All checks
Medium
Application Load Balancers should be associated with an AWS WAF web ACL
Confirms that Application Load Balancers are associated with an AWS WAF web ACL to protect against web exploits that could affect availability or consume excessive resources. Only the association is read, so an empty web ACL, or one with every rule in count mode, passes; an association made in the retired AWS WAF Classic is not seen and fails.
- service
- ELB
- severity
- Medium
- scope
- evaluated in every region
How to fix it
- Can break clients: A rule in block mode drops every request it matches, legitimate ones included, so run new rules in count mode against real traffic first.
In the console
WAF and Shield → Web ACLs → the web ACL → Associated AWS resources → Add AWS resources
- Resource type
- Application Load Balancer
- Resources
- This load balancer, from a regional web ACL in the same Region
With the AWS CLI
aws wafv2 associate-web-acl --web-acl-arn <web-acl-arn> --resource-arn <load-balancer-arn> --region <region>With Terraform
resource "aws_wafv2_web_acl_association" "this" {
resource_arn = var.load_balancer_arn
web_acl_arn = var.web_acl_arn
}See which of your accounts this check is failing on.
Book a live scan