aws-wafv2 - What is the proper way to get the attribute ARN of the CfnIPSet?

[EMazzaglia]

Hello,

when trying to configure WAF with an IPSet to only allow traffic for specific IPs, I cannot figure out what is the proper way to get the CfnIPSet ARN. I followed the documentation in CDK but I receive the following error when I run npx cdk deploy

Deployment failed: Error: Stack Deployments Failed: Error: The stack named xxx-stack failed to deploy: UPDATE_ROLLBACK_COMPLETE: Resource handler returned message: "Error reason: A reference in your rule statement is not valid., field: RULE, parameter: Statement

Sample code below:

const ipSet = new CfnIPSet(this, 'ip-set-vpn', {
      ipAddressVersion: 'IPV4',
      scope: 'CLOUDFRONT',
      addresses: ['111.111.1/28'],
    });

    const waf = new CfnWebACL(this, 'waf', {
      defaultAction: {
        allow: {},
      },
      scope: 'CLOUDFRONT',
      visibilityConfig: {
        cloudWatchMetricsEnabled: false,
        metricName: 'Metric',
        sampledRequestsEnabled: false,
      },
      name: 'ACL',
      rules: [
        {
          name: 'Block-Other-IPs',
          priority: 0,
          statement: {
            ipSetReferenceStatement: {
              arn: ipSet.attrArn,
            },
          },
          visibilityConfig: {
            cloudWatchMetricsEnabled: false,
            metricName: 'g-metric',
            sampledRequestsEnabled: false,
          },
          overrideAction: {
            none: {},
          },
        },
      ],
    });

    const distribution = new Distribution(this, 'cdn', {
      defaultRootObject: 'index.html',
      defaultBehavior: {
        origin: new S3Origin(originB, { originAccessIdentity: oai }),
        cachePolicy: CachePolicy.CACHING_OPTIMIZED,
      },
      domainNames: [domainName],
      certificate,
      webAclId: waf.attrArn,
    });

Also I tried to create the IPSet through the console, get the ARN, and use it directly but it didnt work as well. So I think It might be something related with the construct it self.

Thank you!