nginx-cloudfront-ip.sls

nginx:
    pkg:
        - installed
    service.running:
        - watch:
            - file: /etc/nginx/nginx.conf
            - cmd: /etc/nginx/cloudfront.conf 

/etc/aws/ip-ranges.json:
    file.managed:
        - source: https://ip-ranges.amazonaws.com/ip-ranges.json
        - source_hash: sha256
/etc/nginx/cloudfront.conf:
    cmd.run:
        - name: jq -r '"set_real_ip_from " + (.prefixes[] | select(.service=="CLOUDFRONT") | .ip_prefix) + ";"' /etc/aws/ip-ranges.json > /etc/nginx/cloudfront.conf
        - onchanges:
            - file: /etc/aws/ip-ranges.json
            

this will work perfect if you can actually provide the source_hash (and you're OK with the state failing when it updates)