromlookupintegDefaultTestDeployAssertE62179E7.template.json",
+        "terminationProtection": false,
+        "validateOnSynth": false,
+        "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-deploy-role-${AWS::AccountId}-${AWS::Region}",
+        "cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}",
+        "stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22.json",
+        "requiresBootstrapStackVersion": 6,
+        "bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version",
+        "additionalDependencies": [
+          "prefixlistfromlookupintegDefaultTestDeployAssertE62179E7.assets"
+        ],
+        "lookupRole": {
+          "arn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-lookup-role-${AWS::AccountId}-${AWS::Region}",
+          "requiresBootstrapStackVersion": 8,
+          "bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version"
+        }
+      },
+      "dependencies": [
+        "prefixlistfromlookupintegDefaultTestDeployAssertE62179E7.assets"
+      ],
+      "metadata": {
+        "/prefixlist-from-lookup-integ/DefaultTest/DeployAssert/BootstrapVersion": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "BootstrapVersion"
+          }
+        ],
+        "/prefixlist-from-lookup-integ/DefaultTest/DeployAssert/CheckBootstrapVersion": [
+          {
+            "type": "aws:cdk:logicalId",
+            "data": "CheckBootstrapVersion"
+          }
+        ]
+      },
+      "displayName": "prefixlist-from-lookup-integ/DefaultTest/DeployAssert"
+    },
+    "Tree": {
+      "type": "cdk:tree",
+      "properties": {
+        "file": "tree.json"
+      }
+    }
+  },
+  "missing": [
+    {
+      "key": "cc-api-provider:account=12345678:propertiesToReturn.0=PrefixListId:propertyMatch.PrefixListName=com.amazonaws.global.cloudfront.origin-facing:region=test-region:typeName=AWS$:$:EC2$:$:PrefixList",
+      "provider": "cc-api-provider",
+      "props": {
+        "dummyValue": [
+          {
+            "PrefixListId": "pl-xxxxxxxx"
+          }
+        ],
+        "account": "12345678",
+        "region": "test-region",
+        "typeName": "AWS::EC2::PrefixList",
+        "propertyMatch": {
+          "PrefixListName": "com.amazonaws.global.cloudfront.origin-facing"
+        },
+        "propertiesToReturn": [
+          "PrefixListId"
+        ],
+        "lookupRoleArn": "arn:${AWS::Partition}:iam::12345678:role/cdk-hnb659fds-lookup-role-12345678-test-region"
+      }
+    }
+  ]
+}
\ No newline at end of file
diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-ec2/test/integ.prefix-list-lookup.js.snapshot/prefixlist-from-lookup.assets.json b/packages/@aws-cdk-testing/framework-integ/test/aws-ec2/test/integ.prefix-list-lookup.js.snapshot/prefixlist-from-lookup.assets.json
new file mode 100644
index 0000000000000..e0e306f47fba2
--- /dev/null
+++ b/packages/@aws-cdk-testing/framework-integ/test/aws-ec2/test/integ.prefix-list-lookup.js.snapshot/prefixlist-from-lookup.assets.json
@@ -0,0 +1,20 @@
+{
+  "version": "40.0.0",
+  "files": {
+    "fb53e1a8369dd717f797defd1b48d8b95c0d2e0770a86d5e704d37084c2e963f": {
+      "source": {
+        "path": "prefixlist-from-lookup.template.json",
+        "packaging": "file"
+      },
+      "destinations": {
+        "12345678-test-region": {
+          "bucketName": "cdk-hnb659fds-assets-12345678-test-region",
+          "objectKey": "fb53e1a8369dd717f797defd1b48d8b95c0d2e0770a86d5e704d37084c2e963f.json",
+          "region": "test-region",
+          "assumeRoleArn": "arn:${AWS::Partition}:iam::12345678:role/cdk-hnb659fds-file-publishing-role-12345678-test-region"
+        }
+      }
+    }
+  },
+  "dockerImages": {}
+}
\ No newline at end of file
diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-ec2/test/integ.prefix-list-lookup.js.snapshot/prefixlist-from-lookup.template.json b/packages/@aws-cdk-testing/framework-integ/test/aws-ec2/test/integ.prefix-list-lookup.js.snapshot/prefixlist-from-lookup.template.json
new file mode 100644
index 0000000000000..142e93de33298
--- /dev/null
+++ b/packages/@aws-cdk-testing/framework-integ/test/aws-ec2/test/integ.prefix-list-lookup.js.snapshot/prefixlist-from-lookup.template.json
@@ -0,0 +1,41 @@
+{
+ "Outputs": {
+  "PrefixListId": {
+   "Value": "pl-xxxxxxxx"
+  }
+ },
+ "Parameters": {
+  "BootstrapVersion": {
+   "Type": "AWS::SSM::Parameter::Value<String>",
+   "Default": "/cdk-bootstrap/hnb659fds/version",
+   "Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
+  }
+ },
+ "Rules": {
+  "CheckBootstrapVersion": {
+   "Assertions": [
+    {
+     "Assert": {
+      "Fn::Not": [
+       {
+        "Fn::Contains": [
+         [
+          "1",
+          "2",
+          "3",
+          "4",
+          "5"
+         ],
+         {
+          "Ref": "BootstrapVersion"
+         }
+        ]
+       }
+      ]
+     },
+     "AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
+    }
+   ]
+  }
+ }
+}
\ No newline at end of file
diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-ec2/test/integ.prefix-list-lookup.js.snapshot/prefixlistfromlookupintegDefaultTestDeployAssertE62179E7.assets.json b/packages/@aws-cdk-testing/framework-integ/test/aws-ec2/test/integ.prefix-list-lookup.js.snapshot/prefixlistfromlookupintegDefaultTestDeployAssertE62179E7.assets.json
new file mode 100644
index 0000000000000..5fa1487b4a3f7
--- /dev/null
+++ b/packages/@aws-cdk-testing/framework-integ/test/aws-ec2/test/integ.prefix-list-lookup.js.snapshot/prefixlistfromlookupintegDefaultTestDeployAssertE62179E7.assets.json
@@ -0,0 +1,19 @@
+{
+  "version": "40.0.0",
+  "files": {
+    "21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22": {
+      "source": {
+        "path": "prefixlistfromlookupintegDefaultTestDeployAssertE62179E7.template.json",
+        "packaging": "file"
+      },
+      "destinations": {
+        "current_account-current_region": {
+          "bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
+          "objectKey": "21fbb51d7b23f6a6c262b46a9caee79d744a3ac019fd45422d988b96d44b2a22.json",
+          "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
+        }
+      }
+    }
+  },
+  "dockerImages": {}
+}
\ No newline at end of file
diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-ec2/test/integ.prefix-list-lookup.js.snapshot/prefixlistfromlookupintegDefaultTestDeployAssertE62179E7.template.json b/packages/@aws-cdk-testing/framework-integ/test/aws-ec2/test/integ.prefix-list-lookup.js.snapshot/prefixlistfromlookupintegDefaultTestDeployAssertE62179E7.template.json
new file mode 100644
index 0000000000000..ad9d0fb73d1dd
--- /dev/null
+++ b/packages/@aws-cdk-testing/framework-integ/test/aws-ec2/test/integ.prefix-list-lookup.js.snapshot/prefixlistfromlookupintegDefaultTestDeployAssertE62179E7.template.json
@@ -0,0 +1,36 @@
+{
+ "Parameters": {
+  "BootstrapVersion": {
+   "Type": "AWS::SSM::Parameter::Value<String>",
+   "Default": "/cdk-bootstrap/hnb659fds/version",
+   "Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
+  }
+ },
+ "Rules": {
+  "CheckBootstrapVersion": {
+   "Assertions": [
+    {
+     "Assert": {
+      "Fn::Not": [
+       {
+        "Fn::Contains": [
+         [
+          "1",
+          "2",
+          "3",
+          "4",
+          "5"
+         ],
+         {
+          "Ref": "BootstrapVersion"
+         }
+        ]
+       }
+      ]
+     },
+     "AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
+    }
+   ]
+  }
+ }
+}
\ No newline at end of file
diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-ec2/test/integ.prefix-list-lookup.js.snapshot/tree.json b/packages/@aws-cdk-testing/framework-integ/test/aws-ec2/test/integ.prefix-list-lookup.js.snapshot/tree.json
new file mode 100644
index 0000000000000..f4b2025987b21
--- /dev/null
+++ b/packages/@aws-cdk-testing/framework-integ/test/aws-ec2/test/integ.prefix-list-lookup.js.snapshot/tree.json
@@ -0,0 +1,118 @@
+{
+  "version": "tree-0.1",
+  "tree": {
+    "id": "App",
+    "path": "",
+    "children": {
+      "prefixlist-from-lookup": {
+        "id": "prefixlist-from-lookup",
+        "path": "prefixlist-from-lookup",
+        "children": {
+          "PrefixList": {
+            "id": "PrefixList",
+            "path": "prefixlist-from-lookup/PrefixList",
+            "constructInfo": {
+              "fqn": "aws-cdk-lib.Resource",
+              "version": "0.0.0",
+              "metadata": []
+            }
+          },
+          "PrefixListId": {
+            "id": "PrefixListId",
+            "path": "prefixlist-from-lookup/PrefixListId",
+            "constructInfo": {
+              "fqn": "aws-cdk-lib.CfnOutput",
+              "version": "0.0.0"
+            }
+          },
+          "BootstrapVersion": {
+            "id": "BootstrapVersion",
+            "path": "prefixlist-from-lookup/BootstrapVersion",
+            "constructInfo": {
+              "fqn": "aws-cdk-lib.CfnParameter",
+              "version": "0.0.0"
+            }
+          },
+          "CheckBootstrapVersion": {
+            "id": "CheckBootstrapVersion",
+            "path": "prefixlist-from-lookup/CheckBootstrapVersion",
+            "constructInfo": {
+              "fqn": "aws-cdk-lib.CfnRule",
+              "version": "0.0.0"
+            }
+          }
+        },
+        "constructInfo": {
+          "fqn": "aws-cdk-lib.Stack",
+          "version": "0.0.0"
+        }
+      },
+      "prefixlist-from-lookup-integ": {
+        "id": "prefixlist-from-lookup-integ",
+        "path": "prefixlist-from-lookup-integ",
+        "children": {
+          "DefaultTest": {
+            "id": "DefaultTest",
+            "path": "prefixlist-from-lookup-integ/DefaultTest",
+            "children": {
+              "Default": {
+                "id": "Default",
+                "path": "prefixlist-from-lookup-integ/DefaultTest/Default",
+                "constructInfo": {
+                  "fqn": "constructs.Construct",
+                  "version": "10.4.2"
+                }
+              },
+              "DeployAssert": {
+                "id": "DeployAssert",
+                "path": "prefixlist-from-lookup-integ/DefaultTest/DeployAssert",
+                "children": {
+                  "BootstrapVersion": {
+                    "id": "BootstrapVersion",
+                    "path": "prefixlist-from-lookup-integ/DefaultTest/DeployAssert/BootstrapVersion",
+                    "constructInfo": {
+                      "fqn": "aws-cdk-lib.CfnParameter",
+                      "version": "0.0.0"
+                    }
+                  },
+                  "CheckBootstrapVersion": {
+                    "id": "CheckBootstrapVersion",
+                    "path": "prefixlist-from-lookup-integ/DefaultTest/DeployAssert/CheckBootstrapVersion",
+                    "constructInfo": {
+                      "fqn": "aws-cdk-lib.CfnRule",
+                      "version": "0.0.0"
+                    }
+                  }
+                },
+                "constructInfo": {
+                  "fqn": "aws-cdk-lib.Stack",
+                  "version": "0.0.0"
+                }
+              }
+            },
+            "constructInfo": {
+              "fqn": "@aws-cdk/integ-tests-alpha.IntegTestCase",
+              "version": "0.0.0"
+            }
+          }
+        },
+        "constructInfo": {
+          "fqn": "@aws-cdk/integ-tests-alpha.IntegTest",
+          "version": "0.0.0"
+        }
+      },
+      "Tree": {
+        "id": "Tree",
+        "path": "Tree",
+        "constructInfo": {
+          "fqn": "constructs.Construct",
+          "version": "10.4.2"
+        }
+      }
+    },
+    "constructInfo": {
+      "fqn": "aws-cdk-lib.App",
+      "version": "0.0.0"
+    }
+  }
+}
\ No newline at end of file
diff --git a/packages/@aws-cdk-testing/framework-integ/test/aws-ec2/test/integ.prefix-list-lookup.ts b/packages/@aws-cdk-testing/framework-integ/test/aws-ec2/test/integ.prefix-list-lookup.ts
new file mode 100644
index 0000000000000..c46cd21d56e7a
--- /dev/null
+++ b/packages/@aws-cdk-testing/framework-integ/test/aws-ec2/test/integ.prefix-list-lookup.ts
@@ -0,0 +1,23 @@
+import * as cdk from 'aws-cdk-lib/core';
+import * as integ from '@aws-cdk/integ-tests-alpha';
+import { PrefixList } from 'aws-cdk-lib/aws-ec2';
+
+const app = new cdk.App();
+
+const stack = new cdk.Stack(app, 'prefixlist-from-lookup', {
+  env: {
+    account: process.env.CDK_INTEG_ACCOUNT ?? process.env.CDK_DEFAULT_ACCOUNT,
+    region: process.env.CDK_INTEG_REGION ?? process.env.CDK_DEFAULT_REGION,
+  },
+});
+
+const prefixList = PrefixList.fromLookup(stack, 'PrefixList', {
+  prefixListName: 'com.amazonaws.global.cloudfront.origin-facing',
+});
+
+new cdk.CfnOutput(stack, 'PrefixListId', { value: prefixList.prefixListId });
+
+new integ.IntegTest(app, 'prefixlist-from-lookup-integ', {
+  enableLookups: true,
+  testCases: [stack],
+});
diff --git a/packages/aws-cdk-lib/aws-cloudfront-origins/README.md b/packages/aws-cdk-lib/aws-cloudfront-origins/README.md
index 5edf2c962bca6..3cf3642d6c43f 100644
--- a/packages/aws-cdk-lib/aws-cloudfront-origins/README.md
+++ b/packages/aws-cdk-lib/aws-cloudfront-origins/README.md
@@ -678,8 +678,10 @@ You can allow the traffic from the CloudFront managed prefix list named **com.am
 ``` ts
 declare const alb: elbv2.ApplicationLoadBalancer;
 
-const peer = ec2.Peer.prefixList('pl-xxxxxxxx'); // See the management console to find actual PrefixList Id.
-alb.connections.allowFrom(peer, ec2.Port.HTTP);
+const cfOriginFacing = ec2.PrefixList.fromLookup(this, 'CloudFrontOriginFacing', {
+  prefixListName: 'com.amazonaws.global.cloudfront.origin-facing',
+});
+alb.connections.allowFrom(ec2.Peer.prefixList(cfOriginFacing.prefixListId), ec2.Port.HTTP);
 ```
 
 #### The VPC origin service security group
diff --git a/packages/aws-cdk-lib/aws-ec2/README.md b/packages/aws-cdk-lib/aws-ec2/README.md
index 923024a630393..dd8f3ae2f1394 100644
--- a/packages/aws-cdk-lib/aws-ec2/README.md
+++ b/packages/aws-cdk-lib/aws-ec2/README.md
@@ -2501,7 +2501,15 @@ new ec2.PrefixList(this, 'PrefixList', {
 });
 ```
 
-For more information see [Work with customer-managed prefix lists](https://docs.aws.amazon.com/vpc/latest/userguide/working-with-managed-prefix-lists.html)
+To import AWS-managed prefix list, you can use `PrefixList.fromLookup()`.
+
+``` ts
+ec2.PrefixList.fromLookup(this, 'PrefixListFromName', {
+  prefixListName: 'com.amazonaws.global.cloudfront.origin-facing',
+});
+```
+
+For more information see [Work with customer-managed prefix lists](https://docs.aws.amazon.com/vpc/latest/userguide/working-with-managed-prefix-lists.html).
 
 ### IAM instance profile
 
diff --git a/packages/aws-cdk-lib/aws-ec2/lib/prefix-list.ts b/packages/aws-cdk-lib/aws-ec2/lib/prefix-list.ts
index 6e7628493d349..bfad4fba9c39a 100644
--- a/packages/aws-cdk-lib/aws-ec2/lib/prefix-list.ts
+++ b/packages/aws-cdk-lib/aws-ec2/lib/prefix-list.ts
@@ -1,6 +1,8 @@
 import { Construct } from 'constructs';
+import { ValidationError } from 'jsonschema';
 import { CfnPrefixList } from './ec2.generated';
-import { IResource, Lazy, Resource, Names } from '../../core';
+import * as cxschema from '../../cloud-assembly-schema';
+import { IResource, Lazy, Resource, Names, ContextProvider, Token } from '../../core';
 import { addConstructMetadata } from '../../core/lib/metadata-resource';
 
 /**
@@ -76,6 +78,38 @@ abstract class PrefixListBase extends Resource implements IPrefixList {
   public abstract readonly prefixListId: string;
 }
 
+/**
+ * Properties for looking up an existing managed prefix list.
+ */
+export interface PrefixListLookupOptions {
+  /**
+   * The name of the managed prefix list.
+   */
+  readonly prefixListName: string;
+  /**
+   * The ID of the AWS account that owns the managed prefix list.
+   *
+   * @default - Don't filter on ownerId
+   */
+  readonly ownerId?: string;
+  /**
+   * The address family of the managed prefix list.
+   *
+   * @default - Don't filter on addressFamily
+   */
+  readonly addressFamily?: AddressFamily;
+}
+
+/**
+ * Result of CC API context query in fromLookup()
+ */
+interface PrefixListContextResponse {
+  /**
+   * The id of the prefix list
+   */
+  readonly PrefixListId: string;
+}
+
 /**
  * A managed prefix list.
  * @resource AWS::EC2::PrefixList
@@ -83,7 +117,6 @@ abstract class PrefixListBase extends Resource implements IPrefixList {
 export class PrefixList extends PrefixListBase {
   /**
    * Look up prefix list by id.
-   *
    */
   public static fromPrefixListId(scope: Construct, id: string, prefixListId: string): IPrefixList {
     class Import extends Resource implements IPrefixList {
@@ -91,6 +124,41 @@ export class PrefixList extends PrefixListBase {
     }
     return new Import(scope, id);
   }
+
+  /**
+   * Look up prefix list by name
+   */
+  public static fromLookup(scope: Construct, id: string, options: PrefixListLookupOptions): IPrefixList {
+    if (Token.isUnresolved(options.prefixListName)) {
+      throw new ValidationError('All arguments to look up a managed prefix list must be concrete (no Tokens)', scope);
+    }
+
+    const dummyResponse = { PrefixListId: 'pl-xxxxxxxx' };
+    const response: PrefixListContextResponse[] = ContextProvider.getValue(scope, {
+      provider: cxschema.ContextProvider.CC_API_PROVIDER,
+      props: {
+        typeName: 'AWS::EC2::PrefixList',
+        propertyMatch: {
+          PrefixListName: options.prefixListName,
+          ...(options.ownerId ? { OwnerId: options.ownerId } : undefined),
+          ...(options.addressFamily ? { AddressFamily: options.addressFamily } : undefined),
+        },
+        propertiesToReturn: ['PrefixListId'],
+      } satisfies Omit<cxschema.CcApiContextQuery, 'account'|'region'>,
+      dummyValue: [dummyResponse] satisfies PrefixListContextResponse[],
+    }).value;
+
+    // getValue returns a list of result objects. We are expecting 1 result or Error.
+    if (response.length === 0) {
+      throw new ValidationError(`Could not find any managed prefix lists matching ${JSON.stringify(options)}`, scope);
+    } else if (response.length > 1) {
+      throw new ValidationError(`Found ${response.length} managed prefix lists matching ${JSON.stringify(options)}; please narrow the search criteria`, scope);
+    }
+
+    const prefixList = response[0];
+    return this.fromPrefixListId(scope, id, prefixList.PrefixListId);
+  }
+
   /**
    * The ID of the prefix list
    *
diff --git a/packages/aws-cdk-lib/aws-ec2/test/prefix-list.test.ts b/packages/aws-cdk-lib/aws-ec2/test/prefix-list.test.ts
index 209f6cb665e02..aa05296962487 100644
--- a/packages/aws-cdk-lib/aws-ec2/test/prefix-list.test.ts
+++ b/packages/aws-cdk-lib/aws-ec2/test/prefix-list.test.ts
@@ -1,7 +1,12 @@
 import { Template } from '../../assertions';
-import { Stack } from '../../core';
+import * as cxschema from '../../cloud-assembly-schema';
+import { CfnParameter, ContextProvider, Stack } from '../../core';
 import { AddressFamily, PrefixList } from '../lib/prefix-list';
 
+afterEach(() => {
+  jest.restoreAllMocks();
+});
+
 describe('prefix list', () => {
   test('default empty prefixlist', () => {
     // GIVEN
@@ -101,4 +106,111 @@ describe('prefix list', () => {
       });
     }).toThrow('Invalid IPv6 address range: 10.0.0.1/32');
   });
+
+  test('fromLookup returns a correct PrefixList', () => {
+    // GIVEN
+    const resultObjs = [
+      { Identifier: 'pl-deadbeef', PrefixListId: 'pl-deadbeef' },
+    ];
+    const mock = jest.spyOn(ContextProvider, 'getValue').mockReturnValue({ value: resultObjs });
+
+    // WHEN
+    const stack = new Stack(undefined, undefined, { env: { region: 'us-east-1', account: '123456789012' } });
+    const prefixList = PrefixList.fromLookup(stack, 'PrefixList', {
+      prefixListName: 'com.amazonaws.us-east-1.testprefixlist',
+    });
+
+    // THEN
+    expect(prefixList.prefixListId).toEqual('pl-deadbeef');
+    expect(mock).toHaveBeenCalledWith(stack, {
+      provider: cxschema.ContextProvider.CC_API_PROVIDER,
+      props: {
+        typeName: 'AWS::EC2::PrefixList',
+        propertyMatch: {
+          PrefixListName: 'com.amazonaws.us-east-1.testprefixlist',
+        },
+        propertiesToReturn: ['PrefixListId'],
+      },
+      dummyValue: [
+        { PrefixListId: 'pl-xxxxxxxx' },
+      ],
+    });
+  });
+
+  test('fromLookup queries with ownerId and addressFamily', () => {
+    // GIVEN
+    const resultObjs = [
+      { Identifier: 'pl-deadbeef', PrefixListId: 'pl-deadbeef' },
+    ];
+    const mock = jest.spyOn(ContextProvider, 'getValue').mockReturnValue({ value: resultObjs });
+
+    // WHEN
+    const stack = new Stack(undefined, undefined, { env: { region: 'us-east-1', account: '123456789012' } });
+    const prefixList = PrefixList.fromLookup(stack, 'PrefixList', {
+      prefixListName: 'com.amazonaws.us-east-1.testprefixlist',
+      ownerId: '234567890123',
+      addressFamily: AddressFamily.IP_V6,
+    });
+
+    // THEN
+    expect(prefixList.prefixListId).toEqual('pl-deadbeef');
+    expect(mock).toHaveBeenCalledWith(stack, {
+      provider: cxschema.ContextProvider.CC_API_PROVIDER,
+      props: {
+        typeName: 'AWS::EC2::PrefixList',
+        propertyMatch: {
+          PrefixListName: 'com.amazonaws.us-east-1.testprefixlist',
+          OwnerId: '234567890123',
+          AddressFamily: 'IPv6',
+        },
+        propertiesToReturn: ['PrefixListId'],
+      },
+      dummyValue: [
+        { PrefixListId: 'pl-xxxxxxxx' },
+      ],
+    });
+  });
+
+  test('fromLookup throws if prefix list name is a token', () => {
+    // WHEN
+    const stack = new Stack(undefined, undefined, { env: { region: 'us-east-1', account: '123456789012' } });
+    const prefixListName = new CfnParameter(stack, 'PrefixListName');
+
+    // THEN
+    expect(() => {
+      PrefixList.fromLookup(stack, 'PrefixList', { prefixListName: prefixListName.valueAsString });
+    }).toThrow('All arguments to look up a managed prefix list must be concrete (no Tokens)');
+  });
+
+  test('fromLookup throws if not found', () => {
+    // GIVEN
+    const resultObjs = [];
+    jest.spyOn(ContextProvider, 'getValue').mockReturnValue({ value: resultObjs });
+
+    // WHEN
+    const stack = new Stack(undefined, undefined, { env: { region: 'us-east-1', account: '123456789012' } });
+
+    // THEN
+    expect(() => {
+      PrefixList.fromLookup(stack, 'PrefixList', {
+        prefixListName: 'com.amazonaws.us-east-1.missingprefixlist',
+      });
+    }).toThrow('Could not find any managed prefix lists matching');
+  });
+
+  test('fromLookup throws if multiple resources found', () => {
+    // GIVEN
+    const resultObjs = [{ PrefixListId: 'pl-xxxxxxxx' }, { PrefixListId: 'pl-yyyyyyyy' }];
+    jest.spyOn(ContextProvider, 'getValue').mockReturnValue({ value: resultObjs });
+
+    // WHEN
+    const stack = new Stack(undefined, undefined, { env: { region: 'us-east-1', account: '123456789012' } });
+
+    // THEN
+    expect(() => {
+      PrefixList.fromLookup(stack, 'PrefixList', {
+        prefixListName: 'com.amazonaws.us-east-1.missingprefixlist',
+      });
+    }).toThrow('Found 2 managed prefix lists matching');
+  });
 });


Reviews:
user: login: aws-cdk-automation
body: (This review is outdated)
state: DISMISSED
author_association: COLLABORATOR
submitted_at: 2025-02-28T04:08:15Z
user: login: Tietew
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-03T11:06:33Z
user: login: badmintoncryer
body: Thank you for your contribution! The implementation details were very informative for me!
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-03-04T22:14:42Z
user: login: shikha372
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-07T22:30:02Z
user: login: Tietew
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-08T02:56:13Z
user: login: shikha372
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-13T16:58:21Z
user: login: shikha372
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-13T17:07:55Z
user: login: Tietew
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-14T04:13:46Z
user: login: Tietew
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-14T04:24:45Z
user: login: Tietew
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-14T04:34:52Z
user: login: shikha372
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-17T23:04:52Z
user: login: Tietew
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-18T02:20:07Z
user: login: shikha372
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-18T22:17:11Z
user: login: shikha372
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-18T22:20:29Z
user: login: Tietew
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-19T03:43:46Z
user: login: Tietew
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-19T04:00:48Z
user: login: Tietew
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-19T04:44:08Z
user: login: Tietew
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-19T05:45:32Z
user: login: Tietew
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-19T08:10:03Z
user: login: Tietew
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-19T13:53:59Z
user: login: Tietew
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-19T13:54:42Z
user: login: shikha372
state: DISMISSED
author_association: CONTRIBUTOR
submitted_at: 2025-03-20T22:18:03Z
user: login: shikha372
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-03-24T18:27:10Z

Review comments:
diff_hunk: @@ -678,8 +678,10 @@ You can allow the traffic from the CloudFront managed prefix list named **com.am
 ``` ts
 declare const alb: elbv2.ApplicationLoadBalancer;
 
-const peer = ec2.Peer.prefixList('pl-xxxxxxxx'); // See the management console to find actual PrefixList Id.
-alb.connections.allowFrom(peer, ec2.Port.HTTP);
+const cfOriginFacing = ec2.PrefixList.fromLookup(this, 'CloudFrontOriginFacing', {
+  prefixListName: 'com.amazonaws.global.cloudfront.origin-facing',
+});
+alb.connections.allowFrom(ec2.Peer.prefixList(cfOriginFacing.prefixListId), ec2.Port.HTTP);
path: packages/aws-cdk-lib/aws-cloudfront-origins/README.md
user: login: Tietew
body: #33617 allows this line to be changed to
```ts
alb.connections.allowFrom(cfOriginFacing, ec2.Port.HTTP);
```
created_at: 2025-03-03T11:06:33Z
author_association: CONTRIBUTOR
diff_hunk: @@ -2501,7 +2501,15 @@ new ec2.PrefixList(this, 'PrefixList', {
 });
 ```
 
-For more information see [Work with customer-managed prefix lists](https://docs.aws.amazon.com/vpc/latest/userguide/working-with-managed-prefix-lists.html)
+To import AWS-managed prefix list, you can use `PrefixList.fromLookup()`.
+
+``` ts
+ec2.PrefixList.fromLookup(this, 'PrefixListFromName', {
+  prefixListName: 'com.amazonaws.global.cloudfront.origin-facing',
path: packages/aws-cdk-lib/aws-ec2/README.md
user: login: shikha372
body: I see in the documentation that it says prefix list name cannot start with, does it affect the request being sent to CCAPI.

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-prefixlist.html#cfn-ec2-prefixlist-prefixlistname

```
The name cannot start with com.amazonaws.
```
created_at: 2025-03-07T22:30:02Z
author_association: CONTRIBUTOR
diff_hunk: @@ -2501,7 +2501,15 @@ new ec2.PrefixList(this, 'PrefixList', {
 });
 ```
 
-For more information see [Work with customer-managed prefix lists](https://docs.aws.amazon.com/vpc/latest/userguide/working-with-managed-prefix-lists.html)
+To import AWS-managed prefix list, you can use `PrefixList.fromLookup()`.
+
+``` ts
+ec2.PrefixList.fromLookup(this, 'PrefixListFromName', {
+  prefixListName: 'com.amazonaws.global.cloudfront.origin-facing',
path: packages/aws-cdk-lib/aws-ec2/README.md
user: login: Tietew
body: `fromLookup()` is used to *lookup* an existing managed prefix list, including an *AWS-managed* prefix list which name starts with `com.amazonaws.`.

The documentation just says we users cannot create.

I confirmed the CC API ContextProvider can query an AWS-managed prefix list, see https://github.com/aws/aws-cdk/pull/33619#issuecomment-2689864691 
created_at: 2025-03-08T02:56:13Z
author_association: CONTRIBUTOR
diff_hunk: @@ -76,21 +78,62 @@ abstract class PrefixListBase extends Resource implements IPrefixList {
   public abstract readonly prefixListId: string;
 }
 
+/**
+ * Properties for looking up an existing managed prefix list.
+ */
+export interface PrefixListLookupOptions {
+  /**
+   * The name of the prefix list to lookup.
+   */
+  readonly prefixListName: string;
+}
+
 /**
  * A managed prefix list.
  * @resource AWS::EC2::PrefixList
  */
 export class PrefixList extends PrefixListBase {
   /**
    * Look up prefix list by id.
-   *
    */
   public static fromPrefixListId(scope: Construct, id: string, prefixListId: string): IPrefixList {
     class Import extends Resource implements IPrefixList {
       public readonly prefixListId = prefixListId;
     }
     return new Import(scope, id);
   }
+
+  /**
+   * Look up prefix list by name
+   */
+  public static fromLookup(scope: Construct, id: string, options: PrefixListLookupOptions): IPrefixList {
+    if (Token.isUnresolved(options.prefixListName)) {
+      throw new ValidationError('All arguments to look up a managed prefix list must be concrete (no Tokens)', scope);
+    }
+
+    const dummyResponse = { PrefixListId: 'pl-xxxxxxxx' };
+    const response: {[key: string]: any}[] = ContextProvider.getValue(scope, {
+      provider: cxschema.ContextProvider.CC_API_PROVIDER,
+      props: {
+        typeName: 'AWS::EC2::PrefixList',
+        propertyMatch: {
+          PrefixListName: options.prefixListName,
+        },
+        propertiesToReturn: ['PrefixListId'],
+      } as Omit<cxschema.CcApiContextQuery, 'account'|'region'>,
+      dummyValue: [dummyResponse],
+    }).value;
+
+    // getValue returns a list of result objects. We are expecting 1 result or Error.
+    let prefixList = response[0];
+    if (!prefixList?.PrefixListId) {
+      Annotations.of(scope).addError(`Could not find the managed prefix list '${options.prefixListName}'`);
+      prefixList = dummyResponse;
path: packages/aws-cdk-lib/aws-ec2/lib/prefix-list.ts
user: login: shikha372
body: for my understanding, why do we need the assignment here, can we just throw an error 
created_at: 2025-03-13T16:58:21Z
author_association: CONTRIBUTOR
diff_hunk: @@ -76,21 +78,62 @@ abstract class PrefixListBase extends Resource implements IPrefixList {
   public abstract readonly prefixListId: string;
 }
 
+/**
+ * Properties for looking up an existing managed prefix list.
+ */
+export interface PrefixListLookupOptions {
+  /**
+   * The name of the prefix list to lookup.
+   */
+  readonly prefixListName: string;
+}
+
 /**
  * A managed prefix list.
  * @resource AWS::EC2::PrefixList
  */
 export class PrefixList extends PrefixListBase {
   /**
    * Look up prefix list by id.
-   *
    */
   public static fromPrefixListId(scope: Construct, id: string, prefixListId: string): IPrefixList {
     class Import extends Resource implements IPrefixList {
       public readonly prefixListId = prefixListId;
     }
     return new Import(scope, id);
   }
+
+  /**
+   * Look up prefix list by name
+   */
+  public static fromLookup(scope: Construct, id: string, options: PrefixListLookupOptions): IPrefixList {
+    if (Token.isUnresolved(options.prefixListName)) {
+      throw new ValidationError('All arguments to look up a managed prefix list must be concrete (no Tokens)', scope);
+    }
+
+    const dummyResponse = { PrefixListId: 'pl-xxxxxxxx' };
+    const response: {[key: string]: any}[] = ContextProvider.getValue(scope, {
+      provider: cxschema.ContextProvider.CC_API_PROVIDER,
+      props: {
+        typeName: 'AWS::EC2::PrefixList',
+        propertyMatch: {
+          PrefixListName: options.prefixListName,
+        },
+        propertiesToReturn: ['PrefixListId'],
+      } as Omit<cxschema.CcApiContextQuery, 'account'|'region'>,
path: packages/aws-cdk-lib/aws-ec2/lib/prefix-list.ts
user: login: shikha372
body: also curious about omiting account and region
created_at: 2025-03-13T17:07:55Z
author_association: CONTRIBUTOR
diff_hunk: @@ -76,21 +78,62 @@ abstract class PrefixListBase extends Resource implements IPrefixList {
   public abstract readonly prefixListId: string;
 }
 
+/**
+ * Properties for looking up an existing managed prefix list.
+ */
+export interface PrefixListLookupOptions {
+  /**
+   * The name of the prefix list to lookup.
+   */
+  readonly prefixListName: string;
+}
+
 /**
  * A managed prefix list.
  * @resource AWS::EC2::PrefixList
  */
 export class PrefixList extends PrefixListBase {
   /**
    * Look up prefix list by id.
-   *
    */
   public static fromPrefixListId(scope: Construct, id: string, prefixListId: string): IPrefixList {
     class Import extends Resource implements IPrefixList {
       public readonly prefixListId = prefixListId;
     }
     return new Import(scope, id);
   }
+
+  /**
+   * Look up prefix list by name
+   */
+  public static fromLookup(scope: Construct, id: string, options: PrefixListLookupOptions): IPrefixList {
+    if (Token.isUnresolved(options.prefixListName)) {
+      throw new ValidationError('All arguments to look up a managed prefix list must be concrete (no Tokens)', scope);
+    }
+
+    const dummyResponse = { PrefixListId: 'pl-xxxxxxxx' };
+    const response: {[key: string]: any}[] = ContextProvider.getValue(scope, {
+      provider: cxschema.ContextProvider.CC_API_PROVIDER,
+      props: {
+        typeName: 'AWS::EC2::PrefixList',
+        propertyMatch: {
+          PrefixListName: options.prefixListName,
+        },
+        propertiesToReturn: ['PrefixListId'],
+      } as Omit<cxschema.CcApiContextQuery, 'account'|'region'>,
path: packages/aws-cdk-lib/aws-ec2/lib/prefix-list.ts
user: login: Tietew
body: VSCode detects incompatible type assertion when it is `as cxschema.CcApiContextQuery`.

![image](https://github.com/user-attachments/assets/bcf00586-11ea-4ce0-a92f-232dd4887361)

`account` and `region` are not needed here because `ContextProvider.getKey()` will add them.
https://github.com/aws/aws-cdk/blob/bff85e88fbe0ddb10bdcde8039af1736afa77cc2/packages/aws-cdk-lib/core/lib/context-provider.ts#L77-L79
created_at: 2025-03-14T04:13:46Z
author_association: CONTRIBUTOR
diff_hunk: @@ -76,21 +78,62 @@ abstract class PrefixListBase extends Resource implements IPrefixList {
   public abstract readonly prefixListId: string;
 }
 
+/**
+ * Properties for looking up an existing managed prefix list.
+ */
+export interface PrefixListLookupOptions {
+  /**
+   * The name of the prefix list to lookup.
+   */
+  readonly prefixListName: string;
+}
+
 /**
  * A managed prefix list.
  * @resource AWS::EC2::PrefixList
  */
 export class PrefixList extends PrefixListBase {
   /**
    * Look up prefix list by id.
-   *
    */
   public static fromPrefixListId(scope: Construct, id: string, prefixListId: string): IPrefixList {
     class Import extends Resource implements IPrefixList {
       public readonly prefixListId = prefixListId;
     }
     return new Import(scope, id);
   }
+
+  /**
+   * Look up prefix list by name
+   */
+  public static fromLookup(scope: Construct, id: string, options: PrefixListLookupOptions): IPrefixList {
+    if (Token.isUnresolved(options.prefixListName)) {
+      throw new ValidationError('All arguments to look up a managed prefix list must be concrete (no Tokens)', scope);
+    }
+
+    const dummyResponse = { PrefixListId: 'pl-xxxxxxxx' };
+    const response: {[key: string]: any}[] = ContextProvider.getValue(scope, {
+      provider: cxschema.ContextProvider.CC_API_PROVIDER,
+      props: {
+        typeName: 'AWS::EC2::PrefixList',
+        propertyMatch: {
+          PrefixListName: options.prefixListName,
+        },
+        propertiesToReturn: ['PrefixListId'],
+      } as Omit<cxschema.CcApiContextQuery, 'account'|'region'>,
+      dummyValue: [dummyResponse],
+    }).value;
+
+    // getValue returns a list of result objects. We are expecting 1 result or Error.
+    let prefixList = response[0];
+    if (!prefixList?.PrefixListId) {
+      Annotations.of(scope).addError(`Could not find the managed prefix list '${options.prefixListName}'`);
+      prefixList = dummyResponse;
path: packages/aws-cdk-lib/aws-ec2/lib/prefix-list.ts
user: login: Tietew
body: In other modules, `fromLookup()` never throws an error. An error thrown by context provider will be added as annotation in `ContextProvider.getValue()`.
https://github.com/aws/aws-cdk/blob/bff85e88fbe0ddb10bdcde8039af1736afa77cc2/packages/aws-cdk-lib/core/lib/context-provider.ts#L127-L131

Therefore, in my understanding, annotation seems to be preferred here.
If not, I can change to throw `ValidationError` here.
created_at: 2025-03-14T04:24:45Z
author_association: CONTRIBUTOR
diff_hunk: @@ -76,21 +78,62 @@ abstract class PrefixListBase extends Resource implements IPrefixList {
   public abstract readonly prefixListId: string;
 }
 
+/**
+ * Properties for looking up an existing managed prefix list.
+ */
+export interface PrefixListLookupOptions {
+  /**
+   * The name of the prefix list to lookup.
+   */
+  readonly prefixListName: string;
+}
+
 /**
  * A managed prefix list.
  * @resource AWS::EC2::PrefixList
  */
 export class PrefixList extends PrefixListBase {
   /**
    * Look up prefix list by id.
-   *
    */
   public static fromPrefixListId(scope: Construct, id: string, prefixListId: string): IPrefixList {
     class Import extends Resource implements IPrefixList {
       public readonly prefixListId = prefixListId;
     }
     return new Import(scope, id);
   }
+
+  /**
+   * Look up prefix list by name
+   */
+  public static fromLookup(scope: Construct, id: string, options: PrefixListLookupOptions): IPrefixList {
+    if (Token.isUnresolved(options.prefixListName)) {
+      throw new ValidationError('All arguments to look up a managed prefix list must be concrete (no Tokens)', scope);
+    }
+
+    const dummyResponse = { PrefixListId: 'pl-xxxxxxxx' };
+    const response: {[key: string]: any}[] = ContextProvider.getValue(scope, {
+      provider: cxschema.ContextProvider.CC_API_PROVIDER,
+      props: {
+        typeName: 'AWS::EC2::PrefixList',
+        propertyMatch: {
+          PrefixListName: options.prefixListName,
+        },
+        propertiesToReturn: ['PrefixListId'],
+      } as Omit<cxschema.CcApiContextQuery, 'account'|'region'>,
path: packages/aws-cdk-lib/aws-ec2/lib/prefix-list.ts
user: login: Tietew
body: I noticed `satisfies` is better than `as` here but `Omit<>` is still required.
created_at: 2025-03-14T04:34:51Z
author_association: CONTRIBUTOR
diff_hunk: @@ -76,21 +78,62 @@ abstract class PrefixListBase extends Resource implements IPrefixList {
   public abstract readonly prefixListId: string;
 }
 
+/**
+ * Properties for looking up an existing managed prefix list.
+ */
+export interface PrefixListLookupOptions {
+  /**
+   * The name of the prefix list to lookup.
+   */
+  readonly prefixListName: string;
+}
+
 /**
  * A managed prefix list.
  * @resource AWS::EC2::PrefixList
  */
 export class PrefixList extends PrefixListBase {
   /**
    * Look up prefix list by id.
-   *
    */
   public static fromPrefixListId(scope: Construct, id: string, prefixListId: string): IPrefixList {
     class Import extends Resource implements IPrefixList {
       public readonly prefixListId = prefixListId;
     }
     return new Import(scope, id);
   }
+
+  /**
+   * Look up prefix list by name
+   */
+  public static fromLookup(scope: Construct, id: string, options: PrefixListLookupOptions): IPrefixList {
+    if (Token.isUnresolved(options.prefixListName)) {
+      throw new ValidationError('All arguments to look up a managed prefix list must be concrete (no Tokens)', scope);
+    }
+
+    const dummyResponse = { PrefixListId: 'pl-xxxxxxxx' };
+    const response: {[key: string]: any}[] = ContextProvider.getValue(scope, {
+      provider: cxschema.ContextProvider.CC_API_PROVIDER,
+      props: {
+        typeName: 'AWS::EC2::PrefixList',
+        propertyMatch: {
+          PrefixListName: options.prefixListName,
+        },
+        propertiesToReturn: ['PrefixListId'],
+      } as Omit<cxschema.CcApiContextQuery, 'account'|'region'>,
path: packages/aws-cdk-lib/aws-ec2/lib/prefix-list.ts
user: login: shikha372
body: Thanks @Tietew , I checked some other implementations in the repo for context provider, which are not directly referring the CcApiContextQuery, ~~way to do it is define a new contextQuery type for prefix list in https://github.com/aws/aws-cdk/tree/main/packages/aws-cdk-lib/cx-api/lib/context 
something like 
`export interface PrefixListQuery extends ContextLookupRoleOptions`~~ , can we define a new interface for response that you expect:

```
export interface PrefixListContextResponse {
  /**
   * Security group id
   *
   * @default - None
   */
  readonly prefixListId?: string;
}

    const dummyResponse = { PrefixListId: 'pl-xxxxxxxx' };
    const response: PrefixListContextResponse = ContextProvider.getValue(scope, {
      provider: cxschema.ContextProvider.CC_API_PRovider
      props: {
        typeName: 'AWS::EC2::PrefixList',
        propertyMatch: {
          PrefixListName: options.prefixListName,
        },
        propertiesToReturn: ['PrefixListId'],
      },
      dummyValue: [dummyResponse] as PrefixListContextResponse,
    }).value;

```

~~Looking further, i think the context queries are added to the cloud-assembly schema [here](https://github.com/cdklabs/cloud-assembly-schema/blob/main/lib/cloud-assembly/context-queries.ts)~~ 
I checked the last PR, seems a new provider type is added to handle the CC_API queries and we don't need to add it to schema.
created_at: 2025-03-17T23:04:52Z
author_association: CONTRIBUTOR
diff_hunk: @@ -76,21 +78,62 @@ abstract class PrefixListBase extends Resource implements IPrefixList {
   public abstract readonly prefixListId: string;
 }
 
+/**
+ * Properties for looking up an existing managed prefix list.
+ */
+export interface PrefixListLookupOptions {
+  /**
+   * The name of the prefix list to lookup.
+   */
+  readonly prefixListName: string;
+}
+
 /**
  * A managed prefix list.
  * @resource AWS::EC2::PrefixList
  */
 export class PrefixList extends PrefixListBase {
   /**
    * Look up prefix list by id.
-   *
    */
   public static fromPrefixListId(scope: Construct, id: string, prefixListId: string): IPrefixList {
     class Import extends Resource implements IPrefixList {
       public readonly prefixListId = prefixListId;
     }
     return new Import(scope, id);
   }
+
+  /**
+   * Look up prefix list by name
+   */
+  public static fromLookup(scope: Construct, id: string, options: PrefixListLookupOptions): IPrefixList {
+    if (Token.isUnresolved(options.prefixListName)) {
+      throw new ValidationError('All arguments to look up a managed prefix list must be concrete (no Tokens)', scope);
+    }
+
+    const dummyResponse = { PrefixListId: 'pl-xxxxxxxx' };
+    const response: {[key: string]: any}[] = ContextProvider.getValue(scope, {
+      provider: cxschema.ContextProvider.CC_API_PROVIDER,
+      props: {
+        typeName: 'AWS::EC2::PrefixList',
+        propertyMatch: {
+          PrefixListName: options.prefixListName,
+        },
+        propertiesToReturn: ['PrefixListId'],
+      } as Omit<cxschema.CcApiContextQuery, 'account'|'region'>,
path: packages/aws-cdk-lib/aws-ec2/lib/prefix-list.ts
user: login: Tietew
body: Added `PrefixListContextResponse`.
I don't export it since it's not useful outside of `fromlookup()` method I think.
created_at: 2025-03-18T02:20:07Z
author_association: CONTRIBUTOR
diff_hunk: @@ -76,21 +78,62 @@ abstract class PrefixListBase extends Resource implements IPrefixList {
   public abstract readonly prefixListId: string;
 }
 
+/**
+ * Properties for looking up an existing managed prefix list.
+ */
+export interface PrefixListLookupOptions {
+  /**
+   * The name of the prefix list to lookup.
+   */
+  readonly prefixListName: string;
+}
+
 /**
  * A managed prefix list.
  * @resource AWS::EC2::PrefixList
  */
 export class PrefixList extends PrefixListBase {
   /**
    * Look up prefix list by id.
-   *
    */
   public static fromPrefixListId(scope: Construct, id: string, prefixListId: string): IPrefixList {
     class Import extends Resource implements IPrefixList {
       public readonly prefixListId = prefixListId;
     }
     return new Import(scope, id);
   }
+
+  /**
+   * Look up prefix list by name
+   */
+  public static fromLookup(scope: Construct, id: string, options: PrefixListLookupOptions): IPrefixList {
+    if (Token.isUnresolved(options.prefixListName)) {
+      throw new ValidationError('All arguments to look up a managed prefix list must be concrete (no Tokens)', scope);
+    }
+
+    const dummyResponse = { PrefixListId: 'pl-xxxxxxxx' };
+    const response: {[key: string]: any}[] = ContextProvider.getValue(scope, {
+      provider: cxschema.ContextProvider.CC_API_PROVIDER,
+      props: {
+        typeName: 'AWS::EC2::PrefixList',
+        propertyMatch: {
+          PrefixListName: options.prefixListName,
+        },
+        propertiesToReturn: ['PrefixListId'],
+      } as Omit<cxschema.CcApiContextQuery, 'account'|'region'>,
+      dummyValue: [dummyResponse],
+    }).value;
+
+    // getValue returns a list of result objects. We are expecting 1 result or Error.
+    let prefixList = response[0];
+    if (!prefixList?.PrefixListId) {
+      Annotations.of(scope).addError(`Could not find the managed prefix list '${options.prefixListName}'`);
+      prefixList = dummyResponse;
path: packages/aws-cdk-lib/aws-ec2/lib/prefix-list.ts
user: login: shikha372
body: That's what I try to understand, why we want to add an error here, can we remove this?
created_at: 2025-03-18T22:17:11Z
author_association: CONTRIBUTOR
diff_hunk: @@ -76,21 +78,62 @@ abstract class PrefixListBase extends Resource implements IPrefixList {
   public abstract readonly prefixListId: string;
 }
 
+/**
+ * Properties for looking up an existing managed prefix list.
+ */
+export interface PrefixListLookupOptions {
+  /**
+   * The name of the prefix list to lookup.
+   */
+  readonly prefixListName: string;
+}
+
 /**
  * A managed prefix list.
  * @resource AWS::EC2::PrefixList
  */
 export class PrefixList extends PrefixListBase {
   /**
    * Look up prefix list by id.
-   *
    */
   public static fromPrefixListId(scope: Construct, id: string, prefixListId: string): IPrefixList {
     class Import extends Resource implements IPrefixList {
       public readonly prefixListId = prefixListId;
     }
     return new Import(scope, id);
   }
+
+  /**
+   * Look up prefix list by name
+   */
+  public static fromLookup(scope: Construct, id: string, options: PrefixListLookupOptions): IPrefixList {
+    if (Token.isUnresolved(options.prefixListName)) {
+      throw new ValidationError('All arguments to look up a managed prefix list must be concrete (no Tokens)', scope);
+    }
+
+    const dummyResponse = { PrefixListId: 'pl-xxxxxxxx' };
+    const response: {[key: string]: any}[] = ContextProvider.getValue(scope, {
+      provider: cxschema.ContextProvider.CC_API_PROVIDER,
+      props: {
+        typeName: 'AWS::EC2::PrefixList',
+        propertyMatch: {
+          PrefixListName: options.prefixListName,
+        },
+        propertiesToReturn: ['PrefixListId'],
+      } as Omit<cxschema.CcApiContextQuery, 'account'|'region'>,
path: packages/aws-cdk-lib/aws-ec2/lib/prefix-list.ts
user: login: shikha372
body: Thank you for addressing the comment for `PrefixListContextResponse`, still little worried about Omitting the region and account, i think with ContextProvider.getKey() it will always be from the stack env variables, do you think there can be cases where this needs to be overriden, if yes then we can include it as part of props.
created_at: 2025-03-18T22:20:29Z
author_association: CONTRIBUTOR
diff_hunk: @@ -76,21 +78,62 @@ abstract class PrefixListBase extends Resource implements IPrefixList {
   public abstract readonly prefixListId: string;
 }
 
+/**
+ * Properties for looking up an existing managed prefix list.
+ */
+export interface PrefixListLookupOptions {
+  /**
+   * The name of the prefix list to lookup.
+   */
+  readonly prefixListName: string;
+}
+
 /**
  * A managed prefix list.
  * @resource AWS::EC2::PrefixList
  */
 export class PrefixList extends PrefixListBase {
   /**
    * Look up prefix list by id.
-   *
    */
   public static fromPrefixListId(scope: Construct, id: string, prefixListId: string): IPrefixList {
     class Import extends Resource implements IPrefixList {
       public readonly prefixListId = prefixListId;
     }
     return new Import(scope, id);
   }
+
+  /**
+   * Look up prefix list by name
+   */
+  public static fromLookup(scope: Construct, id: string, options: PrefixListLookupOptions): IPrefixList {
+    if (Token.isUnresolved(options.prefixListName)) {
+      throw new ValidationError('All arguments to look up a managed prefix list must be concrete (no Tokens)', scope);
+    }
+
+    const dummyResponse = { PrefixListId: 'pl-xxxxxxxx' };
+    const response: {[key: string]: any}[] = ContextProvider.getValue(scope, {
+      provider: cxschema.ContextProvider.CC_API_PROVIDER,
+      props: {
+        typeName: 'AWS::EC2::PrefixList',
+        propertyMatch: {
+          PrefixListName: options.prefixListName,
+        },
+        propertiesToReturn: ['PrefixListId'],
+      } as Omit<cxschema.CcApiContextQuery, 'account'|'region'>,
+      dummyValue: [dummyResponse],
+    }).value;
+
+    // getValue returns a list of result objects. We are expecting 1 result or Error.
+    let prefixList = response[0];
+    if (!prefixList?.PrefixListId) {
+      Annotations.of(scope).addError(`Could not find the managed prefix list '${options.prefixListName}'`);
+      prefixList = dummyResponse;
path: packages/aws-cdk-lib/aws-ec2/lib/prefix-list.ts
user: login: Tietew
body: If the managed prefix list with specified name does not exist, CC API context provider returns an empty array `[]`. We should detect it as an error.
Another solution: update the provider (in aws-cdk-lib) to return the dummy value with providerError if the result is empty.
created_at: 2025-03-19T03:43:46Z
author_association: CONTRIBUTOR
diff_hunk: @@ -76,21 +78,62 @@ abstract class PrefixListBase extends Resource implements IPrefixList {
   public abstract readonly prefixListId: string;
 }
 
+/**
+ * Properties for looking up an existing managed prefix list.
+ */
+export interface PrefixListLookupOptions {
+  /**
+   * The name of the prefix list to lookup.
+   */
+  readonly prefixListName: string;
+}
+
 /**
  * A managed prefix list.
  * @resource AWS::EC2::PrefixList
  */
 export class PrefixList extends PrefixListBase {
   /**
    * Look up prefix list by id.
-   *
    */
   public static fromPrefixListId(scope: Construct, id: string, prefixListId: string): IPrefixList {
     class Import extends Resource implements IPrefixList {
       public readonly prefixListId = prefixListId;
     }
     return new Import(scope, id);
   }
+
+  /**
+   * Look up prefix list by name
+   */
+  public static fromLookup(scope: Construct, id: string, options: PrefixListLookupOptions): IPrefixList {
+    if (Token.isUnresolved(options.prefixListName)) {
+      throw new ValidationError('All arguments to look up a managed prefix list must be concrete (no Tokens)', scope);
+    }
+
+    const dummyResponse = { PrefixListId: 'pl-xxxxxxxx' };
+    const response: {[key: string]: any}[] = ContextProvider.getValue(scope, {
+      provider: cxschema.ContextProvider.CC_API_PROVIDER,
+      props: {
+        typeName: 'AWS::EC2::PrefixList',
+        propertyMatch: {
+          PrefixListName: options.prefixListName,
+        },
+        propertiesToReturn: ['PrefixListId'],
+      } as Omit<cxschema.CcApiContextQuery, 'account'|'region'>,
path: packages/aws-cdk-lib/aws-ec2/lib/prefix-list.ts
user: login: Tietew
body: Ah, PrefixList can be shared between accounts.
https://docs.aws.amazon.com/vpc/latest/userguide/sharing-managed-prefix-lists.html

I'll investigate how RAM works on PrefixList.
created_at: 2025-03-19T04:00:48Z
author_association: CONTRIBUTOR
diff_hunk: @@ -76,21 +78,62 @@ abstract class PrefixListBase extends Resource implements IPrefixList {
   public abstract readonly prefixListId: string;
 }
 
+/**
+ * Properties for looking up an existing managed prefix list.
+ */
+export interface PrefixListLookupOptions {
+  /**
+   * The name of the prefix list to lookup.
+   */
+  readonly prefixListName: string;
+}
+
 /**
  * A managed prefix list.
  * @resource AWS::EC2::PrefixList
  */
 export class PrefixList extends PrefixListBase {
   /**
    * Look up prefix list by id.
-   *
    */
   public static fromPrefixListId(scope: Construct, id: string, prefixListId: string): IPrefixList {
     class Import extends Resource implements IPrefixList {
       public readonly prefixListId = prefixListId;
     }
     return new Import(scope, id);
   }
+
+  /**
+   * Look up prefix list by name
+   */
+  public static fromLookup(scope: Construct, id: string, options: PrefixListLookupOptions): IPrefixList {
+    if (Token.isUnresolved(options.prefixListName)) {
+      throw new ValidationError('All arguments to look up a managed prefix list must be concrete (no Tokens)', scope);
+    }
+
+    const dummyResponse = { PrefixListId: 'pl-xxxxxxxx' };
+    const response: {[key: string]: any}[] = ContextProvider.getValue(scope, {
+      provider: cxschema.ContextProvider.CC_API_PROVIDER,
+      props: {
+        typeName: 'AWS::EC2::PrefixList',
+        propertyMatch: {
+          PrefixListName: options.prefixListName,
+        },
+        propertiesToReturn: ['PrefixListId'],
+      } as Omit<cxschema.CcApiContextQuery, 'account'|'region'>,
path: packages/aws-cdk-lib/aws-ec2/lib/prefix-list.ts
user: login: Tietew
body: After enabling resource sharing on a customer-managed prefix list, it is visible in shared account. CC API can query it.
``` console
$ aws --profile primary-account cloudcontrol list-resources --type-name 'AWS::EC2::PrefixList' | jq '.ResourceDescriptions[]|select(.Properties|contains("share-test"))'
{
  "Identifier": "pl-xxxxxxxxxxxxxxxxx",
  "Properties": "{\"MaxEntries\":5,\"OwnerId\":\"aaaaaaaaaaaa\",\"PrefixListId\":\"pl-xxxxxxxxxxxxxxxxx\",\"Version\":1,\"PrefixListName\":\"share-test\",...}"
}
$ aws --profile shared-account cloudcontrol list-resources --type-name 'AWS::EC2::PrefixList' | jq '.ResourceDescriptions[]|select(.Properties|contains("share-test"))'
{
  "Identifier": "pl-xxxxxxxxxxxxxxxxx",
  "Properties": "{\"MaxEntries\":5,\"OwnerId\":\"aaaaaaaaaaaa\",\"PrefixListId\":\"pl-xxxxxxxxxxxxxxxxx\",\"Version\":1,\"PrefixListName\":\"share-test\",...}"
}
```

According to this result, it is not needed to specify account to look up a shared prefix list, but OwnerId! (prefix list name is not a unique identifier...)

Therefore,
- `region` is not useful because PrefixList cannot be shared between regions.
- `account` can be used as `OwnerId` filter but confusable with account to query.
- `ownerId` should be added as `OwnerId` filter (optional). The OwnerId of AWS-managed prefix list is "AWS".
- `addressFamily` should be added as `AddessFamily` filter (optional).
- We should also check the result has exact one element.

We can add account and/or region later if there is a use-case.

Thank you so much!
created_at: 2025-03-19T04:44:08Z
author_association: CONTRIBUTOR
diff_hunk: @@ -76,21 +78,62 @@ abstract class PrefixListBase extends Resource implements IPrefixList {
   public abstract readonly prefixListId: string;
 }
 
+/**
+ * Properties for looking up an existing managed prefix list.
+ */
+export interface PrefixListLookupOptions {
+  /**
+   * The name of the prefix list to lookup.
+   */
+  readonly prefixListName: string;
+}
+
 /**
  * A managed prefix list.
  * @resource AWS::EC2::PrefixList
  */
 export class PrefixList extends PrefixListBase {
   /**
    * Look up prefix list by id.
-   *
    */
   public static fromPrefixListId(scope: Construct, id: string, prefixListId: string): IPrefixList {
     class Import extends Resource implements IPrefixList {
       public readonly prefixListId = prefixListId;
     }
     return new Import(scope, id);
   }
+
+  /**
+   * Look up prefix list by name
+   */
+  public static fromLookup(scope: Construct, id: string, options: PrefixListLookupOptions): IPrefixList {
+    if (Token.isUnresolved(options.prefixListName)) {
+      throw new ValidationError('All arguments to look up a managed prefix list must be concrete (no Tokens)', scope);
+    }
+
+    const dummyResponse = { PrefixListId: 'pl-xxxxxxxx' };
+    const response: {[key: string]: any}[] = ContextProvider.getValue(scope, {
+      provider: cxschema.ContextProvider.CC_API_PROVIDER,
+      props: {
+        typeName: 'AWS::EC2::PrefixList',
+        propertyMatch: {
+          PrefixListName: options.prefixListName,
+        },
+        propertiesToReturn: ['PrefixListId'],
+      } as Omit<cxschema.CcApiContextQuery, 'account'|'region'>,
+      dummyValue: [dummyResponse],
+    }).value;
+
+    // getValue returns a list of result objects. We are expecting 1 result or Error.
+    let prefixList = response[0];
+    if (!prefixList?.PrefixListId) {
+      Annotations.of(scope).addError(`Could not find the managed prefix list '${options.prefixListName}'`);
+      prefixList = dummyResponse;
path: packages/aws-cdk-lib/aws-ec2/lib/prefix-list.ts
user: login: Tietew
body: Submitted issue aws/aws-cdk-cli#257 and PR aws/aws-cdk-cli#251
created_at: 2025-03-19T05:45:32Z
author_association: CONTRIBUTOR
diff_hunk: @@ -76,21 +78,62 @@ abstract class PrefixListBase extends Resource implements IPrefixList {
   public abstract readonly prefixListId: string;
 }
 
+/**
+ * Properties for looking up an existing managed prefix list.
+ */
+export interface PrefixListLookupOptions {
+  /**
+   * The name of the prefix list to lookup.
+   */
+  readonly prefixListName: string;
+}
+
 /**
  * A managed prefix list.
  * @resource AWS::EC2::PrefixList
  */
 export class PrefixList extends PrefixListBase {
   /**
    * Look up prefix list by id.
-   *
    */
   public static fromPrefixListId(scope: Construct, id: string, prefixListId: string): IPrefixList {
     class Import extends Resource implements IPrefixList {
       public readonly prefixListId = prefixListId;
     }
     return new Import(scope, id);
   }
+
+  /**
+   * Look up prefix list by name
+   */
+  public static fromLookup(scope: Construct, id: string, options: PrefixListLookupOptions): IPrefixList {
+    if (Token.isUnresolved(options.prefixListName)) {
+      throw new ValidationError('All arguments to look up a managed prefix list must be concrete (no Tokens)', scope);
+    }
+
+    const dummyResponse = { PrefixListId: 'pl-xxxxxxxx' };
+    const response: {[key: string]: any}[] = ContextProvider.getValue(scope, {
+      provider: cxschema.ContextProvider.CC_API_PROVIDER,
+      props: {
+        typeName: 'AWS::EC2::PrefixList',
+        propertyMatch: {
+          PrefixListName: options.prefixListName,
+        },
+        propertiesToReturn: ['PrefixListId'],
+      } as Omit<cxschema.CcApiContextQuery, 'account'|'region'>,
path: packages/aws-cdk-lib/aws-ec2/lib/prefix-list.ts
user: login: Tietew
body: Only `Vpc.fromLookup()` supports overriding region.
Other lookups don't - SecurityGroup, LoadBalancers, KMS Key, and route53 HostedZone.
created_at: 2025-03-19T08:10:03Z
author_association: CONTRIBUTOR
diff_hunk: @@ -76,21 +78,62 @@ abstract class PrefixListBase extends Resource implements IPrefixList {
   public abstract readonly prefixListId: string;
 }
 
+/**
+ * Properties for looking up an existing managed prefix list.
+ */
+export interface PrefixListLookupOptions {
+  /**
+   * The name of the prefix list to lookup.
+   */
+  readonly prefixListName: string;
+}
+
 /**
  * A managed prefix list.
  * @resource AWS::EC2::PrefixList
  */
 export class PrefixList extends PrefixListBase {
   /**
    * Look up prefix list by id.
-   *
    */
   public static fromPrefixListId(scope: Construct, id: string, prefixListId: string): IPrefixList {
     class Import extends Resource implements IPrefixList {
       public readonly prefixListId = prefixListId;
     }
     return new Import(scope, id);
   }
+
+  /**
+   * Look up prefix list by name
+   */
+  public static fromLookup(scope: Construct, id: string, options: PrefixListLookupOptions): IPrefixList {
+    if (Token.isUnresolved(options.prefixListName)) {
+      throw new ValidationError('All arguments to look up a managed prefix list must be concrete (no Tokens)', scope);
+    }
+
+    const dummyResponse = { PrefixListId: 'pl-xxxxxxxx' };
+    const response: {[key: string]: any}[] = ContextProvider.getValue(scope, {
+      provider: cxschema.ContextProvider.CC_API_PROVIDER,
+      props: {
+        typeName: 'AWS::EC2::PrefixList',
+        propertyMatch: {
+          PrefixListName: options.prefixListName,
+        },
+        propertiesToReturn: ['PrefixListId'],
+      } as Omit<cxschema.CcApiContextQuery, 'account'|'region'>,
+      dummyValue: [dummyResponse],
+    }).value;
+
+    // getValue returns a list of result objects. We are expecting 1 result or Error.
+    let prefixList = response[0];
+    if (!prefixList?.PrefixListId) {
+      Annotations.of(scope).addError(`Could not find the managed prefix list '${options.prefixListName}'`);
+      prefixList = dummyResponse;
path: packages/aws-cdk-lib/aws-ec2/lib/prefix-list.ts
user: login: Tietew
body: Updated to throw ValidationError instead of adding an error annotation.
After the above PR is merged, we can assume exact one result.
created_at: 2025-03-19T13:53:59Z
author_association: CONTRIBUTOR
diff_hunk: @@ -76,21 +78,62 @@ abstract class PrefixListBase extends Resource implements IPrefixList {
   public abstract readonly prefixListId: string;
 }
 
