Block addresses in AWS WAF

Add the address behind an alert to an AWS WAF IP set for a while, then remove it.

Last reviewed November 11, 2026

  1. In AWS WAF create an IP set (IPv4 or IPv6, regional or CloudFront). Note its name, ID, scope and region. CloudFront sets are always in us-east-1. A set holds one address family, so an address of the other family is refused.
  2. Add a web ACL rule that blocks requests that match the set.
  3. Create an IAM user for UptimeWave with only the permissions to read and update that one IP set, and create an access key. Do not use broader credentials.
Policy for one IP set (replace the ARN)
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": ["wafv2:GetIPSet", "wafv2:UpdateIPSet"],
    "Resource": "arn:aws:wafv2:us-east-1:111122223333:regional/ipset/blocked-by-uptimewave/ID"
  }]
}
  1. Open Connections, add an AWS WAF connection with the region and key pair, and add the IP set as a target. To let us discover sets, also allow wafv2:ListIPSets.
  2. Press Test connection, then choose the target in a response.

Everything else works as it does for Cloudflare: single addresses only, for a set time, then removed.

Related