Back to Checks
aws

AWS WAF Classic Regional Web ACL has at least one rule or rule group

waf_regional_webacl_with_rules
Service: wafSeverity: medium
OfficialBuilt-inVerified
Resource Type:AwsWafRegionalWebAcl

AWS WAF Classic Regional web ACL contains at least one rule or rule group to inspect and act on HTTP(S) requests. An ACL with no entries is considered empty.

Prowler logoProwlerprowler-provider-aws

Risk

With no rules, the web ACL performs no inspection, letting malicious traffic through.

  • Confidentiality: data exposure via SQLi/XSS
  • Integrity: unauthorized actions or tampering
  • Availability: abuse/bot traffic causing degradation or denial

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks waf_regional_webacl_with_rules

Recommendation

Populate each web ACL with at least one rule or rule group that inspects requests and enforces least privilege. Apply defense in depth by combining managed and custom rules, include rate controls where appropriate, and review regularly. Default to blocking undesired traffic; only permit required patterns.

Remediation

CLI

aws waf-regional update-web-acl --web-acl-id <your-web-acl-id> --change-token $(aws waf-regional get-change-token --query 'ChangeToken' --output text) --updates '[{"Action":"INSERT","ActivatedRule":{"Priority":1,"RuleId":"<your-rule-id>","Action":{"Type":"BLOCK"}}}]'

Terraform

# Terraform: Ensure the Web ACL has at least one rule
resource "aws_wafregional_web_acl" "<example_resource_name>" {
  name        = "<example_resource_name>"
  metric_name = "<example_resource_name>"

  default_action {
    type = "ALLOW"
  }

  # Critical: add at least one rule so the Web ACL is not empty
  rules {
    priority = 1
    rule_id  = "<example_resource_id>"
    action {
      type = "BLOCK"
    }
  }
}

NativeIaC

# CloudFormation: Ensure the Web ACL has at least one rule
Resources:
  <example_resource_name>:
    Type: AWS::WAFRegional::WebACL
    Properties:
      Name: "<example_resource_name>"
      MetricName: "<example_resource_name>"
      DefaultAction:
        Type: ALLOW
      # Critical: adding any rule to the Web ACL makes it non-empty and passes the check
      Rules:
        - Action:
            Type: BLOCK
          Priority: 1
          RuleId: "<example_resource_id>"  # Rule to insert into the Web ACL

Other

1Open the AWS Console and go to AWS WAF
2In the left pane, click Web ACLs and switch to AWS WAF Classic if prompted
3Select the Regional Web ACL and open the Rules tab
4Click Edit web ACL
5In Rules, select an existing rule or rule group and choose Add rule to web ACL
6Click Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.waf.wafregional_client import wafregional_client


class waf_regional_webacl_with_rules(Check):
    def execute(self):
        findings = []
        for acl in wafregional_client.web_acls.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=acl)
            report.status = "FAIL"
            report.status_extended = f"AWS WAF Regional Web ACL {acl.name} does not have any rules or rule groups."

            if acl.rules or acl.rule_groups:
                report.status = "PASS"
                report.status_extended = f"AWS WAF Regional Web ACL {acl.name} has at least one rule or rule group."

            findings.append(report)

        return findings

References