AWS WAF Classic Regional web ACLs should have at least one rule or rule group

How to fix it

• Can break clients: A rule added with Block can refuse legitimate requests as soon as the change is saved; add it with Count, read its metrics, then switch it to Block.

In the console

AWS WAF Classic → the Region → Web ACLs → the web ACL → Rules

Add rule to web ACL

An existing rule or rule group in this Region that has at least one condition or rule

Action

Count first, then Block or Allow; for a rule group, No override

With the AWS CLI

aws waf-regional update-web-acl --web-acl-id <web-acl-id> --change-token <change-token> --updates '[{"Action":"INSERT","ActivatedRule":{"Priority":1,"RuleId":"<rule-id>","Action":{"Type":"BLOCK"},"Type":"REGULAR"}}]' --region <region>

With Terraform

resource "aws_wafregional_web_acl" "this" {
  name        = var.name
  metric_name = var.metric_name

  default_action {
    type = "ALLOW"
  }

  rule {
    priority = 1
    rule_id  = var.rule_id
    type     = "REGULAR"

    action {
      type = "BLOCK"
    }
  }
}