AWS WAF web ACLs should have at least one rule or rule group

How to fix it

• Can break clients: Rules that block from the start can refuse legitimate requests; run new rules in Count and read their metrics before letting them block.

In the console

AWS WAF → Web ACLs → the scope and Region → the web ACL → Rules

Add managed rule groups

AWS managed rule groups, Core rule set (AWSManagedRulesCommonRuleSet, 700 WCUs), or rules of your own

Override all rule actions

Count to start; Remove all overrides once its metrics show no legitimate requests matching

With the AWS CLI

• Overwrites existing settings: update-web-acl replaces the whole web ACL: run get-web-acl first and resend its default action and every other setting, or the ones you leave out are reset.

aws wafv2 update-web-acl --name <name> --scope REGIONAL --id <web-acl-id> --lock-token <lock-token> --default-action file://default-action.json --visibility-config file://visibility-config.json --rules file://rules.json --region <region>

With Terraform

resource "aws_wafv2_web_acl" "this" {
  name  = var.name
  scope = "REGIONAL"

  default_action {
    allow {}
  }

  rule {
    name     = "aws-common-rule-set"
    priority = 1

    override_action {
      none {}
    }

    statement {
      managed_rule_group_statement {
        name        = "AWSManagedRulesCommonRuleSet"
        vendor_name = "AWS"
      }
    }

    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "aws-common-rule-set"
      sampled_requests_enabled   = true
    }
  }

  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name                = var.name
    sampled_requests_enabled   = true
  }
}