clientIp

The IP address that the request originated from. If the WebACL is associated with a CloudFront distribution, this is the value of one of the following fields in CloudFront access logs:

• c-ip, if the viewer did not use an HTTP proxy or a load balancer to send the request

• x-forwarded-for, if the viewer did use an HTTP proxy or a load balancer to send the request