All checks
Low
AWS WAF web ACL logging should be enabled
Checks that logging is enabled for the AWS WAF web ACL (WAFv2, regional or CloudFront scope). Logs record each request the web ACL inspects and the rule that acted on it, so you can troubleshoot blocked traffic and investigate attacks. Logging set up only through Amazon Security Lake does not count.
- service
- WAF
- severity
- Low
- scope
- evaluated in every region
How to fix it
In the console
AWS WAF → Web ACLs → the scope and Region → the web ACL → Logging and metrics
- Logging destination type
- CloudWatch Logs log group or Firehose stream in the web ACL's Region (us-east-1 for CloudFront), or an S3 bucket
- Logging destination
- One created beforehand in this account, with a name that starts with aws-waf-logs-
With the AWS CLI
aws wafv2 put-logging-configuration --logging-configuration '{"ResourceArn":"<web-acl-arn>","LogDestinationConfigs":["<log-destination-arn>"]}' --region <region>With Terraform
resource "aws_wafv2_web_acl_logging_configuration" "this" {
resource_arn = var.web_acl_arn
log_destination_configs = [var.log_destination_arn]
}See which of your accounts this check is failing on.
Book a live scan