Back to Checks
aws

AWS WAF Classic global Web ACL has at least one rule or rule group

waf_global_webacl_with_rules
Service: wafSeverity: medium
OfficialBuilt-inVerified
Resource Type:AwsWafWebAcl

AWS WAF Classic global web ACLs are evaluated for the presence of at least one rule or rule group that inspects HTTP(S) requests

Prowler logoProwlerprowler-provider-aws

Risk

With no rules, the web ACL relies solely on its default action. If allow, hostile traffic reaches origins uninspected; if block, legitimate traffic can be denied.

  • SQLi/XSS can expose data (confidentiality)
  • Malicious requests can alter state (integrity)
  • Bots and scraping can drain resources (availability)

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks waf_global_webacl_with_rules

Recommendation

Populate each global web ACL with effective protections:

  • Use rule groups and targeted rules (managed, rate-based, IP sets)
  • Apply least privilege: default block where feasible; explicitly allow required traffic
  • Layer defenses and enable logging to tune policies
  • Consider migrating to WAFv2

Remediation

CLI

aws waf update-web-acl --web-acl-id <WEB_ACL_ID> --change-token <CHANGE_TOKEN> --updates '[{"Action":"INSERT","ActivatedRule":{"Priority":1,"RuleId":"<RULE_ID>","Action":{"Type":"BLOCK"}}}]'

Terraform

resource "aws_waf_web_acl" "<example_resource_name>" {
  name        = "<example_resource_name>"
  metric_name = "<example_metric_name>"

  default_action {
    type = "ALLOW"
  }

  rules { # Critical: Adds at least one rule so the Web ACL is not empty
    priority = 1
    rule_id  = "<example_rule_id>"
    type     = "REGULAR"
    action {
      type = "BLOCK"
    }
  }
}

NativeIaC

Resources:
  <example_resource_name>:
    Type: AWS::WAF::WebACL
    Properties:
      Name: <example_resource_name>
      MetricName: <example_metric_name>
      DefaultAction:
        Type: ALLOW
      Rules:
        - Action:
            Type: BLOCK
          Priority: 1
          RuleId: <example_rule_id>  # Critical: Adds a rule so the Web ACL is not empty
          # This ensures the Web ACL has at least one rule, changing FAIL to PASS

Other

1Open the AWS console and go to WAF
2In the left menu, click Switch to AWS WAF Classic
3At the top, set Filter to Global (CloudFront)
4Click Web ACLs and select your web ACL
5On the Rules tab, click Edit web ACL
6In Rules, select an existing rule or rule group and click Add rule to web ACL
7Click Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.waf.waf_client import waf_client


class waf_global_webacl_with_rules(Check):
    def execute(self):
        findings = []
        for acl in waf_client.web_acls.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=acl)
            report.status = "FAIL"
            report.status_extended = f"AWS WAF Global Web ACL {acl.name} does not have any rules or rule groups."

            if acl.rules or acl.rule_groups:
                report.status = "PASS"
                report.status_extended = f"AWS WAF Global Web ACL {acl.name} has at least one rule or rule group."

            findings.append(report)

        return findings

References