# Ensure API Gateway has a WAF ACL attached - Source: https://support.icompaas.com/support/solutions/articles/a_1793292187059353-ensure-api-gateway-has-a-waf-acl-attached - Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224) - Last updated: 2026-10-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **Description** Ensure that every stage of each Amazon API Gateway REST API has an AWS WAF web ACL associated with it. The web ACL inspects incoming requests and blocks or allows them based on the rules it contains, before they reach the API. **Rationale** Without a web ACL, an API is exposed to application-layer attacks such as SQL injection, cross-site scripting, parameter tampering, bot abuse and request floods. These attacks can lead to data exposure, unauthorized changes and loss of availability, and APIs with public endpoints are at the highest risk. Associating a web ACL that uses AWS managed rule groups, rate-based rules and tailored allow or deny lists adds a layer of defense in front of the API. **Impact** - Filters malicious requests before they reach the API and its backend - Allows rate limiting of abusive clients - Rules that are too strict may block legitimate requests, so new rules should be tested (for example in **Count** mode) before they block traffic - AWS WAF is charged per web ACL, per rule and per request inspected **Default Value** API Gateway stages have no AWS WAF web ACL associated by default. **Pre-Requisites** - IAM permissions: apigateway:GET, wafv2:ListWebACLs, wafv2:GetWebACLForResource, wafv2:AssociateWebACL, wafv2:DisassociateWebACL and apigateway:SetWebACL - A web ACL with scope **Regional** in the same region as the API, or permission to create one (wafv2:CreateWebACL) - Agreement with the application owner on the rules to apply **Remediation** **Test Plan** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the API Gateway console and select a REST API. 3. Select **Stages** and select a stage. 4. In **Stage details**, check the **Web ACL** value. 5. Repeat for each stage of each REST API in each region in use. 6. If no web ACL is associated with a stage, follow the implementation steps. **CLI:** List the stages of an API and their associated web ACL: aws apigateway get-stages --region --rest-api-id --query "item\[\].\[stageName,webAclArn\]" --output table A stage fails if webAclArn is empty (shown as None). **Implementation Steps** **Console:** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the AWS WAF console and select **Web ACLs**. 3. Select the region of the API and choose the web ACL to use (or create a Regional web ACL with the required rules). 4. Open the **Associated AWS resources** tab and choose **Add AWS resources**. 5. Select **Amazon API Gateway REST API** as the resource type, then select the API stage. 6. Choose **Add**. 7. Repeat for each stage of each REST API in each region in use. **CLI:** Associate the web ACL with the API stage: aws wafv2 associate-web-acl --region --web-acl-arn --resource-arn arn:aws:apigateway:::/restapis//stages/ **Backout Plan** 1. Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/). 2. Open the AWS WAF console, select **Web ACLs** and select the region of the API. 3. Select the web ACL and open the **Associated AWS resources** tab. 4. Select the API stage and choose **Disassociate**. **CLI:** aws wafv2 disassociate-web-acl --region --resource-arn arn:aws:apigateway:::/restapis//stages/ Note: rolling back removes the WAF protection from the API stage. If legitimate requests are being blocked, consider switching the affected rule to **Count** mode instead. **Reference** - [https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-control-access-aws-waf.html](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-control-access-aws-waf.html) - [https://docs.aws.amazon.com/apigateway/latest/developerguide/security-monitoring.html](https://docs.aws.amazon.com/apigateway/latest/developerguide/security-monitoring.html) - [https://docs.aws.amazon.com/waf/latest/developerguide/web-acl-associating-aws-resource.html](https://docs.aws.amazon.com/waf/latest/developerguide/web-acl-associating-aws-resource.html) - [https://docs.aws.amazon.com/cli/latest/reference/wafv2/associate-web-acl.html](https://docs.aws.amazon.com/cli/latest/reference/wafv2/associate-web-acl.html) ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.