Control: 8 AWS WAF Classic global web ACLs should have at least one rule or rule group
Description
This control checks whether an AWS WAF global web ACL contains at least one WAF rule or WAF rule group. The control fails if a web ACL does not contain any WAF rules or rule groups.
A WAF global web ACL can contain a collection of rules and rule groups that inspect and control web requests. If a web ACL is empty, the web traffic can pass without being detected or acted upon by WAF depending on the default action.
Remediation
To remediate this issue, update your WAF web ACL to add atleast one rule or rule group.
To add rules or rule groups to an empty web ACL
- Open the AWS WAF console.
- In the navigation pane, choose Switch to AWS WAF Classic, and then choose
Web ACLs. - For Filter, choose Global (CloudFront).
- Choose the name of the empty web ACL.
- Choose Rules, and then choose Edit web ACL.
- For Rules, choose a rule or rule group, and then choose Add rule to web ACL.
- At this point, you can modify the rule order within the web ACL if you are adding multiple rules or rule groups to the web ACL.
- Choose Update.
Usage
Run the control in your terminal:
powerpipe control run aws_compliance.control.foundational_security_waf_8Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run aws_compliance.control.foundational_security_waf_8 --shareSQL
This control uses a named query:
waf_web_acl_rule_attached