AWS WAF Classic Regional rule has at least one condition

Check ID: waf_regional_rule_with_conditions
Provider: AWS
Service: waf
Severity: MEDIUM
Resource type: AwsWafRegionalRule

What this check verifies

AWS WAF Classic Regional rules have one or more conditions (predicates) attached (IP, byte/regex, geo, size, SQLi/XSS) to define which requests the rule evaluates

Risk

An empty rule never matches, letting traffic bypass that control. This weakens defense-in-depth and can impact confidentiality (data exfiltration), integrity (SQLi/XSS), and availability (missing rate/size limits), depending on Web ACL order and default action.

Recommendation

Define precise conditions for each rule (e.g., IP, pattern, geo, size) and avoid placeholder rules. Apply least privilege filtering, review rule order, and use layered controls for defense in depth. Regularly validate and monitor rule effectiveness.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws waf-regional update-rule --rule-id <example_rule_id> --change-token $(aws waf-regional get-change-token --query ChangeToken --output text) --updates '[{"Action":"INSERT","Predicate":{"Negated":false,"Type":"IPMatch","DataId":"<example_ipset_id>"}}]'

# WAF Classic Regional rule with at least one condition
resource "aws_wafregional_rule" "<example_resource_name>" {
  name        = "<example_resource_name>"
  metric_name = "<example_metric_name>"

  predicate {                        
    data_id = "<example_ipset_id>"  # CRITICAL: attaches existing IP set as the condition
    type    = "IPMatch"             # CRITICAL: predicate type
    negated = false                  # CRITICAL: apply condition directly
  }
}

# Add at least one condition to a WAF Classic Regional Rule
Resources:
  <example_resource_name>:
    Type: AWS::WAFRegional::Rule
    Properties:
      Name: <example_resource_name>
      MetricName: <example_metric_name>
      Predicates:
        - Negated: false         # CRITICAL: ensures the predicate is applied as-is
          Type: IPMatch          # CRITICAL: predicate type
          DataId: <example_ipset_id>  # CRITICAL: attaches an existing IP set as a condition

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = waf_regional_rule_with_conditions. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

WAF Classic global Web ACL has a rule or rule group AWS WAF Classic Regional rule group has at least one rule

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires