AWS WAF Classic Regional rules should have at least one condition

How to fix it

• Can break clients: If a web ACL uses this rule with Block, matching requests are blocked as soon as the update is saved; set the rule to Count there first and read its metrics.

In the console

AWS WAF Classic → the Region → Rules → the rule → Conditions

When a request does/does not

does, unless the rule should act on requests that do not match

match/originate from

The condition type: IP, geo, string, regex, size constraint, SQL injection or cross-site scripting match

Condition name

One created beforehand in this Region; a request must match every condition on the rule

With the AWS CLI

aws waf-regional update-rule --rule-id <rule-id> --change-token <change-token> --updates '[{"Action":"INSERT","Predicate":{"Negated":false,"Type":"IPMatch","DataId":"<condition-id>"}}]' --region <region>

With Terraform

resource "aws_wafregional_rule" "this" {
  name        = var.name
  metric_name = var.metric_name

  predicate {
    data_id = var.condition_id
    negated = false
    type    = "IPMatch"
  }
}