# Ensure AWS WAF Classic Global Rules Have at Least One Condition

- Source: https://support.icompaas.com/support/solutions/articles/62000233438-ensure-aws-waf-classic-global-rules-have-at-least-one-condition
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS Checks New Version](https://support.icompaas.com/support/solutions/62000112673) › [AWS New Checks](https://support.icompaas.com/support/solutions/folders/62000169206)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Profile Applicability**

-   **Level 2**

#### **Description**

A rule in AWS WAF Classic specifies criteria, called conditions, to filter web requests, such as IP match conditions, size constraints, SQL injection match conditions, and others. Ensuring each rule includes at least one condition helps enforce filtering logic that protects your resources from malicious requests or unauthorized access.

#### **Rationale**

-   Enhanced Security: Defines criteria to filter traffic based on specific conditions.
    
-   Risk Mitigation: Reduces the chance of allowing harmful requests to pass through.
    
-   Compliance: Aligns with industry best practices for web application security.
    

#### **Impact**

**Pros:**

-   Implements security logic to protect web applications.
    
-   Allows targeted filtering of traffic based on specific conditions.
    
-   Improves compliance with security policies.
    

**Cons:**

-   Requires careful design of rules to avoid blocking legitimate traffic.
    
-   Additional configuration and maintenance may be needed for complex conditions.
    

#### **Default Value**

By default, rules may exist without any conditions. Conditions must be explicitly added to define filtering logic.

#### **Pre-Requisite**

IAM Permissions Required:

-   waf:ListRules
    
-   waf:GetRule
    
-   waf:UpdateRule
    
-   AWS CLI installed and configured.
    

#### **Remediation**

**Test Plan:**

**Using AWS Console:**

1.  Sign in to the AWS Management Console.
    
2.  Navigate to AWS WAF Classic > Rules.
    
3.  Select a rule to view its configuration.
    
4.  Verify if the rule includes at least one condition.
    

**Using AWS CLI:**

1.  List all rules:  
    
    aws waf list-rules
    
2.  Retrieve details of a specific rule:  
    
    aws waf get-rule --rule-id <rule-id>
    
3.  Check the Predicates field in the output. Ensure it includes at least one condition.
    

**Implementation Steps:**

**Using AWS Console:**

1.  Navigate to AWS WAF Classic > Rules.  
      ![](https://support.icompaas.com/assets/kb/5943b5c92ddec489.png) ![](https://support.icompaas.com/assets/kb/e6ce13306fa9d0da.png)
    
2.  Select the rule to update.  
    ![](https://support.icompaas.com/assets/kb/28327abb939a0065.png)
    
    ![](https://support.icompaas.com/assets/kb/cc831c17272a30b7.png)
    
3.  Add one or more conditions, such as IP match condition, size constraint, or cross-site scripting condition.  
    ![](https://support.icompaas.com/assets/kb/9c58beea529ff8d2.png)
    
4.  Save the updated rule configuration.
    

**Using AWS CLI:**

1.  Add a condition to the rule:  
    
    aws waf update-rule \\
    --rule-id <rule-id> \\
    --updates Action=INSERT,Predicate={Negated=false,Type=<condition-type>,DataId=<condition-id>}
    

2.  Verify the updated configuration:  
    
    aws waf get-rule --rule-id <rule-id>
    

#### **Backout Plan**

#### **Using AWS Console:**

1.  #### If adding a condition causes issues, sign in to the AWS Management Console.  
    Navigate to AWS WAF & Shield, select the Global rule, and go to the Conditions section.
    
    #### ![](https://support.icompaas.com/assets/kb/155c4bcf35f51e8f.png)  
    ![](https://support.icompaas.com/assets/kb/0ddd92a74ccc7f9c.png)![](https://support.icompaas.com/assets/kb/64aa457293f4cffa.png)
    
2.  #### Remove or modify the condition as needed.
    
    #### ![](https://support.icompaas.com/assets/kb/7c381bb9664726ff.png)
    
3.  #### Save the changes and verify that the rule is functioning correctly.
    

#### **Using AWS CLI:**

1.  #### To remove a condition from the rule, run:  
    
    aws waf update-rule --rule-id <RULE\_ID> --conditions '\[{"Type": "IPMatch", "Data": {"Value": "203.0.113.0/24"}}\]'
    
2.  #### Verify the updated rule:  
    
    aws waf get-rule --rule-id <RULE\_ID>
    

#### **References**

-   [AWS WAF Rules and Conditions Documentation](https://docs.aws.amazon.com/waf/latest/developerguide/web-acl-rules-conditions.html)
    
-   [AWS CLI Command Reference for WAF](https://docs.aws.amazon.com/cli/latest/reference/waf/index.html)
    
-   [Best Practices for AWS WAF Classic](https://aws.amazon.com/answers/networking/aws-waf-best-practices/)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.