Check ID: wafv2_webacl_rule_logging_enabled
Provider: AWS
Service: wafv2
Severity: MEDIUM
Categories: logging
Resource type: AwsWafv2WebAcl

​
What this check verifies

AWS WAFv2 Web ACLs are assessed to confirm that every associated rule and rule group has CloudWatch metrics enabled for visibility into rule evaluations and traffic

​
Risk

Absent CloudWatch metrics, WAF telemetry is lost, masking spikes, rule bypasses, and misconfigurations. This delays detection of SQLi/XSS probes and bot floods, risking data confidentiality, request integrity, and application availability.

​
Recommendation

Enable CloudWatch metrics for all WAF rules and rule groups (including managed rule groups). Use consistent metric names, centralize dashboards and alerts, and review trends to validate rule efficacy. Integrate with a SIEM for defense in depth and tune rules based on telemetry.

​
Remediation

# Terraform: Enable CloudWatch metrics on WAFv2 Web ACL rules
resource "aws_wafv2_web_acl" "<example_resource_name>" {
  name  = "<example_resource_name>"
  scope = "REGIONAL"

  default_action { allow {} }

  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name                = "<metric_name>"
    sampled_requests_enabled   = true
  }

  rule {
    name     = "<example_rule_name>"
    priority = 1

    statement {
      managed_rule_group_statement {
        vendor_name = "AWS"
        name        = "AWSManagedRulesCommonRuleSet"
      }
    }

    override_action { none {} }

    visibility_config {
      cloudwatch_metrics_enabled = true  # Critical: enables CloudWatch metrics for this rule
      metric_name                = "<rule_metric_name>"  # Required with CloudWatch metrics
      sampled_requests_enabled   = true
    }
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = wafv2_webacl_rule_logging_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks