AWS WAF IP Sets Threat Intelligence Integration Guide | OpenDBL

Synchronizing OpenDBL with AWS WAF IP Sets

AWS WAF v2 utilizes IP Sets to block or rate-limit traffic from known malicious IP addresses and CIDR subnets.

1

Create AWS WAF IP Set

In AWS Management Console, navigate to AWS WAF > IP sets and click Create IP set.

2

Automate Sync with AWS Lambda / EventBridge

Deploy a lightweight EventBridge rule and Lambda function to fetch https://opendbl.net/lists/ipsum.list and call wafv2:UpdateIPSet.

3

Attach IP Set to Web ACL

In your Web ACL Rules, add a statement matching Originates from an IP address in IP set and select your OpenDBL IP Set with Action Block.