Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

WAF Quota limits

-2

I have to create 100 IP sets and each IP set contains allowlisted IPs for a tenant. My limitation is that I cannot consolidate the IP sets as I do not want tenant cross-communication. I have the WAF/WebACL attached to an ALB and this ALB serves 100 customers/unique end-points. The WebACL will have 100 rules where each rule will match the customer endpoint and its corresponding IP-set to allow the request. Is this doable based on the following constraints and how?

  1. Maximum number of reference statements per rule group. In a rule group, a reference statement can reference an IP set or a regex pattern set - 50
  2. Maximum number of reference statements per protection pack (web ACL). In a protection pack (web ACL), a reference statement can reference a rule group, an IP set, or a regex pattern set - 50 Reference: https://docs.aws.amazon.com/waf/latest/developerguide/limits.html
Topics
Security, Identity, & Compliance
Tags
AWS WAF
Language
English

asked a month ago61 views

1 Answer
1

Hello.

Maximum number of reference statements per rule group. In a rule group, a reference statement can reference an IP set or a regex pattern set - 50

To avoid exceeding the above quota, you cannot register 100 IP sets in separate statements.
Therefore, I think we need to split the rule group.

Incidentally, if you try to add the 51st item, you will get the following error and will not be able to add it.

AWS WAF couldn’t perform the operation because you exceeded your resource limit NUM_REFERENCED_STATEMENT_IN_CONTAINER

a

EXPERT

answered a month ago

EXPERT

reviewed a month ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content