AWS WAF Classic global rule groups should have at least one rule

How to fix it

• Can break clients: Where a web ACL uses this group, a rule added with Block blocks matching requests as soon as the update is saved; add it with Count first and read its metrics.

In the console

AWS WAF Classic → Global (CloudFront) → Rule groups → the rule group → Rules

Add rule to rule group

An existing rule with at least one condition; rate-based rules cannot be added

Action

Block or Allow as intended, with Count first to see what the rule matches

With the AWS CLI

aws waf update-rule-group --rule-group-id <rule-group-id> --change-token <change-token> --updates '[{"Action":"INSERT","ActivatedRule":{"Priority":1,"RuleId":"<rule-id>","Action":{"Type":"BLOCK"},"Type":"REGULAR"}}]' --region us-east-1

With Terraform

resource "aws_waf_rule_group" "this" {
  name        = var.name
  metric_name = var.metric_name

  activated_rule {
    priority = 1
    rule_id  = var.rule_id

    action {
      type = "BLOCK"
    }
  }
}