Skip to main content

WAFv2 WebACL Should Contain Rule Group Or Groups

More Info:​

Web ACL rule group should not be empty

Risk Level​

High

Address​

Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • Cloudanix Best Practice
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Using Console

To remediate the misconfiguration "WAFv2 WebACL Should Contain Rule Group Or Groups" for AWS Cloud Watch using the AWS console, you can follow these step-by-step instructions:

  1. Access the AWS Management Console: Go to https://aws.amazon.com/ and sign in to your AWS account.

  2. Navigate to AWS WAF: In the AWS Management Console, search for "WAF" in the services search bar and click on "AWS WAF" to access the AWS WAF console.

  3. Select the WebACL: In the AWS WAF console, select the WebACL that is flagged for the misconfiguration "WAFv2 WebACL Should Contain Rule Group Or Groups".

  4. Edit the WebACL: Click on the WebACL that you want to edit to remediate the misconfiguration.

  5. Add Rule Group: In the WebACL configuration, you will see the option to add rule groups. Click on the "Add rule group" button to add a rule group to the WebACL.

  6. Select Rule Group: Choose the appropriate rule group that you want to add to the WebACL. You can either select a managed rule group provided by AWS or a custom rule group that you have created.

  7. Configure Rule Group Settings: Configure the settings for the selected rule group as per your requirements. You can define the action to be taken when a rule in the rule group matches a request.

  8. Save Changes: Once you have added the rule group and configured the settings, click on the "Save" or "Update" button to save the changes to the WebACL.

  9. Review and Test: Review the updated WebACL configuration to ensure that the rule group has been successfully added. You can also test the WebACL to verify that it is working as expected.

By following these steps, you can remediate the misconfiguration "WAFv2 WebACL Should Contain Rule Group Or Groups" for AWS Cloud Watch using the AWS console.

Using CLI

To remediate the misconfiguration of WAFv2 WebACL not containing a Rule Group in AWS CloudWatch using AWS CLI, you can follow these steps:

  1. Identify the WebACL ID: First, you need to identify the WebACL ID that is missing a Rule Group. You can do this by listing all the WebACLs in your account using the following AWS CLI command:

    aws wafv2 list-web-acls

  2. Identify the Rule Group ARN: Next, you need to identify the ARN of the Rule Group that you want to associate with the WebACL. You can list all the available Rule Groups using the following AWS CLI command:

    aws wafv2 list-available-managed-rule-groups

  3. Associate Rule Group with WebACL: Once you have the WebACL ID and the Rule Group ARN, you can associate the Rule Group with the WebACL using the following AWS CLI command:

    aws wafv2 associate-web-acl \
    --web-acl-arn "arn:aws:wafv2:us-east-1:123456789012:regional/webacl/ExampleWebACL/0123456789abcdef" \
    --web-acl-capacity "FULL" \
    --rule-group-arns "arn:aws:wafv2:us-east-1:123456789012:regional/rulegroup/ExampleManagedRuleGroup/0123456789abcdef"

  4. Verify the Association: Finally, verify that the Rule Group has been successfully associated with the WebACL by describing the WebACL using the following AWS CLI command:

    aws wafv2 get-web-acl --web-acl-arn "arn:aws:wafv2:us-east-1:123456789012:regional/webacl/ExampleWebACL/0123456789abcdef"

By following these steps, you can remediate the misconfiguration of a WAFv2 WebACL not containing a Rule Group in AWS CloudWatch using AWS CLI.

Using Python

To remediate the misconfiguration of WAFv2 WebACL not containing any rule group in AWS CloudWatch using Python, you can follow these steps:

  1. Install the necessary Python libraries:
pip install boto3
  1. Use the following Python script to update the WebACL with the desired rule group(s):
import boto3

# Initialize the WAFv2 client
wafv2_client = boto3.client('wafv2')

# Define the WebACL ID that needs to be updated
web_acl_id = 'YOUR_WEB_ACL_ID'

# Define the Rule Group ARNs that you want to add to the WebACL
rule_group_arns = ['arn:aws:wafv2:us-west-2:123456789012:regional/rulegroup/MyRuleGroup']

# Get the current configuration of the WebACL
response = wafv2_client.get_web_acl(
    Name=web_acl_id
)

# Update the WebACL with the new Rule Groups
response = wafv2_client.update_web_acl(
    Name=web_acl_id,
    Scope='REGIONAL',  # or CLOUDFRONT if it's a CloudFront distribution
    DefaultAction=response['WebACL']['DefaultAction'],
    Description=response['WebACL']['Description'],
    Rules=response['WebACL']['Rules'],
    VisibilityConfig=response['WebACL']['VisibilityConfig'],
    Id=response['WebACL']['Id'],
    LockToken=response['WebACL']['LockToken'],
    RulesSource={
        'RulesSource': {
            'RulesString': "",
            'RuleGroupReferenceStatement': {
                'ARN': rule_group_arns[0]
            }
        },
        'OverrideAction': {
            'None': {}
        }
    }
)

print("WebACL updated successfully with the Rule Group(s)")
  1. Replace 'YOUR_WEB_ACL_ID' with the actual WebACL ID that needs to be updated.
  2. Replace 'arn:aws:wafv2:us-west-2:123456789012:regional/rulegroup/MyRuleGroup' with the ARN of the Rule Group that you want to add to the WebACL.
  3. Run the Python script to update the WebACL with the specified Rule Group(s).

By following these steps, you can remediate the misconfiguration of a WAFv2 WebACL not containing any rule group in AWS CloudWatch using Python.

Using Terraform
resource "aws_wafv2_web_acl" "this" {
  name  = "WEB_ACL_NAME"          # replace with your Web ACL name
  scope = "REGIONAL"              # or "CLOUDFRONT" as appropriate

  default_action {
    allow {}
  }

  visibility_config {
    sampled_requests_enabled = true
    cloudwatch_metrics_enabled = true
    metric_name = "WEB_ACL_METRIC_NAME" # replace with a CloudWatch metric name
  }

  # Add at least one rule group to ensure the Web ACL is not empty.
  # This example uses an AWS Managed Rule Group.
  rule {
    name     = "aws-managed-common-rule-set"
    priority = 1

    override_action {
      none {}
    }

    statement {
      managed_rule_group_statement {
        name        = "AWSManagedRulesCommonRuleSet"
        vendor_name = "AWS"
      }
    }

    visibility_config {
      sampled_requests_enabled   = true
      cloudwatch_metrics_enabled = true
      metric_name                = "aws-managed-common-rule-set"
    }
  }
}

This mirrors the CLI guidance by defining default_action, visibility_config, and a non-empty rules array that includes a managed rule group; Terraform will manage the full Web ACL configuration, so any change here overwrites the existing rule set just like update-web-acl.

Verification: terraform plan should show the aws_wafv2_web_acl.this resource being created or updated, with the rule block (including the managed rule group) added and no resource replacement unless you changed name or scope.