TerraformでAWS WAFのIP制限を設定する方法｜ALB・CloudFront対応の実践ガイド

Internet
    │
    ▼
AWS WAF ← ここでIPを判定（許可 or ブロック）
    │
    ▼
Application Load Balancer
    │
    ▼
ECS / EC2（アプリケーション）

resource "aws_wafv2_ip_set" "allowed_ips" {
  name               = "allowed-office-ips"
  scope              = "REGIONAL"
  ip_address_version = "IPV4"

  addresses = [
    "203.0.113.10/32",   # 本社オフィス
    "198.51.100.20/32",  # リモートワーク拠点
  ]

  tags = {
    Environment = "production"
    ManagedBy   = "terraform"
  }
}

resource "aws_wafv2_web_acl" "main" {
  name  = "ip-restriction-acl"
  scope = "REGIONAL"

  # ★ 重要：デフォルトは「ブロック」
  default_action {
    block {}
  }

  # 許可IPからのアクセスのみ通す
  rule {
    name     = "allow-office-ips"
    priority = 1

    action {
      allow {}
    }

    statement {
      ip_set_reference_statement {
        arn = aws_wafv2_ip_set.allowed_ips.arn
      }
    }

    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "AllowOfficeIPs"
      sampled_requests_enabled   = true
    }
  }

  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name                = "IPRestrictionACL"
    sampled_requests_enabled   = true
  }

  tags = {
    Environment = "production"
    ManagedBy   = "terraform"
  }
}

resource "aws_wafv2_web_acl_association" "alb" {
  resource_arn = aws_lb.main.arn
  web_acl_arn  = aws_wafv2_web_acl.main.arn
}

# variables.tf
variable "allowed_ips" {
  description = "WAFで許可するIPアドレスのリスト（CIDR形式）"
  type        = list(string)
}

variable "environment" {
  description = "環境名（dev / stg / prod）"
  type        = string
}

# terraform.tfvars（環境ごとに用意）
allowed_ips = [
  "203.0.113.10/32",   # 本社
  "198.51.100.20/32",  # リモート拠点
  "192.0.2.50/32",     # VPN出口
]

environment = "production"

# waf.tf（IPSetのaddressesに変数を渡す）
resource "aws_wafv2_ip_set" "allowed_ips" {
  name               = "${var.environment}-allowed-ips"
  scope              = "REGIONAL"
  ip_address_version = "IPV4"
  addresses          = var.allowed_ips
}

# CloudFront用のprovider（us-east-1）
provider "aws" {
  alias  = "virginia"
  region = "us-east-1"
}

# CloudFront用のIPSet・Web ACLにはこのproviderを指定
resource "aws_wafv2_ip_set" "allowed_ips_cf" {
  provider           = aws.virginia
  name               = "allowed-ips-cloudfront"
  scope              = "CLOUDFRONT"
  ip_address_version = "IPV4"
  addresses          = var.allowed_ips
}

resource "aws_wafv2_web_acl" "main" {
  name  = "ip-restriction-acl"
  scope = "REGIONAL"

  default_action {
    block {}
  }

  # ルール1：許可IPリスト
  rule {
    name     = "allow-office-ips"
    priority = 1

    action {
      allow {}
    }

    statement {
      ip_set_reference_statement {
        arn = aws_wafv2_ip_set.allowed_ips.arn
      }
    }

    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "AllowOfficeIPs"
      sampled_requests_enabled   = true
    }
  }

  # ルール2：AWS Managed Rules（許可されたIP内でさらに防御）
  rule {
    name     = "aws-managed-common"
    priority = 2

    override_action {
      none {}
    }

    statement {
      managed_rule_group_statement {
        vendor_name = "AWS"
        name        = "AWSManagedRulesCommonRuleSet"
      }
    }

    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "AWSManagedCommon"
      sampled_requests_enabled   = true
    }
  }

  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name                = "IPRestrictionACL"
    sampled_requests_enabled   = true
  }
}

$5.00（ACL）+ $1.00（IPルール）+ $1.00（Managed Rules）+ $0.60（リクエスト）= 約$7.60/月

curl -s https://checkip.amazonaws.com

resource "aws_wafv2_ip_set" "allowed_ips_v6" {
  name               = "allowed-office-ips-v6"
  scope              = "REGIONAL"
  ip_address_version = "IPV6"
  addresses          = ["2001:db8::/32"]
}