AWS WAF Classic global rule group has at least one rule

Check ID: waf_global_rulegroup_not_empty
Provider: AWS
Service: waf
Severity: HIGH
Resource type: AwsWafRuleGroup

What this check verifies

AWS WAF Classic global rule groups are assessed for the presence of one or more rules. Empty groups are identified even when referenced by a web ACL, meaning the group adds no match logic.

Risk

An empty rule group performs no inspection, so web requests pass without WAF scrutiny. This creates blind spots enabling:

Confidentiality: data exfiltration via SQLi/XSS
Integrity: parameter tampering
Availability: bot abuse and layer-7 DoS

It also creates a false sense of protection when attached.

Recommendation

Populate each rule group with effective rules aligned to application threats; choose block or count actions as appropriate. Prefer managed rule groups as a baseline and layer custom rules for least privilege. Avoid placeholder groups, test in staging, and monitor metrics to tune.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws waf update-rule-group --rule-group-id <rule-group-id> --updates Action=INSERT,ActivatedRule={Priority=1,RuleId=<rule-id>,Action={Type=BLOCK}} --change-token <change-token> --region us-east-1

# Terraform: ensure the WAF Classic global rule group has at least one rule
resource "aws_waf_rule_group" "<example_resource_name>" {
  name        = "<example_resource_name>"
  metric_name = "examplemetric"

  activated_rule {
    priority = 1                      # Critical: adds a rule to the group (makes it non-empty)
    rule_id  = "<example_resource_id>" # Critical: ID of the existing rule to add
    action {
      type = "BLOCK"                 # Critical: required action when activating the rule
    }
  }
}

# CloudFormation: ensure the WAF Classic global rule group has at least one rule
Resources:
  <example_resource_name>:
    Type: AWS::WAF::RuleGroup
    Properties:
      Name: <example_resource_name>
      MetricName: examplemetric
      ActivatedRules:
        - Priority: 1                 # Critical: adds a rule to the group (makes it non-empty)
          RuleId: <example_resource_id>  # Critical: ID of the existing rule to add
          Action:
            Type: BLOCK              # Critical: required action when activating the rule

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = waf_global_rulegroup_not_empty. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

AWS WAF Classic Global rule has at least one condition AWS WAF Classic Global Web ACL has logging enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires