# Ensure AWS WAF Classic Global WebACL Has at Least One Rule or Rule Group

- Source: https://support.icompaas.com/support/solutions/articles/62000233432-ensure-aws-waf-classic-global-webacl-has-at-least-one-rule-or-rule-group
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS Checks New Version](https://support.icompaas.com/support/solutions/62000112673) › [AWS New Checks](https://support.icompaas.com/support/solutions/folders/62000169206)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Profile Applicability**

-   **Level 2**

#### **Description**

A Web Access Control List (WebACL) in AWS WAF Classic is used to define rules or rule groups that filter and control web traffic to your resources. Ensuring that a WebACL has at least one rule or rule group is critical for protecting your applications from malicious requests, such as SQL injection or cross-site scripting (XSS) attacks.

#### **Rationale**

-   Enhanced Security: Protects web applications by filtering malicious traffic.
    
-   Risk Mitigation: Reduces the risk of vulnerabilities being exploited.
    
-   Compliance: Aligns with security best practices for web application protection.
    

#### **Impact**

**Pros:**

-   Provides a layer of security for web applications.
    
-   Blocks or allows traffic based on defined rules or rule groups.
    
-   Improves compliance with security standards.
    

**Cons:**

-   Requires proper configuration and maintenance of rules or rule groups.
    
-   May introduce complexity if rules are not well-defined.
    

#### **Default Value**

By default, a WebACL may not have any rules or rule groups. Rules or rule groups must be explicitly added during or after WebACL creation.

#### **Pre-Requisite**

IAM Permissions Required:

-   waf:ListWebACLs
    
-   waf:GetWebACL
    
-   waf:UpdateWebACL
    
-   AWS CLI installed and configured.
    

#### **Remediation**

**Test Plan:**

**Using AWS Console:**

1.  Sign in to the AWS Management Console.
    
2.  Navigate to AWS WAF Classic > WebACLs.
    
3.  Select the WebACL to review its configuration.
    
4.  Verify if at least one rule or rule group is associated with the WebACL.
    

**Using AWS CLI:**

1.  List all WebACLs:  
    
    aws waf list-web-acls
    
2.  Retrieve the details of a specific WebACL:  
    
    aws waf get-web-acl --web-acl-id <web-acl-id>
    
3.  Check the Rules field in the output. Ensure it contains at least one rule or rule group.
    

**Implementation Plan:**

**Using AWS Console:**

1.  Open the AWS WAF & Shield Console and navigate to WebACLs.  
      ![](https://support.icompaas.com/assets/kb/06550b3882878bc2.png) ![](https://support.icompaas.com/assets/kb/45441429ffa78152.png)
    
2.  Select the Global WebACL that you want to configure.  
    ![](https://support.icompaas.com/assets/kb/1b607c73dcfdb290.png)
    
3.  Under the Rules section, ensure that at least one rule or rule group is added.  
    ![](https://support.icompaas.com/assets/kb/8d240251c5c22540.png)
    
4.  If no rules are present, click Edit and either add an individual rule or choose a Rule Group to include.
    
5.  Save the changes and verify that the WebACL now contains at least one rule or rule group.
    

**Using AWS CLI:**

2.  To add a rule or rule group to an existing WebACL, run:  
    
    aws waf update-web-acl --web-acl-id <WEB\_ACL\_ID> --add-rules '\[
    
      {
        "Action": "ALLOW",
        "Priority": 1,
        "RuleId": "<RULE\_ID>"
      }
    
    \]'
    
3.  Verify that the WebACL now contains at least one rule:  
    
    aws waf get-web-acl --web-acl-id <WEB\_ACL\_ID>
    
      
    

**Backout Plan:**

**Using AWS Console:**

1.  If the configuration causes issues, sign in to the AWS Management Console.  
    
2.  Navigate to AWS WAF & Shield, select the Global WebACL, and remove or modify the rule.  
    ![](https://support.icompaas.com/assets/kb/eac211b31aa2df09.png)  
      
    ![](https://support.icompaas.com/assets/kb/7ef4587fdb0bb795.png)![](https://support.icompaas.com/assets/kb/20f18513dc1e6a18.png)
    
    ![](https://support.icompaas.com/assets/kb/11dacdd40d290a78.png)
    
3.  Save the changes and verify that the WebACL now functions as intended.  
    

**Using AWS CLI:**

1.  To remove a rule from a WebACL, run:  
    
    aws waf update-web-acl --web-acl-id <WEB\_ACL\_ID> --remove-rules '\[
      {
        "RuleId": "<RULE\_ID>"
      }
    \]'
    

2.  Verify that the rule has been removed:  
    
    aws waf get-web-acl --web-acl-id <WEB\_ACL\_ID>
    

**Reference:**

-   [AWS WAF Classic: WebACLs](https://docs.aws.amazon.com/waf/latest/developerguide/web-acl.html)
    
-   [AWS CLI: list-web-acls](https://docs.aws.amazon.com/cli/latest/reference/waf/list-web-acls.html)
    
-   [AWS CLI: get-web-acl](https://docs.aws.amazon.com/cli/latest/reference/waf/get-web-acl.html)
    
-   [AWS CLI: update-web-acl  
    ](https://docs.aws.amazon.com/cli/latest/reference/waf/update-web-acl.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.