AWS WAF Classic global rule groups should have at least one rule

How to fix it

Activate at least one rule in the WAF Classic global rule group. The rule has to exist first as its own Classic rule with its own conditions, so create it before the update; each activation carries a priority setting the order it runs in and an action of allow, block or count. Rule groups subscribed from AWS Marketplace are managed by their vendor and are not yours to edit.

In the console

AWS WAF Classic → Global (CloudFront) → Rule groups → the rule group → Rules

With the AWS CLI

aws waf update-rule-group --rule-group-id <rule-group-id> --change-token <change-token> --updates '[{"Action":"INSERT","ActivatedRule":{"Priority":1,"RuleId":"<rule-id>","Action":{"Type":"BLOCK"},"Type":"REGULAR"}}]' --region us-east-1

With Terraform

resource "aws_waf_rule_group" "this" {
  name        = var.name
  metric_name = var.metric_name

  activated_rule {
    priority = 1
    rule_id  = var.rule_id

    action {
      type = "BLOCK"
    }
  }
}