Back to Checks
aws

AWS WAF Classic Global Web ACL has logging enabled

waf_global_webacl_logging_enabled
Service: wafSeverity: medium
OfficialBuilt-inVerified
Categories:logging
Resource Type:AwsWafWebAcl

AWS WAF Classic global Web ACLs have logging enabled to capture evaluated web requests and rule actions for each ACL

Prowler logoProwlerprowler-provider-aws

Risk

Without WAF logging, you lose visibility into attacks (SQLi/XSS probes, bots, brute-force) and into allow/block decisions, limiting detection and forensics. This degrades confidentiality, integrity, and availability, and slows incident response and tuning.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks waf_global_webacl_logging_enabled

Recommendation

Enable logging on all global Web ACLs and send records to a centralized logging platform. Apply least privilege to log destinations and redact sensitive fields. Monitor and alert on anomalies, and integrate logs with incident response for defense in depth and faster containment.

Remediation

CLI

aws waf put-logging-configuration --logging-configuration ResourceArn=<web_acl_arn>,LogDestinationConfigs=<kinesis_firehose_delivery_stream_arn>

Other

1In the AWS console, create an Amazon Kinesis Data Firehose delivery stream named starting with "aws-waf-logs-" (for CloudFront/global, create it in us-east-1)
2Open the AWS WAF console and switch to AWS WAF Classic
3Select Filter: Global (CloudFront) and go to Web ACLs
4Open the target Web ACL and go to the Logging tab
5Click Enable logging and select the Firehose delivery stream created in step 1
6Click Enable/Save

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.waf.waf_client import waf_client


class waf_global_webacl_logging_enabled(Check):
    def execute(self):
        findings = []
        for acl in waf_client.web_acls.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=acl)
            report.status = "FAIL"
            report.status_extended = (
                f"AWS WAF Global Web ACL {acl.name} does not have logging enabled."
            )

            if acl.logging_enabled:
                report.status = "PASS"
                report.status_extended = (
                    f"AWS WAF Global Web ACL {acl.name} does have logging enabled."
                )

            findings.append(report)

        return findings

References