WAF Classic global Web ACL has a rule or rule group

Check ID: waf_global_webacl_with_rules
Provider: AWS
Service: waf
Severity: MEDIUM
Resource type: AwsWafWebAcl

What this check verifies

AWS WAF Classic global web ACLs are evaluated for the presence of at least one rule or rule group that inspects HTTP(S) requests

Risk

With no rules, the web ACL relies solely on its default action. If allow, hostile traffic reaches origins uninspected; if block, legitimate traffic can be denied.

SQLi/XSS can expose data (confidentiality)
Malicious requests can alter state (integrity)
Bots and scraping can drain resources (availability)

Recommendation

Populate each global web ACL with effective protections:

Use rule groups and targeted rules (managed, rate-based, IP sets)
Apply least privilege: default block where feasible; explicitly allow required traffic
Layer defenses and enable logging to tune policies
Consider migrating to WAFv2

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws waf update-web-acl --web-acl-id <WEB_ACL_ID> --change-token <CHANGE_TOKEN> --updates '[{"Action":"INSERT","ActivatedRule":{"Priority":1,"RuleId":"<RULE_ID>","Action":{"Type":"BLOCK"}}}]'

resource "aws_waf_web_acl" "<example_resource_name>" {
  name        = "<example_resource_name>"
  metric_name = "<example_metric_name>"

  default_action {
    type = "ALLOW"
  }

  rules { # Critical: Adds at least one rule so the Web ACL is not empty
    priority = 1
    rule_id  = "<example_rule_id>"
    type     = "REGULAR"
    action {
      type = "BLOCK"
    }
  }
}

Resources:
  <example_resource_name>:
    Type: AWS::WAF::WebACL
    Properties:
      Name: <example_resource_name>
      MetricName: <example_metric_name>
      DefaultAction:
        Type: ALLOW
      Rules:
        - Action:
            Type: BLOCK
          Priority: 1
          RuleId: <example_rule_id>  # Critical: Adds a rule so the Web ACL is not empty
          # This ensures the Web ACL has at least one rule, changing FAIL to PASS

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = waf_global_webacl_with_rules. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

AWS WAF Classic Global Web ACL has logging enabled AWS WAF Classic Regional rule has at least one condition

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires