AWS Beanstalk配置WAFv2 IPSet触发CloudFormation 400报错如何解决？

问题复现 #

我在为Beanstalk环境配置IPSet时，在.ebextensions目录下创建了waf.config文件，内容如下：

option_settings:
  aws:elasticbeanstalk:environment:
    LoadBalancerType: application
Resources:
  IPSet:
    Type: "AWS::WAFv2::IPSet"
    Properties:
      Name: '`{ "Ref" : "AWSEBEnvironmentName" }`-IPset'
      Addresses:
        - 10.10.10.10/32
      IPAddressVersion: IPV4
      Scope: REGIONAL
      Tags:
        - Key: "Scope"
          Value: "Sqreen"
  WafAcl:
   Type: "AWS::WAFv2::WebACL"
   Properties:
    Description: 'Web ACL to Block bad requests on `{ "Ref" : "AWSEBEnvironmentName" }`'
    Name: '`{ "Ref" : "AWSEBEnvironmentName" }`-WebACL'
    Scope: REGIONAL
    DefaultAction:
      Allow : {}
    VisibilityConfig:
      SampledRequestsEnabled: true
      CloudWatchMetricsEnabled: true
      MetricName: '`{ "Ref" : "AWSEBEnvironmentName" }`-WebACL'
    Rules:
      - Name: DenyListIPSet
        Priority: 0
        OverrideAction:
          Block: {}
        VisibilityConfig:
          SampledRequestsEnabled: true
          CloudWatchMetricsEnabled: true
          MetricName: DenyIps
        Statement:
          IPSetReferenceStatement:
            Arn: '`{ "Fn::GetAtt" : ["IPSet", "Arn" ]}`'
  WebACLAssociation:
    Type: AWS::WAFv2::WebACLAssociation
    Properties:
      ResourceArn: '`{ "Ref" : "AWSEBV2LoadBalancer" }`'
      WebACLArn: '`{ "Fn::GetAtt" : ["WafAcl", "Arn" ]}`'

部署后CloudFormation堆栈返回报错：

"Error reason: A reference in your rule statement is not valid., field: RULE, parameter: Statement (Service: Wafv2, Status Code: 400 "

经排查确认CloudFormation堆栈配置语法本身合法，也无其他适配需求的声明配置可替换。

解决方案 #

该问题由混淆RuleAction和OverrideAction的使用场景导致：

• OverrideAction 仅用于规则组引用场景，作用是覆盖规则组内部预设的规则动作
• Action 用于自定义独立规则的动作定义

本次配置的是自定义IPSet匹配规则，不属于规则组引用场景，将规则定义中的OverrideAction字段替换为Action后，WAF即可正常运行。

内容的提问来源于stack exchange，提问作者maathor