resource "aws_wafv2_ip_set" "datadog_blocked_ipv4s" {
  name               = "Datadog-blocked-ipv4s"
  ip_address_version = "IPV4"
  scope              = "CLOUDFRONT"
  addresses          = []

  lifecycle {
    # The addresses are managed by the Datadog Application Security product.
    ignore_changes = [addresses]
  }
}

# Add a blocking rule to your existing web ACL resource
resource "aws_wafv2_web_acl" "EdgeWAF" {
  name  = "EdgeWAF"
  description = "undefined"
  scope = "CLOUDFRONT"

  default_action {
    allow {}
  }

  rule {
    name     = "BlockedIPs"
    priority = 0

    action {
      block {}
    }

    statement {
      ip_set_reference_statement {
        arn = aws_wafv2_ip_set.datadog_blocked_ipv4s.arn
      }
    }

    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "Datadog-blocked-ipv4s"
      sampled_requests_enabled   = true
    }
  }

  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name                = "EdgeWAF"
    sampled_requests_enabled   = true
  }
}