AWS WAF Classic Regional rule group has at least one rule

Check ID: waf_regional_rulegroup_not_empty
Provider: AWS
Service: waf
Severity: MEDIUM
Resource type: AwsWafRegionalRuleGroup

What this check verifies

AWS WAF Classic Regional rule groups are evaluated to confirm they contain at least one rule. Groups with no rule entries are considered empty.

Risk

An empty rule group contributes no filtering in a web ACL, letting requests bypass inspection within that group. This erodes defense in depth and can enable injection, brute-force, or bot traffic to reach applications, threatening confidentiality, integrity, and availability.

Recommendation

Apply least privilege: populate each rule group with vetted rules aligned to your threat model, using ALLOW, BLOCK, or COUNT actions as appropriate. Remove or disable unused groups to avoid false assurance. Validate behavior in staging and monitor metrics to maintain defense in depth.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws waf-regional update-rule-group --rule-group-id <rule-group-id> --updates Action=INSERT,ActivatedRule={Priority=1,RuleId=<rule-id>,Action={Type=BLOCK}} --change-token <change-token>

# Ensure WAF Classic Regional Rule Group has at least one rule
resource "aws_wafregional_rule_group" "<example_resource_name>" {
  name        = "<example_resource_name>"
  metric_name = "<example_resource_name>"

  # Critical: adds a rule so the rule group is not empty
  activated_rule {
    priority = 1
    rule_id  = "<example_resource_id>"  # existing rule ID
    action {
      type = "BLOCK"
    }
  }
}

# CloudFormation: Ensure WAF Classic Regional Rule Group has at least one rule
Resources:
  <example_resource_name>:
    Type: AWS::WAFRegional::RuleGroup
    Properties:
      Name: <example_resource_name>
      MetricName: <example_resource_name>
      ActivatedRules:
        - Priority: 1  # Critical: adds a rule so the rule group is not empty
          RuleId: <example_resource_id>  # Critical: references an existing rule to include in the group
          Action:
            Type: BLOCK

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = waf_regional_rulegroup_not_empty. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

AWS WAF Classic Regional rule has at least one condition WAF Classic Regional Web ACL has a rule or rule group

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires