A developer wants to use a broad public prefix in a security group because the corporate outbound IPs change. What is the best governed alternative?

1. Allow all public addresses and rely on the rule description to identify corporate users.
2. Maintain an approved customer-managed prefix list and reference it in supported security group rules.
3. Turn off the security group whenever corporate addresses change.
4. Use a Route 53 TXT record as the security group source.