AWS WAF Classic global rules should have at least one condition

How to fix it

Attach at least one condition to the WAF Classic global rule, so its allow, block or count action applies to traffic the rule matched. The condition is a separate Classic object, an IP set, a string or regex match, a size constraint, a SQL injection or cross-site scripting match, or a geo match, and has to exist before it can be attached to the rule as a predicate.

In the console

AWS WAF Classic → Global (CloudFront) → Rules → the rule → Conditions

With the AWS CLI

aws waf update-rule --rule-id <rule-id> --change-token <change-token> --updates '[{"Action":"INSERT","Predicate":{"Negated":false,"Type":"IPMatch","DataId":"<condition-id>"}}]' --region us-east-1

With Terraform

resource "aws_waf_rule" "this" {
  name        = var.name
  metric_name = var.metric_name

  predicates {
    data_id = var.condition_id
    negated = false
    type    = "IPMatch"
  }
}