Skip to main content

ip_sets

Creates, updates, deletes, gets or lists an ip_sets resource.

Overview​

Nameip_sets
TypeResource
Idaws.wafv2.ip_sets

Fields​

The following fields are returned by SELECT queries:

NameDatatypeDescription
ip_setobjectContains zero or more IP addresses or blocks of IP addresses specified in Classless Inter-Domain Routing (CIDR) notation. WAF supports all IPv4 and IPv6 CIDR ranges except for /0. For information about CIDR notation, see the Wikipedia entry Classless Inter-Domain Routing. WAF assigns an ARN to each IPSet that you create. To use an IP set in a rule, you provide the ARN to the Rule statement IPSetReferenceStatement.
lock_tokenstringA token used for optimistic locking. WAF returns a token to your get and list requests, to mark the state of the entity at the time of the request. To make changes to the entity associated with the token, you provide the token to operations like update and delete. WAF uses the token to ensure that no changes have been made to the entity since you last retrieved it. If a change has been made, the update fails with a WAFOptimisticLockException. If this happens, perform another get, and use the new token returned by that operation. (pattern: <code>^[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$</code>)

Methods​

The following methods are available for this resource:

NameAccessible byRequired ParamsOptional ParamsDescription
get_ip_setselectregionRetrieves the specified IPSet.
list_ip_setsselectregionRetrieves an array of IPSetSummary objects for the IP sets that you manage.
create_ip_setinsertregion, Name, Scope, IPAddressVersion, AddressesCreates an IPSet, which you use to identify web requests that originate from specific IP addresses or ranges of IP addresses. For example, if you're receiving a lot of requests from a ranges of IP addresses, you can configure WAF to block them using an IPSet that lists those IP addresses.
update_ip_setupdateregion, Name, Scope, Id, Addresses, LockTokenUpdates the specified IPSet. This operation completely replaces the mutable specifications that you already have for the IP set with the ones that you provide to this call. To modify an IP set, do the following: Retrieve it by calling GetIPSet Update its settings as needed Provide the complete IP set specification to this call Temporary inconsistencies during updates When you create or change a web ACL or other WAF resources, the changes take a small amount of time to propagate to all areas where the resources are stored. The propagation time can be from a few seconds to a number of minutes. The following are examples of the temporary inconsistencies that you might notice during change propagation: After you create a web ACL, if you try to associate it with a resource, you might get an exception indicating that the web ACL is unavailable. After you add a rule group to a web ACL, the new rule group rules might be in effect in one area where the web ACL is used and not in another. After you change a rule action setting, you might see the old action in some places and the new action in others. After you add an IP address to an IP set that is in use in a blocking rule, the new address might be blocked in one area while still allowed in another.
delete_ip_setdeleteregionDeletes the specified IPSet.

Parameters​

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

NameDatatypeDescription
regionstringAWS region (default: us-east-1)

SELECT examples​

Retrieves the specified IPSet.

SELECT
ip_set,
lock_token
FROM aws.wafv2.ip_sets
WHERE region = '{{ region }}' -- required
;

INSERT examples​

Creates an IPSet, which you use to identify web requests that originate from specific IP addresses or ranges of IP addresses. For example, if you're receiving a lot of requests from a ranges of IP addresses, you can configure WAF to block them using an IPSet that lists those IP addresses.

INSERT INTO aws.wafv2.ip_sets (
Name,
Scope,
Description,
IPAddressVersion,
Addresses,
Tags,
region
)
SELECT 
'{{ Name }}' /* required */,
'{{ Scope }}' /* required */,
'{{ Description }}',
'{{ IPAddressVersion }}' /* required */,
'{{ Addresses }}' /* required */,
'{{ Tags }}',
'{{ region }}'
RETURNING
summary
;

UPDATE examples​

Updates the specified IPSet. This operation completely replaces the mutable specifications that you already have for the IP set with the ones that you provide to this call. To modify an IP set, do the following: Retrieve it by calling GetIPSet Update its settings as needed Provide the complete IP set specification to this call Temporary inconsistencies during updates When you create or change a web ACL or other WAF resources, the changes take a small amount of time to propagate to all areas where the resources are stored. The propagation time can be from a few seconds to a number of minutes. The following are examples of the temporary inconsistencies that you might notice during change propagation: After you create a web ACL, if you try to associate it with a resource, you might get an exception indicating that the web ACL is unavailable. After you add a rule group to a web ACL, the new rule group rules might be in effect in one area where the web ACL is used and not in another. After you change a rule action setting, you might see the old action in some places and the new action in others. After you add an IP address to an IP set that is in use in a blocking rule, the new address might be blocked in one area while still allowed in another.

UPDATE aws.wafv2.ip_sets
SET 
Name = '{{ Name }}',
Scope = '{{ Scope }}',
Id = '{{ Id }}',
Description = '{{ Description }}',
Addresses = '{{ Addresses }}',
LockToken = '{{ LockToken }}'
WHERE 
region = '{{ region }}' --required
AND Name = '{{ Name }}' --required
AND Scope = '{{ Scope }}' --required
AND Id = '{{ Id }}' --required
AND Addresses = '{{ Addresses }}' --required
AND LockToken = '{{ LockToken }}' --required
RETURNING
next_lock_token;

DELETE examples​

Deletes the specified IPSet.

DELETE FROM aws.wafv2.ip_sets
WHERE region = '{{ region }}' --required
;
Last updated on