Skip to main content

πŸ›‘οΈ AWS WAF Rule Group has no WAF Rules🟒

Logic​

Similar Policies​

Description​

Open File

Description​

This policy identifies AWS WAF rule groups that contain zero rules. Rule groups are reusable collections of WAF rules that you attach to Web ACLs to standardize request inspection across applications and environments. An empty rule group performs no inspection or filtering and therefore provides no protection.

Rationale​

An empty rule group usually indicates an incomplete or abandoned configuration. Retaining unused resources increases configuration drift and can create a false sense of coverage if engineers assume the rule group is active. It also adds operational overhead during reviews and audits.

Audit​

This policy flags an AWS WAF Rule Group as INCOMPLIANT if it does not have any associated AWS WAF Rules.

Remediation​

Open File

Remediation​

Add Rules to the Rule Group​

A rule group must contain at least one rule to inspect or filter requests. If the rule group is empty, add rules that define how AWS WAF evaluates requests and applies actions.

Before applying changes to rule groups that are currently in use, validate changes in a staging environment. Then test the updated rules in count mode against production traffic before enforcing actions.

From Console​

  1. Select the rule group you want to edit. If the rule group is not visible, check the Region setting. For rule groups used with Amazon CloudFront, select the Global (CloudFront) Region.
  2. On the rule group page, choose Edit to modify its configuration.
  3. Add one or more rules with match conditions such as IP sets, string matches, or rate-based filters, and specify the desired action (Allow, Block, or Count).
  4. Save the configuration. The console applies your updates to any Web ACLs using the rule group.
  5. If you rename a rule and want the metric name to reflect the change, update the metric name manually in the rule JSON editor. AWS WAF does not automatically synchronize metric names with rule names.

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
πŸ’Ό AWS Foundational Security Best Practices v1.0.0 β†’ πŸ’Ό [WAF.3] AWS WAF Classic Regional rule groups should have at least one rule1no data
πŸ’Ό AWS Foundational Security Best Practices v1.0.0 β†’ πŸ’Ό [WAF.7] AWS WAF Classic global rule groups should have at least one rule1no data
πŸ’Ό AWS Well-Architected β†’ πŸ’Ό SEC05-BP03 Implement inspection-based protection3no data
πŸ’Ό Cloudaware Framework β†’ πŸ’Ό Threat Protection31no data
πŸ’Ό FedRAMP High Security Controls β†’ πŸ’Ό AC-4(21) Physical or Logical Separation of Information Flows (M)(H)1163no data
πŸ’Ό FedRAMP High Security Controls β†’ πŸ’Ό CM-2 Baseline Configuration (L)(M)(H)3147no data
πŸ’Ό FedRAMP High Security Controls β†’ πŸ’Ό SC-7 Boundary Protection (L)(M)(H)10884no data
πŸ’Ό FedRAMP High Security Controls β†’ πŸ’Ό SC-7(21) Isolation of System Components (H)37no data
πŸ’Ό FedRAMP Low Security Controls β†’ πŸ’Ό CM-2 Baseline Configuration (L)(M)(H)45no data
πŸ’Ό FedRAMP Low Security Controls β†’ πŸ’Ό SC-7 Boundary Protection (L)(M)(H)49no data
πŸ’Ό FedRAMP Moderate Security Controls β†’ πŸ’Ό AC-4(21) Physical or Logical Separation of Information Flows (M)(H)63no data
πŸ’Ό FedRAMP Moderate Security Controls β†’ πŸ’Ό CM-2 Baseline Configuration (L)(M)(H)347no data
πŸ’Ό FedRAMP Moderate Security Controls β†’ πŸ’Ό SC-7 Boundary Protection (L)(M)(H)768no data
πŸ’Ό NIST CSF v2.0 β†’ πŸ’Ό DE.CM-01: Networks and network services are monitored to find potentially adverse events180no data
πŸ’Ό NIST CSF v2.0 β†’ πŸ’Ό PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected187no data
πŸ’Ό NIST CSF v2.0 β†’ πŸ’Ό PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected160no data
πŸ’Ό NIST CSF v2.0 β†’ πŸ’Ό PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected184no data
πŸ’Ό NIST CSF v2.0 β†’ πŸ’Ό PR.IR-01: Networks and environments are protected from unauthorized logical access and usage123no data
πŸ’Ό NIST SP 800-53 Revision 5 β†’ πŸ’Ό AC-4(21) Information Flow Enforcement _ Physical or Logical Separation of Information Flows3763no data
πŸ’Ό NIST SP 800-53 Revision 5 β†’ πŸ’Ό CA-9(1) Internal System Connections _ Compliance Checks54no data
πŸ’Ό NIST SP 800-53 Revision 5 β†’ πŸ’Ό CM-2 Baseline Configuration746no data
πŸ’Ό NIST SP 800-53 Revision 5 β†’ πŸ’Ό SC-7 Boundary Protection29493no data
πŸ’Ό NIST SP 800-53 Revision 5 β†’ πŸ’Ό SC-7(11) Boundary Protection _ Restrict Incoming Communications Traffic37no data
πŸ’Ό NIST SP 800-53 Revision 5 β†’ πŸ’Ό SC-7(16) Boundary Protection _ Prevent Discovery of System Components37no data
πŸ’Ό NIST SP 800-53 Revision 5 β†’ πŸ’Ό SC-7(21) Boundary Protection _ Isolation of System Components37no data