Back to Checks
aws

AWS WAF Classic Regional rule has at least one condition

waf_regional_rule_with_conditions
Service: wafSeverity: medium
OfficialBuilt-inVerified
Resource Type:AwsWafRegionalRule

AWS WAF Classic Regional rules have one or more conditions (predicates) attached (IP, byte/regex, geo, size, SQLi/XSS) to define which requests the rule evaluates

Prowler logoProwlerprowler-provider-aws

Risk

An empty rule never matches, letting traffic bypass that control. This weakens defense-in-depth and can impact confidentiality (data exfiltration), integrity (SQLi/XSS), and availability (missing rate/size limits), depending on Web ACL order and default action.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks waf_regional_rule_with_conditions

Recommendation

Define precise conditions for each rule (e.g., IP, pattern, geo, size) and avoid placeholder rules. Apply least privilege filtering, review rule order, and use layered controls for defense in depth. Regularly validate and monitor rule effectiveness.

Remediation

CLI

aws waf-regional update-rule --rule-id <example_rule_id> --change-token $(aws waf-regional get-change-token --query ChangeToken --output text) --updates '[{"Action":"INSERT","Predicate":{"Negated":false,"Type":"IPMatch","DataId":"<example_ipset_id>"}}]'

Terraform

# WAF Classic Regional rule with at least one condition
resource "aws_wafregional_rule" "<example_resource_name>" {
  name        = "<example_resource_name>"
  metric_name = "<example_metric_name>"

  predicate {                        
    data_id = "<example_ipset_id>"  # CRITICAL: attaches existing IP set as the condition
    type    = "IPMatch"             # CRITICAL: predicate type
    negated = false                  # CRITICAL: apply condition directly
  }
}

NativeIaC

# Add at least one condition to a WAF Classic Regional Rule
Resources:
  <example_resource_name>:
    Type: AWS::WAFRegional::Rule
    Properties:
      Name: <example_resource_name>
      MetricName: <example_metric_name>
      Predicates:
        - Negated: false         # CRITICAL: ensures the predicate is applied as-is
          Type: IPMatch          # CRITICAL: predicate type
          DataId: <example_ipset_id>  # CRITICAL: attaches an existing IP set as a condition

Other

1Open the AWS Console and go to AWS WAF, then select Switch to AWS WAF Classic
2In the left pane, choose Regional and click Rules
3Select the target rule and choose Add rule
4Click Add condition, set When a request to does, choose IP match (or another type), and select an existing condition (e.g., an IP set)
5Click Update to save the rule with the condition

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.waf.wafregional_client import wafregional_client


class waf_regional_rule_with_conditions(Check):
    def execute(self):
        findings = []
        for rule in wafregional_client.rules.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=rule)
            report.status = "FAIL"
            report.status_extended = (
                f"AWS WAF Regional Rule {rule.name} does not have any conditions."
            )

            if rule.predicates:
                report.status = "PASS"
                report.status_extended = (
                    f"AWS WAF Regional Rule {rule.name} has at least one condition."
                )

            findings.append(report)

        return findings

References