Back to Checks
aws

AWS WAF Classic Regional rule group has at least one rule

waf_regional_rulegroup_not_empty
Service: wafSeverity: medium
OfficialBuilt-inVerified
Resource Type:AwsWafRegionalRuleGroup

AWS WAF Classic Regional rule groups are evaluated to confirm they contain at least one rule. Groups with no rule entries are considered empty.

Prowler logoProwlerprowler-provider-aws

Risk

An empty rule group contributes no filtering in a web ACL, letting requests bypass inspection within that group. This erodes defense in depth and can enable injection, brute-force, or bot traffic to reach applications, threatening confidentiality, integrity, and availability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks waf_regional_rulegroup_not_empty

Recommendation

Apply least privilege: populate each rule group with vetted rules aligned to your threat model, using ALLOW, BLOCK, or COUNT actions as appropriate. Remove or disable unused groups to avoid false assurance. Validate behavior in staging and monitor metrics to maintain defense in depth.

Remediation

CLI

aws waf-regional update-rule-group --rule-group-id <rule-group-id> --updates Action=INSERT,ActivatedRule={Priority=1,RuleId=<rule-id>,Action={Type=BLOCK}} --change-token <change-token>

Terraform

# Ensure WAF Classic Regional Rule Group has at least one rule
resource "aws_wafregional_rule_group" "<example_resource_name>" {
  name        = "<example_resource_name>"
  metric_name = "<example_resource_name>"

  # Critical: adds a rule so the rule group is not empty
  activated_rule {
    priority = 1
    rule_id  = "<example_resource_id>"  # existing rule ID
    action {
      type = "BLOCK"
    }
  }
}

NativeIaC

# CloudFormation: Ensure WAF Classic Regional Rule Group has at least one rule
Resources:
  <example_resource_name>:
    Type: AWS::WAFRegional::RuleGroup
    Properties:
      Name: <example_resource_name>
      MetricName: <example_resource_name>
      ActivatedRules:
        - Priority: 1  # Critical: adds a rule so the rule group is not empty
          RuleId: <example_resource_id>  # Critical: references an existing rule to include in the group
          Action:
            Type: BLOCK

Other

1In the AWS Console, go to AWS WAF & Shield and switch to AWS WAF Classic
2Select the correct Region, then choose Rule groups
3Open the target rule group and click Edit rule group
4Click Add rule to rule group, select an existing rule, choose an action (e.g., BLOCK), and click Update
5Save changes to ensure the rule group contains at least one rule

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.waf.wafregional_client import wafregional_client


class waf_regional_rulegroup_not_empty(Check):
    def execute(self):
        findings = []
        for rule_group in wafregional_client.rule_groups.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=rule_group)
            report.status = "FAIL"
            report.status_extended = f"AWS WAF Regional Rule Group {rule_group.name} does not have any rules."

            if rule_group.rules:
                report.status = "PASS"
                report.status_extended = (
                    f"AWS WAF Regional Rule Group {rule_group.name} is not empty."
                )

            findings.append(report)

        return findings

References