Back to Checks
aws

AWS WAF Classic global rule group has at least one rule

waf_global_rulegroup_not_empty
Service: wafSeverity: high
OfficialBuilt-inVerified
Resource Type:AwsWafRuleGroup

AWS WAF Classic global rule groups are assessed for the presence of one or more rules. Empty groups are identified even when referenced by a web ACL, meaning the group adds no match logic.

Prowler logoProwlerprowler-provider-aws

Risk

An empty rule group performs no inspection, so web requests pass without WAF scrutiny. This creates blind spots enabling:

  • Confidentiality: data exfiltration via SQLi/XSS
  • Integrity: parameter tampering
  • Availability: bot abuse and layer-7 DoS

It also creates a false sense of protection when attached.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks waf_global_rulegroup_not_empty

Recommendation

Populate each rule group with effective rules aligned to application threats; choose block or count actions as appropriate. Prefer managed rule groups as a baseline and layer custom rules for least privilege. Avoid placeholder groups, test in staging, and monitor metrics to tune.

Remediation

CLI

aws waf update-rule-group --rule-group-id <rule-group-id> --updates Action=INSERT,ActivatedRule={Priority=1,RuleId=<rule-id>,Action={Type=BLOCK}} --change-token <change-token> --region us-east-1

Terraform

# Terraform: ensure the WAF Classic global rule group has at least one rule
resource "aws_waf_rule_group" "<example_resource_name>" {
  name        = "<example_resource_name>"
  metric_name = "examplemetric"

  activated_rule {
    priority = 1                      # Critical: adds a rule to the group (makes it non-empty)
    rule_id  = "<example_resource_id>" # Critical: ID of the existing rule to add
    action {
      type = "BLOCK"                 # Critical: required action when activating the rule
    }
  }
}

NativeIaC

# CloudFormation: ensure the WAF Classic global rule group has at least one rule
Resources:
  <example_resource_name>:
    Type: AWS::WAF::RuleGroup
    Properties:
      Name: <example_resource_name>
      MetricName: examplemetric
      ActivatedRules:
        - Priority: 1                 # Critical: adds a rule to the group (makes it non-empty)
          RuleId: <example_resource_id>  # Critical: ID of the existing rule to add
          Action:
            Type: BLOCK              # Critical: required action when activating the rule

Other

1Open the AWS Console and go to AWS WAF, then switch to AWS WAF Classic
2At the top, set scope to Global (CloudFront)
3Go to Rule groups and select the target rule group
4Click Edit rule group
5Select an existing rule, choose its action (e.g., BLOCK), and click Add rule to rule group
6Click Update to save

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.waf.waf_client import waf_client


class waf_global_rulegroup_not_empty(Check):
    def execute(self):
        findings = []
        for rule_group in waf_client.rule_groups.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=rule_group)
            report.status = "FAIL"
            report.status_extended = (
                f"AWS WAF Global Rule Group {rule_group.name} does not have any rules."
            )

            if rule_group.rules:
                report.status = "PASS"
                report.status_extended = (
                    f"AWS WAF Global Rule Group {rule_group.name} is not empty."
                )

            findings.append(report)

        return findings

References