Top / Amazon Web Service / AWS WAF V2 / IP Set

AWS WAF V2 IP Set

This page shows how to write Terraform and CloudFormation for AWS WAF V2 IP Set and write them securely.

terraform-logo

Review your .tf file for AWS best practices

Shisho Cloud, our free checker to make sure your Terraform configuration follows best practices, is available (beta).

aws_wafv2_ip_set (Terraform)

The IP Set in AWS WAF V2 can be configured in Terraform with the resource name aws_wafv2_ip_set. The following sections describe 4 examples of how to use the resource and its parameters.

Example Usage from GitHub

ipset.tf#L1
resource "aws_wafv2_ip_set" "IPv4RegionCloudflareIPSet" {
  name  = "IPv4RegionalCloudflareIPSet"
  scope = "REGIONAL"
  ip_address_version = "IPV4"
  addresses = var.ipv4address
}
ip_firewall.tf#L1
resource "aws_wafv2_ip_set" "nul_ip_set" {
  count              = local.secrets.firewall_type == "IP" ? 1 : 0
  name               = "nul-ips"
  description        = "NU Library IP Addresses"
  scope              = "REGIONAL"
  ip_address_version = "IPV4"
main.tf#L8
resource "aws_wafv2_ip_set" "block_ip_set" {
  name = "generated-ips"

  scope              = "REGIONAL"
  ip_address_version = "IPV4"
main.tf#L8
resource "aws_wafv2_ip_set" "block_ip_set" {
  name = "generated-ips"

  scope              = "REGIONAL"
  ip_address_version = "IPV4"

Review your Terraform file for AWS best practices

Shisho Cloud, our free checker to make sure your Terraform configuration follows best practices, is available (beta).

Parameters

>> from Terraform Registry

Explanation in Terraform Registry

Provides a WAFv2 IP Set Resource

>> from Terraform Registry

AWS::WAFv2::IPSet (CloudFormation)

The IPSet in WAFv2 can be configured in CloudFormation with the resource name AWS::WAFv2::IPSet. The following sections describe 10 examples of how to use the resource and its parameters.

Example Usage from GitHub

S3_CloudFront_WAF_v2__with-ip-set.yml#L54
    Type: "AWS::WAFv2::IPSet"
    Properties:
      Addresses:
        - 192.0.2.44/32
      IPAddressVersion: IPV4
      Name: "MyWAFv2IPSet"
template.yml#L33
    Type: AWS::WAFv2::IPSet
    Properties:
      Addresses:
        - 192.0.2.0/24
      Description: IPv4 set automatically updated with AWS IP ranges
      IPAddressVersion: IPV4
waf.yml#L3
    Type: AWS::WAFv2::IPSet
    Properties:
      Addresses:
        - ${self:provider.environment.ALLOWEDIP}
      Description: IP set for SlsTestWebApp Access.
      IPAddressVersion: IPV4
waf.yml#L25
    Type: AWS::WAFv2::IPSet
    Condition: IsTest
    Properties:
      Description: IP Set for Infinity Works office
      Name: IwIpSet
      Scope: CLOUDFRONT
waf.yml#L167
#    Type: "AWS::WAFv2::IPSet"
#    Properties:
#      Name: Custom-ipaddress-whitelist
#      Scope: REGIONAL
#      IPAddressVersion: IPV4
#      Addresses:
template.json#L599
    "AWS::WAFv2::IPSet": {
      "Type": "AWS::WAFv2::IPSet",
      "Properties": {}
    },
    "AWS::Budgets::Budget": {
      "Type": "AWS::Budgets::Budget",
WAFv2IPSetSpecification.json#L22
    "AWS::WAFv2::IPSet": {
      "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-wafv2-ipset.html",
      "Properties": {
        "Description": {
          "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-wafv2-ipset.html#cfn-wafv2-ipset-description",
          "UpdateType": "Mutable",
awsResouceIconMatches.json#L1925
        "resourceType": "AWS::WAFv2::IPSet",
        "filePath": null
      },
      {
        "resourceType": "AWS::WAFv2::WebACLAssociation",
        "filePath": null
WAF-enterprise-only.json#L139
      "Type": "AWS::WAFv2::IPSet",
      "Properties": {
        "Addresses": {
          "Ref": "InternalCIDR"
        },
        "IPAddressVersion": "IPV4",
project-with-waf.json#L109
            "Type": "AWS::WAFv2::IPSet"
        }
    }
}

Parameters

>> from AWS CloudFormation Documentation

Explanation in CloudFormation Registry

Note This is the latest version of AWS WAF, named AWS WAFV2, released in November, 2019. For information, including how to migrate your AWS WAF resources from the prior release, see the AWS WAF Developer Guide. Use an AWS::WAFv2::IPSet to identify web requests that originate from specific IP addresses or ranges of IP addresses. For example, if you're receiving a lot of requests from a ranges of IP addresses, you can configure AWS WAF to block them using an IP set that lists those IP addresses. You use an IP set by providing its Amazon Resource Name (ARN) to the rule statement IPSetReferenceStatement, when you add a rule to a rule group or web ACL.

>> from AWS CloudFormation Documentation

The Other Related AWS WAF V2 Resources

Frequently asked questions

What is AWS WAF V2 IP Set?

AWS WAF V2 IP Set is a resource for WAF V2 of Amazon Web Service. Settings can be wrote in Terraform and CloudFormation.

Where can I find the example code for the AWS WAF V2 IP Set?

For Terraform, the fedesan/terraform-aws-wafv2-cloudflare, nulib/infrastructure and barracuda-ess/terraform-aws-waf-webaclv2 source code examples are useful. See the Terraform Example section for further details.

For CloudFormation, the michimani/cfn-template-samples, aws-samples/aws-waf-ipset-auto-update-aws-ip-ranges and nekoze-climber/slsTestWebApp source code examples are useful. See the CloudFormation Example section for further details.

security-icon

Automate config file reviews on your commits

Fix issues in your infrastructure as code with auto-generated patches.

Table of Contents