Check ID: wafv2_webacl_with_rules
Provider: AWS
Service: wafv2
Severity: HIGH
Categories: internet-exposed
Resource type: AwsWafv2WebAcl

​
What this check verifies

AWS WAFv2 web ACLs are evaluated for the presence of at least one configured rule or rule group that defines how HTTP(S) requests are inspected and acted upon.

​
Risk

Without rules, traffic is governed only by the web ACL DefaultAction, often allowing requests without inspection. This increases risks to confidentiality (data exfiltration via injection), integrity (XSS/parameter tampering), and availability (layer-7 DDoS, bot abuse).

​
Recommendation

Populate each web ACL with targeted rules or managed rule groups to enforce least-privilege web access: cover common exploits (SQLi/XSS), IP reputation, and rate limits, scoped to your apps. Use a conservative DefaultAction, monitor metrics/logs, and continually tune-supporting defense in depth and zero trust.

​
Remediation

# Terraform: Ensure the WAFv2 Web ACL has at least one rule
resource "aws_wafv2_web_acl" "<example_resource_name>" {
  name  = "<example_resource_name>"
  scope = "REGIONAL"

  default_action {
    allow {}
  }

  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name                = "<example_resource_name>"
    sampled_requests_enabled   = true
  }

  rule { # CRITICAL: Presence of this rule makes the Web ACL non-empty and passes the check
    name     = "<example_rule_name>"
    priority = 0
    statement {
      managed_rule_group_statement {
        name        = "AWSManagedRulesCommonRuleSet"
        vendor_name = "AWS"  # Minimal managed rule group
      }
    }
    override_action { count {} } # Non-blocking
    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "<example_rule_name>"
      sampled_requests_enabled   = true
    }
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = wafv2_webacl_with_rules. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks