We have an application hosted in AWS where for which we need to implement IP whitelisting. We don't use API gateway. I believe WAF will sit right after load balancer (correct me if I'm wrong). How can we feed allow IP address list to WAF from external service? The list will come from another service which we need to feed to WAF. If not WAF, what other alternatives do we have? Consider it as standard web server/application server based application.
You can use the AWS WAF management API to amend the rules directly from your own code, or you can use the AWS WAF CLI to do it from a command line.