title: AWS Lambda function to create / delete entries into WAF
body: <p>I am trying to write a basic logic for creating WAF entries (that would block a ip address or set of ip addresses to enter) and later delete them.</p>
  
  <p>i am currently doing this </p>
  
  <pre><code>const aws = require('aws-sdk');
  
  const s3 = new aws.S3({ apiVersion: '2006-03-01' });
  const waf = new aws.WAF({ apiVersion: '2015-08-24' });
  
  class Police {
    constructor(maxHit=100, timeGap=(6*60*60*1000)) {
      this.maxHit = maxHit;
      this.timeGap = timeGap;
      this.lastBailCheck = Date.now();
      this.hitMap = {};
    }
    static bail(ip){
      // TODO bail this ip by removing entry into waf
    }
    static jail(ip){
      // TODO jail this ip by adding entry from waf
    }
    checkBail(){
      var nowDate = Date.now();
      if((nowDate - this.lastBailCheck) &gt; this.timeGap){
        this.lastBailCheck = nowDate;
        this.prevMap = this.hitMap;
        this.hitMap = {};
        this.scanAndBail();
      }
    }
    scanAndBail(){
      Object.keys(this.prevMap).forEach(Police.bail);
      delete this.prevMap;
    }
    watch(ip){
      this.hitMap[ip] = (this.hitMap[ip] || 0) + 1;
      if(this.maxHit &lt; this.hitMap[ip]){
        Police.jail(ip);
      }
      this.checkBail();
    }
  }
  
  const police = new Police();
  
  function forOneLogLine(line){
    if(typeof line === 'string') {
      police.watch(line.split(' ')[3]);
    }
  }
  </code></pre>
  
  <p>So here i want to fill code for <code>jail</code> and <code>bail</code> (to block / free a ip address or a set of addresses)</p>
  
  <p>I went through this <a href="http://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/WAF.html" rel="nofollow noreferrer">AWS nodejs docs</a> . But it was so confusing how to implement it. And more specifically how to optimally implement it.
  I was looking for just two APIs, one that i would pass ip address and that would block that, and another to free that.</p>
  
  <p>I have a few basic question from above docs</p>
  
  <ol>
  <li>How do i pass ip address? and in which API?</li>
  <li>Does <code>aws.WAF</code> automatically groups a set of ip addresses into IPSets?</li>
  <li>Does <code>aws.WAF</code> also keeps the hit counts, something similar i am doing in class <code>Police</code> ?</li>
  <li>Do i need to fetch <code>ChangeToken</code> for <strong>every</strong> <code>IPaddress</code> that i am going to add/remove into block list? Or can i have it once and use that forever?</li>
  </ol>
  
  <p>I would be glad to have a sample code (preferably in javascript) for this exact requirement.
  I would be delighted if i get my <code>jail</code> and <code>bail</code> code filled.</p>