How to update security group rules and WAF rules with dynamic ip address

You could create a Lambda function to update the security group(s) for you - but how will you know when the IP address changes?

Putting my "how would I hack this together" hat on:

If there is a DNS record which you could look up and it provides the IP address: Trigger the Lambda function every 'x' minutes using an EventBridge rule; if the IP address is different to the one in the security group then update it. Not the most efficient way but it would work.

If you have some compute device on premises I would have it check to see that the external/public IP address is - it is has changed then that device could (with the right permissions) update the security group directly; or it could trigger the Lambda function via API Gateway or a Lambda function URL.

So it comes down to: How do you know when the IP address changes?