{
  "Name": "IP_Blocks",
  "Priority": 0,
  "Statement": {
    "RateBasedStatement": {
      "Limit": 2000,   ## アクセス数
      "EvaluationWindowSec": 300,
      "AggregateKeyType": "IP"
    }
  },
  "Action": {
    "Block": {}
  },
  "VisibilityConfig": {
    "SampledRequestsEnabled": true,
    "CloudWatchMetricsEnabled": true,
    "MetricName": "IP_Blocks"
  }
}

# IPブロック確認
$ aws wafv2 get-rate-based-statement-managed-keys \\ 
    --scope REGIONAL \\
    --web-acl-name {ACL名} \\                     
    --web-acl-id {ACL ID} \\
    --rule-name {ルール名}
{
    "ManagedKeysIPV4": {
        "IPAddressVersion": "IPV4",
        "Addresses": []
    },
    "ManagedKeysIPV6": {
        "IPAddressVersion": "IPV6",
        "Addresses": []
    }
}

# 連続アクセス
$ ab -c 1 -n 5  -A basic_auth:pass <https://hogehoge.com>

Server Software:        
Server Hostname:        hogehoge.com
︙
Complete requests:      100
Failed requests:        0
︙

# IPブロック再確認
$ aws wafv2 get-rate-based-statement-managed-keys \\  
    --scope REGIONAL \\
    --web-acl-name {acl-name} \\
    --web-acl-id {acl-id} \\
    --rule-name IP_Blocks
{
    "ManagedKeysIPV4": {
        "IPAddressVersion": "IPV4",
        "Addresses": [
            "xxx.xxx.xxx.xxx/32"　　　←IPが追加されている
        ]
    },
    "ManagedKeysIPV6": {
        "IPAddressVersion": "IPV6",
        "Addresses": []
    }
}

# 連続アクセス再確認
$ ab -c 1 -n 5  -A basic_auth:pass <https://hogehoge.com>

Server Hostname:        hogehoge.com
Server Port:            443
︙
Complete requests:      100
Failed requests:        0
Non-2xx responses:      100　　← ここにカウントが増えている
︙

import json
import os
import logging
import base64
import boto3

from urllib.request import Request, urlopen
from urllib.error import URLError, HTTPError

REGION = "ap-northeast-1"

def send_email(source, to, subject, body):
    client = boto3.client('ses', region_name=REGION)

    response = client.send_email(
        Source=source,
        Destination={
            'ToAddresses': [
                to,
            ]
        },
        Message={
            'Subject': {
                'Data': subject,
            },
            'Body': {
                'Text': {
                    'Data': body,
                },
            }
        }
    )
    
    return response

def lambda_handler(event, context):
		# 遮断されたIP取得
    web_acl_name = os.environ.get('WEB_ACL_NAME')
    web_acl_id = os.environ.get('WEB_ACL_ID')
    rule_name = os.environ.get('RULE_NAME')
    client = boto3.client('wafv2')
    
    print(web_acl_name)
    print(web_acl_id)
    print(rule_name)
    response = client.get_rate_based_statement_managed_keys(
        Scope='REGIONAL',
        WebACLName=web_acl_name,
        WebACLId=web_acl_id,
        RuleName=rule_name
    )
    dict_ip = response["ManagedKeysIPV4"]["Addresses"]
    print(dict_ip)

    ip_list = ""
    for ip in dict_ip:
        print(ip)
        ip_list += ip + ", "

    subject = '【***】ALBでDOS攻撃を検知しました。'
    text = "遮断したIPは" + ip_list + "です。"

    print(subject)
    print(text)
    
    # slack送信
    SLACK_WEBHOOK_URL = os.environ['SLACK_WEBHOOK_URL']
    color = "#FF0000"

    slack_message = {
        'text': "*%s*" % (subject),
        'attachments': [
            {
                'color': color,
                'text': text
            }
        ]
    }
    
    req = Request(SLACK_WEBHOOK_URL, json.dumps(slack_message).encode("utf-8"))
    try:
        response = urlopen(req)
        response.read()
    except HTTPError as e:
        logger.error("Request failed: %d %s", e.code, e.reason)
    except URLError as e:
        logger.error("Server connection failed: %s", e.reason)
    
    print(slack_message)
    print("slack通知を行いました")

    # メール送信
    SENDER_MAIL = os.environ.get('SENDER_MAIL')
    RECIPIENT_MAIL = os.environ.get('RECIPIENT_MAIL')
    to_mail = RECIPIENT_MAIL.split(',')
    
    for to in to_mail:
        send_email_to = send_email(SENDER_MAIL, to, subject, text)
        print("Send ResponseMetadata:" + json.dumps(send_email_to, ensure_ascii=False))
        print(to + "へメール通知を行いました")