Back to Checks
aws

AWS WAF Classic Global rule has at least one condition

waf_global_rule_with_conditions
Service: wafSeverity: medium
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:AwsWafRule

AWS WAF Classic global rules contain at least one condition that matches HTTP(S) requests the rule evaluates for action (e.g., allow, block, count).

Prowler logoProwlerprowler-provider-aws

Risk

No-condition rules never match traffic, providing no filtering. Malicious requests (SQLi/XSS, bots) can reach origins, impacting confidentiality (data exfiltration), integrity (tampering), and availability (service disruption). They may also create a false sense of coverage.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks waf_global_rule_with_conditions

Recommendation

Attach at least one precise condition to every rule, aligned to known threats and application context. Apply least privilege for traffic, use managed rule groups for defense in depth, and routinely review rules to remove placeholders. If on Classic, plan migration to WAFv2.

Remediation

CLI

aws waf update-rule --rule-id <example_resource_id> --change-token <example_change_token> --updates '[{"Action":"INSERT","Predicate":{"Negated":false,"Type":"IPMatch","DataId":"<example_resource_id>"}}]' --region us-east-1

Terraform

# Ensure the WAF Classic Global rule has at least one condition
resource "aws_waf_rule" "<example_resource_name>" {
  name        = "<example_resource_name>"
  metric_name = "<example_metric_name>"

  # Critical: add at least one predicate (condition) so the rule is not empty
  predicate {
    data_id = "<example_resource_id>"  # existing IPSet ID
    negated = false
    type    = "IPMatch"
  }
}

NativeIaC

# CloudFormation: ensure the WAF Classic Global rule has at least one condition
Resources:
  <example_resource_name>:
    Type: AWS::WAF::Rule
    Properties:
      Name: <example_resource_name>
      MetricName: <example_metric_name>
      # Critical: add at least one predicate (condition) so the rule is not empty
      Predicates:
        - Negated: false  # evaluate as-is
          Type: IPMatch
          DataId: <example_resource_id>  # existing IPSet ID

Other

1Open the AWS Console > AWS WAF, then click Switch to AWS WAF Classic
2In Global (CloudFront) scope, go to Rules and select the target rule
3Click Edit (or Add rule) > Add condition
4Choose a condition type (e.g., IP match), select an existing condition, set it to does (not negated)
5Click Update/Save to apply

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.waf.waf_client import waf_client


class waf_global_rule_with_conditions(Check):
    def execute(self):
        findings = []
        for rule in waf_client.rules.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=rule)
            report.status = "FAIL"
            report.status_extended = (
                f"AWS WAF Global Rule {rule.name} does not have any conditions."
            )

            if rule.predicates:
                report.status = "PASS"
                report.status_extended = (
                    f"AWS WAF Global Rule {rule.name} has at least one condition."
                )

            findings.append(report)

        return findings

References