Check ID:
Provider: AWS
Service:
Severity: MEDIUM
Categories:
Resource type:
waf_global_webacl_logging_enabledProvider: AWS
Service:
wafSeverity: MEDIUM
Categories:
loggingResource type:
AwsWafWebAclWhat this check verifies
AWS WAF Classic global Web ACLs have logging enabled to capture evaluated web requests and rule actions for each ACLRisk
Without WAF logging, you lose visibility into attacks (SQLi/XSS probes, bots, brute-force) and into allow/block decisions, limiting detection and forensics. This degrades confidentiality, integrity, and availability, and slows incident response and tuning.Recommendation
Enable logging on all global Web ACLs and send records to a centralized logging platform. Apply least privilege to log destinations and redact sensitive fields. Monitor and alert on anomalies, and integrate logs with incident response for defense in depth and faster containment.Remediation
- CLI
- Dashboard steps
References
- https://docs.aws.amazon.com/waf/latest/developerguide/classic-logging.html
- https://docs.aws.amazon.com/securityhub/latest/userguide/waf-controls.html#waf-1
- https://docs.aws.amazon.com/cli/latest/reference/waf/put-logging-configuration.html
Where this check fires
This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable byCheck ID = waf_global_webacl_logging_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks