> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# FMS Policy Owner Specifies WebACLId

### More Info:

Checks if the web ACL is associated with an Application Load Balancer, API Gateway stage, or Amazon CloudFront distributions. When AWS Firewall Manager creates this rule, the FMS policy owner specifies the WebACLId in the FMS policy and can optionally enable remediation.

### Risk Level

Medium

### Address

Security

### Compliance Standards

CBP

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration where FMS Policy Owner Specifies WebACLId for an AWS Elastic Load Balancer using the AWS console, follow these step-by-step instructions:

        1. **Login to AWS Console**: Go to the AWS Management Console ([https://aws.amazon.com/console/](https://aws.amazon.com/console/)) and login with your credentials.

        2. **Navigate to AWS WAF & Shield**: In the AWS Management Console, navigate to the AWS WAF & Shield service by typing "WAF" in the search bar and selecting the "AWS WAF & Shield" service.

        3. **Select the Web ACL**: In the AWS WAF & Shield dashboard, select the Web ACL that is associated with the FMS Policy Owner Specifies WebACLId misconfiguration.

        4. **Remove Web ACL from FMS Policy**: Find the option to remove the Web ACL from the FMS Policy Owner in the Web ACL settings. This will ensure that the FMS Policy Owner no longer specifies the WebACLId for the Elastic Load Balancer.

        5. **Save Changes**: Once you have removed the Web ACL from the FMS Policy Owner, save the changes to update the configuration.

        6. **Verify Configuration**: Verify that the Web ACL is no longer specified by the FMS Policy Owner for the Elastic Load Balancer. You can do this by checking the configuration settings or testing the Elastic Load Balancer to ensure it is functioning correctly.

        By following these steps, you should be able to successfully remediate the misconfiguration where the FMS Policy Owner Specifies WebACLId for an AWS Elastic Load Balancer using the AWS console.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration where the FMS Policy Owner Specifies WebACLId for an AWS Elastic Load Balancer using AWS CLI, you can follow these steps:

        1. **Identify the FMS Policy Owner**: First, identify the FMS Policy Owner who has specified the WebACLId for the Elastic Load Balancer.

        2. **Revoke Permissions**: The FMS Policy Owner needs to revoke the permission to specify the WebACLId for the Elastic Load Balancer. This can be done by updating the FMS policy or removing the specific permission from the IAM policy attached to the FMS Policy Owner.

        3. **Update WebACLId for the Elastic Load Balancer**: If the WebACLId specified by the FMS Policy Owner is incorrect or causing issues, you can update the WebACLId for the Elastic Load Balancer. Use the following AWS CLI command to update the WebACLId for the Elastic Load Balancer:

           ```bash theme={null}
           aws elbv2 modify-load-balancer-attributes --load-balancer-arn <your-load-balancer-arn> --attributes Key=aws.wafv2.webacl,Value=<new-webacl-id>
           ```

           Replace `<your-load-balancer-arn>` with the ARN of your Elastic Load Balancer and `<new-webacl-id>` with the correct WebACLId that you want to associate with the Elastic Load Balancer.

        4. **Verify the Changes**: After updating the WebACLId for the Elastic Load Balancer, verify the changes by checking the attributes of the Elastic Load Balancer using the following AWS CLI command:

           ```bash theme={null}
           aws elbv2 describe-load-balancer-attributes --load-balancer-arn <your-load-balancer-arn>
           ```

           Ensure that the correct WebACLId is now associated with the Elastic Load Balancer.

        By following these steps, you can remediate the misconfiguration where the FMS Policy Owner Specifies WebACLId for an AWS Elastic Load Balancer using AWS CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration where the FMS Policy Owner Specifies WebACLId for AWS Elastic Load Balancer using Python, you can follow these steps:

        1. **Identify the Misconfiguration**: Check the AWS WAF WebACL associated with the Elastic Load Balancer to ensure that the FMS Policy Owner does not specify a specific WebACLId.

        2. **Update the WebACL**: Use the AWS SDK for Python (Boto3) to update the WebACL associated with the Elastic Load Balancer. You can remove the FMS Policy Owner's specified WebACLId and revert to the default WebACL or a more appropriate one.

        3. **Install Boto3**: If you haven't already, install the Boto3 library by running the following command:
           ```
           pip install boto3
           ```

        4. **Python Script to Remediate**:
           Here is a sample Python script that demonstrates how to update the WebACL associated with an Elastic Load Balancer:
           ```python theme={null}
           import boto3

           elb_client = boto3.client('elbv2')

           # Specify the ARN of the Elastic Load Balancer
           elb_arn = 'YOUR_ELB_ARN_HERE'

           # Specify the ARN of the desired WebACL
           web_acl_arn = 'YOUR_WEBACL_ARN_HERE'

           # Update the WebACL associated with the Elastic Load Balancer
           response = elb_client.modify_load_balancer_attributes(
               LoadBalancerArn=elb_arn,
               Attributes=[
                   {
                       'Key': 'aws:waf:webacl',
                       'Value': web_acl_arn
                   }
               ]
           )

           print('WebACL updated successfully.')
           ```

        5. **Replace the placeholders**:
           * Replace `YOUR_ELB_ARN_HERE` with the ARN of your Elastic Load Balancer.
           * Replace `YOUR_WEBACL_ARN_HERE` with the ARN of the desired WebACL that you want to associate with the Elastic Load Balancer.

        6. **Run the Script**: Execute the Python script to update the WebACL associated with the Elastic Load Balancer. This will remediate the misconfiguration where the FMS Policy Owner Specifies WebACLId.

        By following these steps and running the Python script, you can successfully remediate the misconfiguration for an AWS Elastic Load Balancer where the FMS Policy Owner Specifies WebACLId.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>