Back to Checks
aws

AWS WAFv2 Web ACL has logging enabled

wafv2_webacl_logging_enabled
Service: wafv2Severity: medium
OfficialBuilt-inVerified
Categories:logging
Resource Type:AwsWafv2WebAcl

AWS WAFv2 Web ACLs with logging capture details of inspected requests and rule evaluations. The assessment determines for each Web ACL whether logging is configured to record traffic analyzed by that ACL.

Prowler logoProwlerprowler-provider-aws

Risk

Without WAF logging, visibility into allowed/blocked requests is lost, degrading detection and response. SQLi, credential stuffing, and bot/DDoS probes can go unnoticed, risking data exposure (C), undetected rule misuse (I), and service instability from unseen abuse (A).

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks wafv2_webacl_logging_enabled

Recommendation

Enable logging on all WAFv2 Web ACLs to a centralized destination. Apply least privilege for log delivery, redact sensitive fields, and filter to retain high-value events. Integrate with monitoring/SIEM for alerting and correlation, and review routinely as part of defense in depth.

Remediation

CLI

aws wafv2 put-logging-configuration --logging-configuration ResourceArn=<WEB_ACL_ARN>,LogDestinationConfigs=<DESTINATION_ARN>

Terraform

# Enable logging for a WAFv2 Web ACL
resource "aws_wafv2_web_acl_logging_configuration" "<example_resource_name>" {
  resource_arn           = "<example_resource_arn>"                 # CRITICAL: target Web ACL ARN
  log_destination_configs = ["<example_destination_arn>"]           # CRITICAL: log destination ARN
}

NativeIaC

# CloudFormation: Enable logging for a WAFv2 Web ACL
Resources:
  <example_resource_name>:
    Type: AWS::WAFv2::LoggingConfiguration
    Properties:
      ResourceArn: arn:aws:wafv2:<region>:<account-id>:regional/webacl/<example_resource_name>/<example_resource_id>  # CRITICAL: target Web ACL to log
      LogDestinationConfigs:  # CRITICAL: where logs are sent
        - arn:aws:logs:<region>:<account-id>:log-group:aws-waf-logs-<example_resource_name>

Other

1In the AWS Console, go to AWS WAF & Shield > Web ACLs
2Select the target Web ACL
3Open the Logging and metrics (or Logging) section and click Enable logging
4Choose a log destination (CloudWatch Logs log group, S3 bucket, or Kinesis Data Firehose)
5Click Save to enable logging

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.wafv2.wafv2_client import wafv2_client


class wafv2_webacl_logging_enabled(Check):
    def execute(self):
        findings = []
        for web_acl in wafv2_client.web_acls.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=web_acl)

            if web_acl.logging_enabled:
                report.status = "PASS"
                report.status_extended = (
                    f"AWS WAFv2 Web ACL {web_acl.name} has logging enabled."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"AWS WAFv2 Web ACL {web_acl.name} does not have logging enabled."
                )

            findings.append(report)

        return findings

References