AWS WAF

Keep a WAF IP set in sync and block it on CloudFront, ALB or API Gateway.

AWS WAF can block an IP set in front of CloudFront, an Application Load Balancer, API Gateway or AppSync. Keep an IP set in sync with the blocklist from a cron job or a scheduled Lambda, and block it in your web ACL.

Set it up

1. Create the IP set once. Use --scope CLOUDFRONT --region us-east-1 for CloudFront, or --scope REGIONAL in the load balancer's region:

   aws wafv2 create-ip-set --name isipsafe --scope REGIONAL --ip-address-version IPV4 --addresses 192.0.2.1/32

   Note the Id it returns.
2. Add a rule to your web ACL (console: Add rules › Add my own rules › IP set), match the source IP against isipsafe, action Block, priority above your other rules. Behind CloudFront in front of an ALB, add the rule to the CloudFront web ACL, where the real client address is known.
3. Refresh it hourly with this script (needs the AWS CLI and wafv2:GetIPSet and wafv2:UpdateIPSet):

   #!/bin/sh
   set -e
   NAME=isipsafe; SCOPE=REGIONAL; ID=your-ip-set-id
   ADDRS=$(curl -sf "https://isipsafe.com/api/v1/blocklist?key=$ISIPSAFE_KEY&format=txt&ipVersion=4&confidenceMinimum=90&limit=10000" | sed 's#$#/32#')
   LOCK=$(aws wafv2 get-ip-set --name $NAME --scope $SCOPE --id $ID --query LockToken --output text)
   aws wafv2 update-ip-set --name $NAME --scope $SCOPE --id $ID --lock-token "$LOCK" --addresses $ADDRS

An IP set holds up to 10,000 addresses, hence limit=10000: the highest-confidence addresses come first. For IPv6, create a second set with --ip-address-version IPV6, fetch with ipVersion=6 and append /128.

Need a hand?

If something here does not work with your version of AWS WAF, or you have improved it, tell us. We update these pages with what people send.

AWS WAF and its logo are trademarks of their respective owners. isipsafe is not affiliated with or endorsed by them.