How to add one IP in ip-set using aws wafv2 cli?

In waf-regional you can actually insert an IP in existing set but how I can do the same thing in WAFv2?

When I tried to do that it replaces the whole IP-set, I just want to add one IP in existing IP-set

Solution 1:

You can't. The API was changed such that you cannot do delta change anymore.

You would need to do get-ip-set, make changes to the returned JSON model, and then call update-ip-set.

Solution 2:

After some research, I was able to do this with the existing API. Assign the values to all variables in starting of the script

# Get IP set
aws wafv2 get-ip-set --name=$NAME --scope REGIONAL --id=$ID --region $REGION > /root/IP_SET_OUTPUT

# Get token from the JSON
LOCK_TOKEN=$(jq -r '.LockToken' /root/IP_SET_OUTPUT)

# Get IP list from the JSON
arr=( $(jq -r '.IPSet.Addresses[]' /root/IP_SET_OUTPUT) )

# Add our ip to the list
arr+=( "${IP}/${BLOCK}" )

echo "${arr[@]}"

# Update IP set
aws wafv2 update-ip-set --name=$NAME --scope=REGIONAL --id=$ID --addresses "${arr[@]}" --lock-token=$LOCK_TOKEN --region=$REGION