Ban a user after being blocked by WAF rule

Yes, you can add an IP to an IPSet when it exceeds the rate limit fixed by a WAF rule. You can do this by creating an Eventbridge event rule that triggers a Lambda function. The Lambda function can then add the IP address to the IPSet.

Create an Eventbridge event rule that is triggered by the WAF logs. The event rule should have the following conditions:

The source is the WAF log group. The event type is "AWS WAF Rule Matched". The rule name is the name of the WAF rule that you want to use to trigger the event.

Create a Lambda function that adds the IP address to the IPSet. The Lambda function should have the following permissions:

The ability to call the AWS WAF API. The ability to create and update IPSets. In the Lambda function, add the following code:

def handler(event, context):
    # Get the IP address from the event.
    ip_address = event["detail"]["request"]["clientIp"]

    # Add the IP address to the IPSet.
    client = boto3.client("waf-v2")
    client.update_ip_set(
        Name=IPSetName,
        Addresses=[ip_address],
    )

Once you have completed these steps, the Lambda function will be triggered whenever an IP address exceeds the rate limit fixed by the WAF rule. The Lambda function will then add the IP address to the IPSet.