Application Load Balancer has a WAF Web ACL attached

Check ID: elbv2_waf_acl_attached
Provider: AWS
Service: elbv2
Severity: MEDIUM
Resource type: AwsElbv2LoadBalancer

What this check verifies

Application Load Balancers are evaluated for an associated AWS WAF web ACL that governs HTTP(S) requests. The evaluation detects ALBs missing a web ACL and recognizes associations from WAFv2 or regional WAF Classic.

Risk

Absent a WAF web ACL, ALBs accept unfiltered Layer 7 traffic, enabling:

Injection (SQLi/XSS) harming confidentiality and integrity
Credential stuffing and bot abuse
Resource exhaustion degrading availability

Recommendation

Associate a WAF web ACL with each ALB as defense in depth. Use managed and custom rules, IP reputation lists, and rate limiting to block attacks. Continuously tune policies and monitor logs. Apply least privilege by scoping rules to required paths, methods, and sources.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws wafv2 associate-web-acl —web-acl-arn <WEB_ACL_ARN> —resource-arn <ALB_ARN>

# Associate WAFv2 Web ACL with an ALB
resource "aws_wafv2_web_acl_association" "<example_resource_name>" {
  resource_arn = "<example_resource_id>" # CRITICAL: ALB ARN
  web_acl_arn  = "<example_resource_id>" # CRITICAL: WAFv2 Web ACL ARN
}

# CloudFormation: associate an existing WAFv2 Web ACL to an ALB
Resources:
  <example_resource_name>:
    Type: AWS::WAFv2::WebACLAssociation
    Properties:
      ResourceArn: <example_resource_id>  # CRITICAL: ALB ARN to protect
      WebACLArn: <example_resource_id>    # CRITICAL: WAFv2 Web ACL ARN to attach

References

https://docs.aws.amazon.com/waf/latest/developerguide/web-acl-associating-aws-resource.html

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = elbv2_waf_acl_attached. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Application Load Balancer listeners use HTTPS EMR account has Block Public Access enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires