如何通过 cloudformation 使用我的 WAF v2 允许某些 IP 集资源？

Question

为此问题设计的示例，基于 aws 文档，我使用 WAF 定义了 WAFv2 资源类型、规则和 IP 集列表。以下工作，它阻止了我指定的 IP，但是如何允许某些 IP 列表并阻止所有其他 IP？

Resources:
  
  WebAcl:
    Type: AWS::WAFv2::WebACL
    Properties:
      Name: sample-acl
      Scope: REGIONAL
      Description: sample ACL.
      DefaultAction:
        Allow: {}
      VisibilityConfig:
        SampledRequestsEnabled: true
        CloudWatchMetricsEnabled: true
        MetricName: sample-acl
      Rules:
      - Name: blockIPList
        Priority: 4
        Action:
          Block: {}
        VisibilityConfig:
          SampledRequestsEnabled: true
          CloudWatchMetricsEnabled: true
          MetricName: IPListMetric
        Statement:
          IPSetReferenceStatement:
            Arn: !GetAtt myIPSet.Arn
 myIPSet:
    Type: 'AWS::WAFv2::IPSet'
    Properties:
      Name: sampleIPlistIPv4
      Scope: REGIONAL
      IPAddressVersion: IPV4
      Addresses:
        - 70.25.14.172/32

  

Answer 1

在 CloudFront 分配上启用它

CloudFront:
Type: AWS::CloudFront::Distribution
Properties:
  DistributionConfig:
    WebACLId: !GetAtt ExampleWebACL.Arn

或者对于 ALB 或 API 网关，您可以使用 https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-wafv2-webaclassociation.html

Type: AWS::WAFv2::WebACLAssociation
Properties: 
  ResourceArn: String
  WebACLArn: String

编辑： 您的意思是如何在您的规则组中启用 IPSet？

RuleGroup:
Type: 'AWS::WAFv2::RuleGroup'
Properties:
  Name: SampleRuleGroup
  Scope: REGIONAL
  Description: SampleRuleGroup
  VisibilityConfig:
    SampledRequestsEnabled: true
    CloudWatchMetricsEnabled: true
    MetricName: SampleRuleGroupMetrics
  Rules:
    - Name: ip-whitelist
      Priority: 0
      Action:
        Allow: { }
      VisibilityConfig:
        SampledRequestsEnabled: true
        CloudWatchMetricsEnabled: true
        MetricName: ip-whitelist-metric
      Statement:
        IPSetReferenceStatement:
          Arn: !GetAtt SampleIPSet.Arn