# use a value from x-forwarded-for as the client address
real_ip_header X-Forwarded-For;
# only trust x-forwarded-for appended from within the vpc
set_real_ip_from 172.31.0.0/16;
# Recursively replace
real_ip_recursive on;
# rewrite x-forwarded-for to the real client address
proxy_set_header X-Forwarded-For $remote_addr;

header_filter_by_lua_block {                                                                                                                                                                                       
  local xff = ngx.req.get_headers()["X-Forwarded-For"]                                                                                                                                                             
  ngx.req.clear_header("X-Forwarded-For")                                                                                                                                                                          
  local new_xff = string.match(xff, ",? *([^,]+)$")`                                                                                                                                                               
  ngx.req.set_header("X-Forwarded-For", new_xff)                                                                                                                                                                   
}