# Ensure AWS WAF Classic Regional WebACL Has at Least One Rule or Rule Group

- Source: https://support.icompaas.com/support/solutions/articles/62000233439-ensure-aws-waf-classic-regional-webacl-has-at-least-one-rule-or-rule-group
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS Checks New Version](https://support.icompaas.com/support/solutions/62000112673) › [AWS New Checks](https://support.icompaas.com/support/solutions/folders/62000169206)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Profile Applicability**

-   **Level 2**

#### **Description**

A Web Access Control List (WebACL) in AWS WAF Classic is used to define rules that filter and control web traffic to your resources. Ensuring that a WebACL has at least one rule or rule group helps protect your applications from malicious requests, such as SQL injection or cross-site scripting (XSS) attacks.

#### **Rationale**

-   Enhanced Security: Protects web applications by filtering malicious traffic.
    
-   Risk Mitigation: Reduces the risk of vulnerabilities being exploited.
    
-   Compliance: Aligns with security best practices for web application protection.
    

#### **Impact**

**Pros:**

-   Provides a layer of security for web applications.
    
-   Blocks or allows traffic based on defined rules.
    
-   Improves compliance with security standards.
    

**Cons:**

-   Requires proper configuration and maintenance of rules.
    
-   May introduce complexity if rules are not well-defined.
    

#### **Default Value**

By default, a WebACL may not have any rules or rule groups. Rules must be explicitly added during or after WebACL creation.

#### **Pre-Requisite**

IAM Permissions Required:

-   waf:ListWebACLs
    
-   waf:GetWebACL
    
-   waf:UpdateWebACL
    
-   AWS CLI installed and configured.
    

#### **Remediation**

**Test Plan:**

**Using AWS Console:**

1.  Sign in to the AWS Management Console.
    
2.  Navigate to AWS WAF Classic > WebACLs.
    
3.  Select the WebACL to review its configuration.
    
4.  Verify if at least one rule or rule group is associated with the WebACL.
    

**Using AWS CLI:**

1.  List all WebACLs:  
    
    aws waf list-web-acls
    
2.  Retrieve the details of a specific WebACL  
    
    aws waf get-web-acl --web-acl-id <web-acl-id>
    
3.  Check the Rules field in the output. Ensure it contains at least one rule or rule group.
    

**Implementation Steps:**

**Using AWS Console:**

1.  Navigate to AWS WAF Classic > WebACLs.  
     ![](https://support.icompaas.com/assets/kb/a50d25e5b2217ee2.png) ![](https://support.icompaas.com/assets/kb/65e267cc7a8c69ba.png)
    
2.  Select the WebACL to update.  
    ![](https://support.icompaas.com/assets/kb/9cc057272f6b9e06.png)
    
3.  Add a rule or rule group to the WebACL by specifying the desired conditions (e.g., IP match, string match, or regex match).  
    ![](https://support.icompaas.com/assets/kb/134c2d6b11b28418.png)
    
4.  Save the changes.
    

**Using AWS CLI:**

1.  Add a rule to the WebACL:  
    
    aws waf update-web-acl \\
    --web-acl-id <web-acl-id> \\
    --updates Action=INSERT,ActivatedRule={Priority=1,RuleId=<rule-id>,Action={Type=BLOCK}}
    

2.  Verify the updated configuration:  
    
    aws waf get-web-acl --web-acl-id <web-acl-id>
    

#### **Backout Plan**

#### **Using AWS Console:**

1.  #### If adding a rule or rule group causes issues, sign in to the AWS Management Console.  
    
2.  #### Navigate to AWS WAF & Shield, select the Regional WebACL, and go to the Rules section.  
    ![](https://support.icompaas.com/assets/kb/8232d5aba45b5b22.png)  
    ![](https://support.icompaas.com/assets/kb/b79596663f1e1a0f.png)
    
    ![](https://support.icompaas.com/assets/kb/cbeadf8f889f3acd.png)
    
3.  #### Remove or modify the rule as necessary.
    
    #### ![](https://support.icompaas.com/assets/kb/daca619acf3004b9.png)
    
4.  #### Save the changes and verify that the WebACL is functioning correctly.
    

#### **Using AWS CLI:**

1.  #### To remove a rule from the Regional WebACL, run:  
    
    aws waf update-web-acl --web-acl-id <WEB\_ACL\_ID> --remove-rules '\[
      {
        "RuleId": "<RULE\_ID>"
      }
    \]'
    

2.  #### Verify that the rule has been removed:  
    
    aws waf get-web-acl --web-acl-id <WEB\_ACL\_ID>
    

#### **References**

-   [Using WebACLs in AWS WAF](https://docs.aws.amazon.com/waf/latest/developerguide/web-acl.html)
    
-   [AWS WAF Rule Groups Documentation](https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-groups.html)
    
-   [AWS WAF Developer Guide](https://docs.aws.amazon.com/waf/latest/developerguide/web-acl-processing.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.