Fix CloudFront WAF ACL

* Scope needs to be set to "CLOUDFRONT" (global) when associated to a CloudFront distribution
dxw · Jun 7, 2024 · 9ad470b · 9ad470b
1 parent cc2d171
commit 9ad470b
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/ecs-cluster-infrastructure-waf.tf b/ecs-cluster-infrastructure-waf.tf
@@ -5,7 +5,7 @@ resource "aws_wafv2_ip_set" "infrastructure_ecs_cluster_ip_deny_list" {
 
   name               = "${local.resource_prefix}-${each.key}-ip-deny-list"
   description        = "IP addresses to block on ${local.resource_prefix}-${each.key}"
-  scope              = "REGIONAL"
+  scope              = "CLOUDFRONT"
   ip_address_version = "IPV4"
   addresses          = each.value["ip_deny_list"]
 }
@@ -17,7 +17,7 @@ resource "aws_wafv2_web_acl" "infrastructure_ecs_cluster" {
 
   name        = "${local.resource_prefix}-${each.key}"
   description = "${local.resource_prefix} ${each.key}"
-  scope       = "REGIONAL"
+  scope       = "CLOUDFRONT"
 
   default_action {
     allow {}