Title: AWS Beanstalk and IPset
Tags: amazon-web-services;amazon-elastic-beanstalk;amazon-cloudformation;amazon-waf
Question: I'm trying to set an IPSet on my Beanstalk Environment.
into my .ebextensions I have a waf.config containing :
option_settings:
aws:elasticbeanstalk:environment:
LoadBalancerType: application
Resources:
IPSet:
Type: &quot;AWS75b5:f2c1:f5d7:b954:8dc3:cee9:baf:a8c0WAFv75b5:f2c1:f5d7:b954:8dc3:cee9:baf:a8c0IPSet&quot;
Properties:
Name: '`{ &quot;Ref&quot; : &quot;AWSEBEnvironmentName&quot; }`-IPset'
Addresses:
- 151.154.11.224/32
IPAddressVersion: IPV4
Scope: REGIONAL
Tags:
- Key: &quot;Scope&quot;
Value: &quot;Sqreen&quot;
WafAcl:
Type: &quot;AWS75b5:f2c1:f5d7:b954:8dc3:cee9:baf:a8c0WAFv75b5:f2c1:f5d7:b954:8dc3:cee9:baf:a8c0WebACL&quot;
Properties:
Description: 'Web ACL to Block bad requests on `{ &quot;Ref&quot; : &quot;AWSEBEnvironmentName&quot; }`'
Name: '`{ &quot;Ref&quot; : &quot;AWSEBEnvironmentName&quot; }`-WebACL'
Scope: REGIONAL
DefaultAction:
Allow : {}
VisibilityConfig:
SampledRequestsEnabled: true
CloudWatchMetricsEnabled: true
MetricName: '`{ &quot;Ref&quot; : &quot;AWSEBEnvironmentName&quot; }`-WebACL'
Rules:
- Name: DenyListIPSet
Priority: 0
OverrideAction:
Block: {}
VisibilityConfig:
SampledRequestsEnabled: true
CloudWatchMetricsEnabled: true
MetricName: DenyIps
Statement:
IPSetReferenceStatement:
Arn: '`{ &quot;Fn75b5:f2c1:f5d7:b954:8dc3:cee9:baf:a8c0GetAtt&quot; : [&quot;IPSet&quot;, &quot;Arn&quot; ]}`'
WebACLAssociation:
Type: AWS75b5:f2c1:f5d7:b954:8dc3:cee9:baf:a8c0WAFv75b5:f2c1:f5d7:b954:8dc3:cee9:baf:a8c0WebACLAssociation
Properties:
ResourceArn: '`{ &quot;Ref&quot; : &quot;AWSEBV2LoadBalancer&quot; }`'
WebACLArn: '`{ &quot;Fn75b5:f2c1:f5d7:b954:8dc3:cee9:baf:a8c0GetAtt&quot; : [&quot;WafAcl&quot;, &quot;Arn&quot; ]}`'
But the cloudformation stack gave me : &quot;Error reason: A reference in your rule statement is not valid., field: RULE, parameter: Statement (Service: Wafv2, Status Code: 400
The cloudformation stack looks valid to me. I don't see any other statment that could be match better for my need....
EDIT: Solution
&quot;RuleAction&quot; and &quot;OverrideAction&quot;, kindly reference [3] and [4] respectively.
[3] https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-wafv2-webacl-ruleaction.html
[4] https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-wafv2-webacl-overrideaction.html
With Action (instead of override action) the WAF works as expected !
Comment: oups typo in, fixed

Comment: Seemingly you are mixing waf and wafv2. `AWS75b5:f2c1:f5d7:b954:8dc3:cee9:baf:a8c0WAFv75b5:f2c1:f5d7:b954:8dc3:cee9:baf:a8c0IPSet` will work?

Here is the accepted answer: &quot;RuleAction&quot; and &quot;OverrideAction&quot;, kindly reference [3] and [4] respectively.
[3] https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-wafv2-webacl-ruleaction.html [4] https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-wafv2-webacl-overrideaction.html
With Action (instead of override action) the WAF works as expected !


{'source': 'StackExchangeDataset', 'subset': 'stackoverflow.com', 'metadata': {'AnswerCount': 1, 'CommentCount': 2, 'ContentLicense': 'CC BY-SA 4.0', 'CreationDate': '2021:00:08/31/21', 'FavoriteCount': None, 'PostTypeId': 1, 'Tags': '<amazon-web-services><amazon-elastic-beanstalk><amazon-cloudformation><amazon-waf>', 'Title': 'AWS Beanstalk and IPset', 'ViewCount': 85, 'id': 69004674, 'user_AboutMe': None, 'user_AccountId': 4783314.0, 'user_DisplayName': 'maathor', 'user_Reputation': 121.0, 'user_Views': 12.0, 'user_id': 3864493.0}}