AWS WAF Classic Global rule has at least one condition

Check ID: waf_global_rule_with_conditions
Provider: AWS
Service: waf
Severity: MEDIUM
Categories: internet-exposed
Resource type: AwsWafRule

What this check verifies

AWS WAF Classic global rules contain at least one condition that matches HTTP(S) requests the rule evaluates for action (e.g., allow, block, count).

Risk

No-condition rules never match traffic, providing no filtering. Malicious requests (SQLi/XSS, bots) can reach origins, impacting confidentiality (data exfiltration), integrity (tampering), and availability (service disruption). They may also create a false sense of coverage.

Recommendation

Attach at least one precise condition to every rule, aligned to known threats and application context. Apply least privilege for traffic, use managed rule groups for defense in depth, and routinely review rules to remove placeholders. If on Classic, plan migration to WAFv2.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws waf update-rule --rule-id <example_resource_id> --change-token <example_change_token> --updates '[{"Action":"INSERT","Predicate":{"Negated":false,"Type":"IPMatch","DataId":"<example_resource_id>"}}]' --region us-east-1

# Ensure the WAF Classic Global rule has at least one condition
resource "aws_waf_rule" "<example_resource_name>" {
  name        = "<example_resource_name>"
  metric_name = "<example_metric_name>"

  # Critical: add at least one predicate (condition) so the rule is not empty
  predicate {
    data_id = "<example_resource_id>"  # existing IPSet ID
    negated = false
    type    = "IPMatch"
  }
}

# CloudFormation: ensure the WAF Classic Global rule has at least one condition
Resources:
  <example_resource_name>:
    Type: AWS::WAF::Rule
    Properties:
      Name: <example_resource_name>
      MetricName: <example_metric_name>
      # Critical: add at least one predicate (condition) so the rule is not empty
      Predicates:
        - Negated: false  # evaluate as-is
          Type: IPMatch
          DataId: <example_resource_id>  # existing IPSet ID

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = waf_global_rule_with_conditions. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

AWS Site-to-Site VPN connection has both tunnels up AWS WAF Classic global rule group has at least one rule

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires