Back to Checks
aws

AWS WAF Classic Regional Web ACL has logging enabled

waf_regional_webacl_logging_enabled
Service: wafSeverity: medium
OfficialBuilt-inVerified
Categories:logging
Resource Type:AwsWafRegionalWebAcl

AWS WAF Classic Regional Web ACLs are evaluated for logging enabled to capture evaluated web requests and rule actions. Regional Web ACLs protect Application Load Balancers and API Gateway stages.

Prowler logoProwlerprowler-provider-aws

Risk

Without WAF logging, you lose visibility into attacks (SQLi/XSS probes, bots, brute-force) and into allow/block decisions for ALB and API Gateway traffic. This limits detection, forensics, and incident response, weakening confidentiality, integrity, and availability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks waf_regional_webacl_logging_enabled

Recommendation

Enable logging on all Regional Web ACLs and send records to a centralized logging platform. Apply least privilege to log destinations, redact sensitive fields, and monitor for anomalies. Integrate logs with incident response for defense in depth and faster containment.

Remediation

CLI

aws waf-regional put-logging-configuration --logging-configuration ResourceArn=<web_acl_arn>,LogDestinationConfigs=<kinesis_firehose_delivery_stream_arn> --region <region>

Other

1Create an Amazon Kinesis Data Firehose delivery stream with a name starting with "aws-waf-logs-" in the same region as your Web ACL
2Open the AWS WAF console and switch to AWS WAF Classic
3Select Filter: Regional (your region) and go to Web ACLs
4Open the target Web ACL and go to the Logging tab
5Click Enable logging and select the Firehose delivery stream created in step 1
6Click Enable/Save

Check Code

from typing import List

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.waf.wafregional_client import wafregional_client


class waf_regional_webacl_logging_enabled(Check):
    """Ensure AWS WAF Classic Regional Web ACLs have logging enabled.

    This check evaluates whether each AWS WAF Classic Regional Web ACL has logging
    enabled by verifying the presence of at least one log destination configured
    in its logging configuration.

    - PASS: The Web ACL has at least one log destination configured.
    - FAIL: The Web ACL has no log destinations configured (logging is disabled).
    """

    def execute(self) -> List[Check_Report_AWS]:
        """Execute the WAF Regional Web ACL logging enabled check.

        Iterates over all WAF Classic Regional Web ACLs and generates a report
        indicating whether each Web ACL has logging enabled.

        Returns:
            List[Check_Report_AWS]: A list of report objects with the results of the check.
        """
        findings = []
        for acl in wafregional_client.web_acls.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=acl)
            report.status = "FAIL"
            report.status_extended = (
                f"AWS WAF Regional Web ACL {acl.name} does not have logging enabled."
            )

            if acl.logging_enabled:
                report.status = "PASS"
                report.status_extended = (
                    f"AWS WAF Regional Web ACL {acl.name} does have logging enabled."
                )

            findings.append(report)

        return findings

References