WAF V2 Rule Groups Should Not Be Empty

More Info:

WAF rule groups should not be empty

Risk Level

High

Address

Security

Compliance Standards

APRA CPS 234 (Australia)
AWS Startup Security Baseline
BSI C5 (Germany)
Brazil LGPD
CCPA / CPRA (California)
CIS Critical Security Controls v8
CMMC 2.0
CSA Cloud Controls Matrix v4
Cloudanix Best Practice
DPDPA
Digital Operational Resilience Act (EU)
Essential 8
ISO/IEC 27017
ISO/IEC 27018
ISO/IEC 27701
KSA PDPL
MAS Technology Risk Management (Singapore)
MITRE ATT&CK (Cloud)
NIS2 Directive
NIST SP 800-171
NYDFS 23 NYCRR 500
SWIFT Customer Security Controls Framework
Sarbanes-Oxley IT General Controls
UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

To remediate the misconfiguration of having empty WAF V2 Rule Groups in AWS CloudWatch using the AWS console, follow these steps:

Login to AWS Console: Go to the AWS Management Console (https://aws.amazon.com/) and login using your credentials.
Navigate to AWS WAF: Click on the "Services" dropdown menu at the top of the page, search for "WAF & Shield" under the Security, Identity, & Compliance section, and click on it.
Select the WAF Web ACL: In the AWS WAF & Shield dashboard, click on "Web ACLs" from the left-hand menu.
Choose the Web ACL: Select the Web ACL that you want to check for empty WAF V2 Rule Groups.
Review Rule Groups: In the selected Web ACL, review the configured Rule Groups to identify any that are empty.
Edit the Web ACL: Click on the Web ACL that contains the empty WAF V2 Rule Groups to edit it.
Remove Empty Rule Groups: In the Web ACL editor, locate the empty Rule Groups and remove them by clicking on the delete or remove option next to each empty Rule Group.
Add Rules to Rule Groups: If necessary, add appropriate rules to the Rule Groups to ensure that they are not empty. You can create custom rules or use managed rule groups provided by AWS.
Save Changes: After removing the empty Rule Groups and adding necessary rules, save the changes to the Web ACL.
Review and Deploy: Review the updated Web ACL configuration to ensure that there are no more empty Rule Groups. Once you are satisfied with the changes, deploy the updated Web ACL to apply the changes.

By following these steps, you can remediate the misconfiguration of having empty WAF V2 Rule Groups in AWS CloudWatch using the AWS console.

Using CLI

To remediate the misconfiguration of having empty WAF V2 Rule Groups in AWS CloudWatch using AWS CLI, you can follow these steps:

Identify the Empty WAF V2 Rule Groups: First, you need to identify the empty WAF V2 Rule Groups in your AWS account. You can do this by running the following AWS CLI command:
```
aws wafv2 list-rule-groups --scope CLOUDFRONT(or REGIONAL) --query "RuleGroups[?RuleGroupArn == null].Name"
```
This command will list the names of all the empty WAF V2 Rule Groups in your account.
Update the Empty Rule Groups: To update the empty WAF V2 Rule Groups, you can either add rules to them or delete them based on your requirements.
- To add rules to a specific empty WAF V2 Rule Group, you can use the following AWS CLI command:
```
aws wafv2 update-rule-group --scope CLOUDFRONT(or REGIONAL) --name <RuleGroupName> --rules-action ALLOW|BLOCK --rules file://rules.json
```
  Replace <RuleGroupName> with the name of the empty WAF V2 Rule Group and provide the necessary rules in the rules.json file.
- To delete a specific empty WAF V2 Rule Group, you can use the following AWS CLI command:
```
aws wafv2 delete-rule-group --scope CLOUDFRONT(or REGIONAL) --name <RuleGroupName>
```
  Replace <RuleGroupName> with the name of the empty WAF V2 Rule Group that you want to delete.
Verify the Changes: After updating or deleting the empty WAF V2 Rule Groups, you can verify the changes by listing all the WAF V2 Rule Groups in your account using the following AWS CLI command:
```
aws wafv2 list-rule-groups --scope CLOUDFRONT(or REGIONAL) --query "RuleGroups[].Name"
```
This command will list all the WAF V2 Rule Groups in your account.

By following these steps, you can remediate the misconfiguration of having empty WAF V2 Rule Groups in AWS CloudWatch using AWS CLI.

Using Python

To remediate the misconfiguration of having empty WAF V2 Rule Groups in AWS CloudWatch using Python, you can follow these steps:

Install the Boto3 library:

pip install boto3

Use the following Python script to check for and remediate empty WAF V2 Rule Groups in AWS CloudWatch:

import boto3

def remediate_empty_rule_groups():
    # Initialize the AWS CloudWatch client
    client = boto3.client('wafv2')

    # Get all the available rule groups
    response = client.list_rule_groups(Scope='CLOUDFRONT(or REGIONAL)')

    for rule_group in response['RuleGroups']:
        rule_group_id = rule_group['Id']
        
        # Get the rules in each rule group
        rules_response = client.get_rule_group(RuleGroupId=rule_group_id)
        
        # Check if the rule group is empty
        if not rules_response['RuleGroup']['AvailableRules']:
            # Remediate by adding a sample rule
            sample_rule = {
                'Name': 'SampleRule',
                'Priority': 1,
                'Statement': {
                    'ByteMatchStatement': {
                        'SearchString': 'sample',
                        'FieldToMatch': {
                            'UriPath': {}
                        }
                    }
                },
                'Action': {
                    'Block': {}
                },
                'VisibilityConfig': {
                    'SampledRequestsEnabled': True,
                    'CloudWatchMetricsEnabled': True,
                    'MetricName': 'SampleRuleMetric'
                }
            }
            
            # Add the sample rule to the rule group
            client.put_managed_rule_group(
                RuleGroupName=rule_group_id,
                Updates=[
                    {
                        'Action': 'INSERT',
                        'ManagedRuleGroupStatement': {
                            'VendorName': 'AWS',
                            'Name': 'AWSManagedRulesCommonRuleSet',
                            'ExcludedRules': []
                        }
                    },
                    {
                        'Action': 'INSERT',
                        'RuleGroupReferenceStatement': {
                            'ARN': 'arn:aws:wafv2:us-west-2:123456789012:regional/managedrulegroup/AWSManagedRulesCommonRuleSet',
                            'ExcludedRules': []
                        }
                    },
                    {
                        'Action': 'INSERT',
                        'RuleStatement': {
                            'ManagedRuleGroupStatement': {
                                'VendorName': 'AWS',
                                'Name': 'AWSManagedRulesKnownBadInputsRuleSet',
                                'ExcludedRules': []
                            }
                        }
                    },
                    {
                        'Action': 'INSERT',
                        'RuleStatement': {
                            'ManagedRuleGroupStatement': {
                                'VendorName': 'AWS',
                                'Name': 'AWSManagedRulesPHPRuleSet',
                                'ExcludedRules': []
                            }
                        }
                    },
                    {
                        'Action': 'INSERT',
                        'RuleStatement': {
                            'ManagedRuleGroupStatement': {
                                'VendorName': 'AWS',
                                'Name': 'AWSManagedRulesSQLiRuleSet',
                                'ExcludedRules': []
                            }
                        }
                    },
                    {
                        'Action': 'INSERT',
                        'RuleStatement': {
                            'ManagedRuleGroupStatement': {
                                'VendorName': 'AWS',
                                'Name': 'AWSManagedRulesLinuxRuleSet',
                                'ExcludedRules': []
                            }
                        }
                    },
                    {
                        'Action': 'INSERT',
                        'RuleStatement': {
                            'ManagedRuleGroupStatement': {
                                'VendorName': 'AWS',
                                'Name': 'AWSManagedRulesAdminProtectionRuleSet',
                                'ExcludedRules': []
                            }
                        }
                    },
                    {
                        'Action': 'INSERT',
                        'RuleStatement': {
                            'ManagedRuleGroupStatement': {
                                'VendorName': 'AWS',
                                'Name': 'AWSManagedRulesBotControlRuleSet',
                                'ExcludedRules': []
                            }
                        }
                    },
                    {
                        'Action': 'INSERT',
                        'RuleStatement': {
                            'RuleGroupReferenceStatement': {
                                'ARN': rule_group_id,
                                'ExcludedRules': []
                            }
                        }
                    }
                ]
            )
            print(f"Remediated empty rule group: {rule_group_id} by adding a sample rule")
        else:
            print(f"Rule group: {rule_group_id} is not empty")

if __name__ == '__main__':
    remediate_empty_rule_groups()

Run this Python script to check for empty WAF V2 Rule Groups in AWS CloudWatch and remediate them by adding a sample rule to each empty rule group.

This script will add a sample rule to each empty WAF V2 Rule Group in AWS CloudWatch. You can customize the sample rule based on your requirements.

Using Terraform

resource "aws_wafv2_rule_group" "WAFV2_RULE_GROUP" {
  name     = "WAFV2_RULE_GROUP_NAME"        # replace with your rule group name
  scope    = "REGIONAL"                     # or "CLOUDFRONT"
  capacity = 50                             # replace with appropriate capacity

  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name                = "WAFV2_RULE_GROUP_NAME_METRIC" # CloudWatch metric name
    sampled_requests_enabled   = true
  }

  # Add at least one rule so the rule group is not empty.
  # WARNING: This example uses AWSManagedRulesCommonRuleSet. Review and replace
  # with rules appropriate for your application and capacity.
  rule {
    name     = "AWS-AWSManagedRulesCommonRuleSet"
    priority = 1

    statement {
      managed_rule_group_statement {
        vendor_name = "AWS"
        name        = "AWSManagedRulesCommonRuleSet"
      }
    }

    override_action {
      none {}
    }

    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "AWS-AWSManagedRulesCommonRuleSet"
      sampled_requests_enabled   = true
    }
  }
}

Updating an existing empty rule group to add a rule is an in-place update and should not force resource replacement, but it will immediately change WAF behavior for any associated Web ACLs.

Verification with terraform plan should show the existing aws_wafv2_rule_group changing from rules = [] (or no rule blocks) to adding the new rule block and potentially updating visibility_config.metric_name for CloudWatch metrics.

More Info:​

Risk Level​

Address​

Compliance Standards​

Triage and Remediation​

Remediation​