These kinds of things are still important these days. In my previous employment we had to create security guardrails for content distribution resources in AWS (API gateways, s3 buckets, instances and cloudfront distros) for a standalone CDN. For cloudfront you'd be right to question why put a CDN behind a CDN and the answer is technical debt, so we had to deal with it.

The problem is that cloudfront functions are very limited in code size and execution cycles, and the list of cidr blocks from the external CDN was so long it meant we couldn't do a simple comparison, so we did something similar, representing all cidr blocks and the incoming source IP to a binary representation and used binary search to see if the source IP matched any cidr block range. It's also very hard to estimate correctly if the resulting function would in fact fit the compute budget, because AWS isn't very clear about what a cf function cycle is in practice, so we tested it extensively, with real and synthetic cases to simulate worse conditions.