How to import AWS::WAFv2::IPSet into existing CloudFormation stack

Question

I am trying to import an AWS::WAFv2::IPSet into an existing stack using the AWS CLI cloudformation command. I try entering the "Name", "Scope", "Id", and any combination of those three in the "ResourceeIdentifier" field, and I always get the error "Invalid resource identifier for resource type AWS::WAFv2::IPSet. Expected [Name, Id, Scope]". In CloudFormation, the resource I am trying to import has a "Physical Id" of "Name|Id|Scope", however I cannot figure what property that would equate to in the import?

Leo K · Accepted Answer

I tested it and it's working for me. I added this in my YAML-formatted CloudFormation template:
```yaml
TestEuWest1Import:
  Type: 'AWS::WAFv2::IPSet'
  DeletionPolicy: 'Delete'
  Properties:
    Name: 'test-eu-west-1-import'
    Scope: 'REGIONAL'
    IPAddressVersion: 'IPV4'
    Addresses: ['192.0.2.0/24']
```

Then I created a CFN change set with the updated template in the template bucket URL `https://CLOUDFORMATION-TEMPLATE-BUCKET/cfn-import-ipset.yaml` with this CLI command:
```bash
aws cloudformation create-change-set \
    --stack-name test-ipset --change-set-name ImportIpset \
    --change-set-type IMPORT \
    --template-url https://CLOUDFORMATION-TEMPLATE-BUCKET/cfn-import-ipset.yaml \
    --resources-to-import '[{"ResourceType":"AWS::WAFv2::IPSet","LogicalResourceId":"TestEuWest1Import","ResourceIdentifier":{"Name":"test-eu-west-1-import","Id":"ed838102-f3ec-4076-aa01-d80942b28b4b","Scope":"REGIONAL"}}]'
```

The minified JSON passed with the `--resources-to-import` parameter contains the following:
```json
[
  {
    "ResourceType": "AWS::WAFv2::IPSet",
    "LogicalResourceId": "TestEuWest1Import",
    "ResourceIdentifier": {
      "Name": "test-eu-west-1-import",
      "Id": "ed838102-f3ec-4076-aa01-d80942b28b4b",
      "Scope": "REGIONAL"
    }
  }
]
```
The "Id" parameter value I obtained with this CLI command: `aws wafv2 list-ip-sets --scope REGIONAL`, which would've been `aws wafv2 list-ip-sets --scope CLOUDFRONT --region us-east-1` if it had been scoped for CloudFront.

Executing the change set imported the IPSet successfully.

How to import AWS::WAFv2::IPSet into existing CloudFormation stack

Add your answer

Relevant content