AWS WAF icon

AWS WAF

Manage AWS WAF IP Sets - Add/Remove IP from blacklist

Actions4

Add IP to Blacklist

AI-generated

Summary

Adds specified IP addresses to an AWS WAF IP Set blacklist, optionally checking against a whitelist.

Inputs

  • scope (required) — Specifies whether the IP Set is Regional (REGIONAL) or CloudFront (CLOUDFRONT).
  • ipSetName (required) — The name of the existing IP Set to update.
  • ipSetId (required) — The unique identifier of the existing IP Set.
  • ipAddresses (required) — IP addresses in CIDR notation (e.g., 192.168.1.1/32). Supports comma-separated strings, JSON arrays, or single values. Missing /32 suffix is auto-added.
  • checkWhitelist — When true, checks if the provided IPs exist in a separate whitelist IP Set before adding them to the blacklist.
  • whitelistIpSetName — The name of the whitelist IP Set to check against. Required when checkWhitelist is true.
  • whitelistIpSetId — The unique identifier of the whitelist IP Set. Required when checkWhitelist is true.
  • whitelistAction — Action to take when an IP is found in the whitelist: 'skip' (add only non-whitelisted IPs) or 'fail' (abort and error).

Output shape

One item per input item, containing a JSON object with success status, message, and IP Set details.

If all IPs are skipped due to the whitelist, returns a success=false entry with skipped and whitelisted IPs. If checkWhitelist is disabled, always returns success=true.

Examples

Example 1: Add a single IP to a regional IP Set.

Set scope to REGIONAL, provide the IP Set name and ID, and enter the IP address with /32.

Example 2: Add multiple IPs while skipping those present in a whitelist.

Enable checkWhitelist, provide the whitelist IP Set details, and set whitelistAction to 'skip'.

Example 3: Block adding IPs that are already whitelisted.

Enable checkWhitelist and set whitelistAction to 'fail'. The operation will error if any input IP matches the whitelist.

Links

Discussion