API Gateway should be associated with a WAF Web ACL

How to fix it

• Can break clients: A rule in block mode drops every request it matches, legitimate ones included, so run new rules in count mode against real traffic first.

In the console

API Gateway → APIs → the REST API → Stages → the stage → Stage details

Web application firewall (AWS WAF)

An AWS WAF web ACL for a Regional application, in the same Region as the API

With the AWS CLI

aws wafv2 associate-web-acl --web-acl-arn <web-acl-arn> --resource-arn arn:aws:apigateway:<region>::/restapis/<rest-api-id>/stages/<stage-name> --region <region>

With Terraform

resource "aws_wafv2_web_acl_association" "this" {
  resource_arn = var.stage_arn
  web_acl_arn  = var.web_acl_arn
}