AWS WAFv2 Web ACL has logging enabled

Check ID: wafv2_webacl_logging_enabled
Provider: AWS
Service: wafv2
Severity: MEDIUM
Categories: logging
Resource type: AwsWafv2WebAcl

What this check verifies

AWS WAFv2 Web ACLs with logging capture details of inspected requests and rule evaluations. The assessment determines for each Web ACL whether logging is configured to record traffic analyzed by that ACL.

Risk

Without WAF logging, visibility into allowed/blocked requests is lost, degrading detection and response. SQLi, credential stuffing, and bot/DDoS probes can go unnoticed, risking data exposure (C), undetected rule misuse (I), and service instability from unseen abuse (A).

Recommendation

Enable logging on all WAFv2 Web ACLs to a centralized destination. Apply least privilege for log delivery, redact sensitive fields, and filter to retain high-value events. Integrate with monitoring/SIEM for alerting and correlation, and review routinely as part of defense in depth.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws wafv2 put-logging-configuration --logging-configuration ResourceArn=<WEB_ACL_ARN>,LogDestinationConfigs=<DESTINATION_ARN>

# Enable logging for a WAFv2 Web ACL
resource "aws_wafv2_web_acl_logging_configuration" "<example_resource_name>" {
  resource_arn           = "<example_resource_arn>"                 # CRITICAL: target Web ACL ARN
  log_destination_configs = ["<example_destination_arn>"]           # CRITICAL: log destination ARN
}

# CloudFormation: Enable logging for a WAFv2 Web ACL
Resources:
  <example_resource_name>:
    Type: AWS::WAFv2::LoggingConfiguration
    Properties:
      ResourceArn: arn:aws:wafv2:<region>:<account-id>:regional/webacl/<example_resource_name>/<example_resource_id>  # CRITICAL: target Web ACL to log
      LogDestinationConfigs:  # CRITICAL: where logs are sent
        - arn:aws:logs:<region>:<account-id>:log-group:aws-waf-logs-<example_resource_name>

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = wafv2_webacl_logging_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

WAF Classic Regional Web ACL has a rule or rule group WAFv2 web ACL has CloudWatch metrics on all rules

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires