# Ensure Application Load Balancer has a WAF ACL attached - Source: https://support.icompaas.com/support/solutions/articles/62000223477-ensure-application-load-balancer-has-a-waf-acl-attached - Section: [Solutions](https://support.icompaas.com/support/solutions) › [Security Controls](https://support.icompaas.com/support/solutions/62000065178) › [AWS Services](https://support.icompaas.com/support/solutions/folders/62000097507) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) ### **Description:** AWS Web Application Firewall (WAF) helps to protect your web applications from common application-layer exploits that can affect the availability or consume excessive resources. AWS Application Load Balancer (ALB) – This load balancing option for the Elastic Load Balancing service runs at the application layer. It allows you to define routing rules that are based on content that can span multiple containers or EC2 instances. Application Load Balancers support HTTP/2 and WebSocket and give you additional visibility into the health of the target containers and instances  ### **Rationale:** WAF allows you to use access control lists (ACLs), rules, and conditions that define acceptable or unacceptable requests or IP addresses. You can selectively allow or deny access to specific parts of your web application and you can also guard against various SQL injection attacks.  If WAF is not attached to ALB it is prone to different attacks. **Impact:** WAF helps to protect applications that are running behind an Application Load Balancer. WAF can protect both internal and external applications and web services. **Default Value** By default, the load balancer is not attached to any WEB ACL **Prerequisites** - Create an Application Load balancer - Create an AWS WAF ACL **Remediation** ### **Test Plan** - Login into the AWS management console. - open the ec2 console [https://ap-south-1.console.aws.amazon.com/ec2/v2/home](https://ap-south-1.console.aws.amazon.com/ec2/v2/home "https://ap-south-1.console.aws.amazon.com/ec2/v2/home") - In the navigation menu choose load balancing. ![](https://support.icompaas.com/assets/kb/48df5358ee2ca12f.png)  - choose the application load balancer of your choice.![](https://support.icompaas.com/assets/kb/42cd9d0028251954.png) - In the Integrated Services option of the load balancer check in the AWS WAF Web ACL configuration to check whether any WAF ACL is attached or not.  ![](https://support.icompaas.com/assets/kb/b454a8afff504d10.png) **Using AWS CLI:** aws wafv2 get-web-acl-for-resource \--resource-arn #### **Implementation Steps:** 1. Sign in to the AWS Management Console and open the AWS WAF console at [https://console.aws.amazon.com/wafv2/](https://console.aws.amazon.com/wafv2/ "https://console.aws.amazon.com/wafv2/"). 2. Click on Create Web ACL![](https://support.icompaas.com/assets/kb/b65f0f910b50a14e.png) 3. Click on **the Associated AWS resources** tab![](https://support.icompaas.com/assets/kb/ebb3add4d610c747.png) 4.  Click on **Add AWS resources![](https://support.icompaas.com/assets/kb/d3062605c5ef8f4e.png)** 5. **Click on When prompted, choose the resource that you want to associate this web ACL with. If you choose an Amazon API Gateway REST API, an Application Load Balancer, or an AWS AppSync,  specify a Region. ![](https://support.icompaas.com/assets/kb/b2c0477e80b689ce.png)**  6. **Click on Application Load Balancer which is already Created**  7. **Click on Add.![](https://support.icompaas.com/assets/kb/50825b4772dedb84.png)**   **Using AWS CLI:** **To associate the web ACL** aws waf-regional associate-web-acl \--web-acl-arn \--resource-arn **Backout Plan:** 1. Sign in to the AWS Management Console and open the AWS WAF console at [https://console.aws.amazon.com/wafv2/](https://console.aws.amazon.com/wafv2/ "https://console.aws.amazon.com/wafv2/"). 2. In the navigation pane, choose **Web ACLs**. 3. Choose the web ACL that you want to disassociate from your resource. 4. On the **Associated AWS resources** tab, deselect the resources that you want to disassociate this web ACL from.![](https://support.icompaas.com/assets/kb/4840f46ca0fc8738.png) 5. Choose **Save**.  **Using AWS CLI:** **To Disassociate the services**  aws wafv2 disassociate-web-acl \\ --resource-arn \\ --region ### **References:** [https://aws.amazon.com/blogs/aws/aws-web-application-firewall-waf-for-application-load-balancers/](https://aws.amazon.com/blogs/aws/aws-web-application-firewall-waf-for-application-load-balancers/) [https://docs.aws.amazon.com/cli/latest/reference/wafv2/get-web-acl-for-resource.html](https://docs.aws.amazon.com/cli/latest/reference/wafv2/get-web-acl-for-resource.html) [](https://docs.aws.amazon.com/cli/latest/reference/wafv2/get-web-acl-for-resource.html) ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.