AWS WAF Classic Global Web ACL logging should be enabled

How to fix it

• Affects another check: Migrating to AWS WAF instead leaves logging off on the new web ACL, so WAF.11 fails there until you enable it.

In the console

AWS WAF Classic → Global (CloudFront) → Web ACLs → the web ACL → Logging

Kinesis Data Firehose

A stream created beforehand in us-east-1 (US East, N. Virginia), with a name that starts with aws-waf-logs-

Source (on the Firehose stream)

Direct PUT, not a Kinesis data stream

With the AWS CLI

aws waf put-logging-configuration --logging-configuration '{"ResourceArn":"<web-acl-arn>","LogDestinationConfigs":["<firehose-delivery-stream-arn>"]}' --region us-east-1

With Terraform

resource "aws_waf_web_acl" "this" {
  name        = var.name
  metric_name = var.metric_name

  default_action {
    type = "ALLOW"
  }

  logging_configuration {
    log_destination = var.firehose_delivery_stream_arn
  }
}