+/**
+ * Properties for looking up an existing managed prefix list.
+ */
+export interface PrefixListLookupOptions {
+  /**
+   * The name of the prefix list to lookup.
+   */
+  readonly prefixListName: string;
+}
+
 /**
  * A managed prefix list.
  * @resource AWS::EC2::PrefixList
  */
 export class PrefixList extends PrefixListBase {
   /**
    * Look up prefix list by id.
-   *
    */
   public static fromPrefixListId(scope: Construct, id: string, prefixListId: string): IPrefixList {
     class Import extends Resource implements IPrefixList {
       public readonly prefixListId = prefixListId;
     }
     return new Import(scope, id);
   }
+
+  /**
+   * Look up prefix list by name
+   */
+  public static fromLookup(scope: Construct, id: string, options: PrefixListLookupOptions): IPrefixList {
+    if (Token.isUnresolved(options.prefixListName)) {
+      throw new ValidationError('All arguments to look up a managed prefix list must be concrete (no Tokens)', scope);
+    }
+
+    const dummyResponse = { PrefixListId: 'pl-xxxxxxxx' };
+    const response: {[key: string]: any}[] = ContextProvider.getValue(scope, {
+      provider: cxschema.ContextProvider.CC_API_PROVIDER,
+      props: {
+        typeName: 'AWS::EC2::PrefixList',
+        propertyMatch: {
+          PrefixListName: options.prefixListName,
+        },
+        propertiesToReturn: ['PrefixListId'],
+      } as Omit<cxschema.CcApiContextQuery, 'account'|'region'>,
path: packages/aws-cdk-lib/aws-ec2/lib/prefix-list.ts
user: login: Tietew
body: Added `ownerId` and `addressFamily` as search criteria.
created_at: 2025-03-19T13:54:42Z
author_association: CONTRIBUTOR

PR comments:
user: login: Tietew
created_at: 2025-02-28T06:45:22Z
body: Verified CloudControl context provider works:

``` ts
import * as cxschema from '@aws-cdk/cloud-assembly-schema';
import { Toolkit } from '@aws-cdk/toolkit-lib';
import * as cdk from 'aws-cdk-lib';

(async () => {
  const toolkit = new Toolkit({ sdkConfig: { profile: 'sandbox' } });
  const cx = await toolkit.fromAssemblyBuilder(async () => {
    const app = new cdk.App();
    const stack = new cdk.Stack(app, 'Stack', { env: { region: 'us-east-1', account: 'ACCOUNT-ID' } });

    const responses = cdk.ContextProvider.getValue(stack, {
      provider: cxschema.ContextProvider.CC_API_PROVIDER,
      props: {
        typeName: 'AWS::EC2::PrefixList',
        propertyMatch: {
          PrefixListName: 'com.amazonaws.global.cloudfront.origin-facing',
        },
        propertiesToReturn: ['PrefixListId'],
      },
      dummyValue: [{ PrefixListId: 'pl-xxxxxxxx' }],
    }).value;

    new cdk.CfnOutput(stack, 'PrefixListId', {
      value: responses[0].PrefixListId,
    });

    return app.synth();
  });

  const cxSnap = await toolkit.synth(cx);
  const assembly = await cxSnap.produce();
  const template = assembly.getStackByName('Stack').template;

  const { Outputs } = template;
  console.log(JSON.stringify({ Outputs }, undefined, 2));
})().catch(console.error);
```

``` console
$ yarn ts-node --prefer-ts-exts cc-api-test.ts
✨  Synthesis time: 3.87s
Successfully synthesized to /tmp/cdk.out8jL5HY
{
  "Outputs": {
    "PrefixListId": {
      "Value": "pl-3b927c52"
    }
  }
}
$ aws --profile sandbox --region us-east-1 ec2 describe-managed-prefix-lists --prefix-list-ids pl-3b927c52
{
    "PrefixLists": [
        {
            "PrefixListId": "pl-3b927c52",
            "AddressFamily": "IPv4",
            "State": "create-complete",
            "PrefixListArn": "arn:aws:ec2:us-east-1:aws:prefix-list/pl-3b927c52",
            "PrefixListName": "com.amazonaws.global.cloudfront.origin-facing",
            "Tags": [],
            "OwnerId": "AWS"
        }
    ]
}
```
author_association: CONTRIBUTOR
user: login: codecov[bot]
created_at: 2025-02-28T11:32:02Z
body: ## [Codecov](https://app.codecov.io/gh/aws/aws-cdk/pull/33619?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aws) Report
All modified and coverable lines are covered by tests :white_check_mark:
> Project coverage is 82.38%. Comparing base [(`a9bae27`)](https://app.codecov.io/gh/aws/aws-cdk/commit/a9bae276f595d3b3d18c8a56d40549ab1044cbb7?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aws) to head [(`d59c985`)](https://app.codecov.io/gh/aws/aws-cdk/commit/d59c985c84173d97d0ba12a79f695c651fb23244?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aws).

<details><summary>Additional details and impacted files</summary>


```diff
@@           Coverage Diff           @@
##             main   #33619   +/-   ##
=======================================
  Coverage   82.38%   82.38%           
=======================================
  Files         120      120           
  Lines        6938     6938           
  Branches     1170     1170           
=======================================
  Hits         5716     5716           
  Misses       1119     1119           
  Partials      103      103           
```

| [Flag](https://app.codecov.io/gh/aws/aws-cdk/pull/33619/flags?src=pr&el=flags&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aws) | Coverage Δ | |
|---|---|---|
| [suite.unit](https://app.codecov.io/gh/aws/aws-cdk/pull/33619/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aws) | `82.38% <ø> (ø)` | |

Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aws#carryforward-flags-in-the-pull-request-comment) to find out more.

| [Components](https://app.codecov.io/gh/aws/aws-cdk/pull/33619/components?src=pr&el=components&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aws) | Coverage Δ | |
|---|---|---|
| [packages/aws-cdk](https://app.codecov.io/gh/aws/aws-cdk/pull/33619/components?src=pr&el=component&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aws) | `∅ <ø> (∅)` | |
| [packages/aws-cdk-lib/core](https://app.codecov.io/gh/aws/aws-cdk/pull/33619/components?src=pr&el=component&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=aws) | `82.38% <ø> (ø)` | |

</details>
<details><summary> :rocket: New features to boost your workflow: </summary>

- :snowflake: [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.
- :package: [JS Bundle Analysis](https://docs.codecov.com/docs/javascript-bundle-analysis): Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
</details>
author_association: NONE
user: login: shikha372
created_at: 2025-03-13T17:08:56Z
body: Thank you @Tietew for your contribution, changes look good to me, i just have few last questions before approving this PR. 
author_association: CONTRIBUTOR
user: login: Tietew
created_at: 2025-03-14T04:40:39Z
body: @shikha372 Thank you for review. I answered them.
author_association: CONTRIBUTOR
user: login: mergify[bot]
created_at: 2025-03-20T22:18:41Z
body: Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to [allow changes to be pushed to your fork](https://help.github.com/en/github/collaborating-with-issues-and-pull-requests/allowing-changes-to-a-pull-request-branch-created-from-a-fork)).
author_association: CONTRIBUTOR
user: login: mergify[bot]
created_at: 2025-03-20T22:18:47Z
body: This pull request has been removed from the queue for the following reason: <code>pull request branch update failed</code>.

The pull request can't be updated

You should update or rebase your pull request manually.

If you want to requeue this pull request, you can post a `@mergifyio requeue` comment.

author_association: CONTRIBUTOR
user: login: mergify[bot]
created_at: 2025-03-20T22:22:12Z
body: Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to [allow changes to be pushed to your fork](https://help.github.com/en/github/collaborating-with-issues-and-pull-requests/allowing-changes-to-a-pull-request-branch-created-from-a-fork)).
author_association: CONTRIBUTOR
user: login: mergify[bot]
created_at: 2025-03-24T18:27:49Z
body: Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to [allow changes to be pushed to your fork](https://help.github.com/en/github/collaborating-with-issues-and-pull-requests/allowing-changes-to-a-pull-request-branch-created-from-a-fork)).
author_association: CONTRIBUTOR
user: login: aws-cdk-automation
created_at: 2025-03-24T18:58:18Z
body: 
### AWS CodeBuild CI Report

* CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
* Commit ID: d59c985c84173d97d0ba12a79f695c651fb23244
* Result: SUCCEEDED
* [Build Logs](https://2cl995f30a.execute-api.us-east-1.amazonaws.com/Prod/buildlogs?key=8d0ca05c-c7f2-4a6c-9226-1f111125aae4%2Fbuild.log) (available for 30 days)

*Powered by [github-codebuild-logs](https://serverlessrepo.aws.amazon.com/applications/arn:aws:serverlessrepo:us-east-1:277187709615:applications~github-codebuild-logs), available on the [AWS Serverless Application Repository](https://aws.amazon.com/serverless/serverlessrepo/)*


<!--
CREATED BY GITHUB-CODEBUILD-LOGS
-->


author_association: COLLABORATOR
user: login: mergify[bot]
created_at: 2025-03-24T18:58:36Z
body: Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to [allow changes to be pushed to your fork](https://help.github.com/en/github/collaborating-with-issues-and-pull-requests/allowing-changes-to-a-pull-request-branch-created-from-a-fork)).
author_association: CONTRIBUTOR
user: login: github-actions[bot]
created_at: 2025-03-24T18:58:45Z
body: Comments on closed issues and PRs are hard for our team to see. 
If you need help, please open a new issue that references this one.
author_association: CONTRIBUTOR