AWS WAF rules should have CloudWatch metrics enabled

How to fix it

• Overwrites existing settings: The CLI call and the Terraform resource replace the whole rule group: include every rule get-rule-group lists, each with metrics on, or the rules you leave out are deleted.

In the console

AWS WAF → Rule groups → the scope and Region → the rule group → Visibility configuration

Rule group VisibilityConfig.CloudWatchMetricsEnabled

true

Each rule's VisibilityConfig.CloudWatchMetricsEnabled

true on every rule; in the console, set it in each rule's JSON editor

With the AWS CLI

aws wafv2 update-rule-group --name <name> --scope REGIONAL --id <rule-group-id> --lock-token <lock-token> --visibility-config '{"SampledRequestsEnabled":true,"CloudWatchMetricsEnabled":true,"MetricName":"<metric-name>"}' --rules file://rules.json --region <region>

With Terraform

resource "aws_wafv2_rule_group" "this" {
  name     = var.name
  capacity = var.capacity
  scope    = "REGIONAL"

  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name                = var.metric_name
    sampled_requests_enabled   = true
  }
}