AWS WAF Classic Global Web ACL logging should be enabled

How to fix it

Point the WAF Classic global web ACL at a logging destination. Classic accepts exactly one kind: an Amazon Data Firehose delivery stream in the same account, in US East (N. Virginia) where a global web ACL is managed, whose name starts with the prefix aws-waf-logs-, which AWS enforces. The stream has to exist first. Logging is not retroactive; it records from the moment it is attached.

In the console

AWS WAF Classic → Global (CloudFront) → Web ACLs → the web ACL → Logging

With the AWS CLI

aws waf put-logging-configuration --logging-configuration '{"ResourceArn":"<web-acl-arn>","LogDestinationConfigs":["<firehose-delivery-stream-arn>"]}' --region us-east-1

With Terraform

resource "aws_waf_web_acl" "this" {
  name        = var.name
  metric_name = var.metric_name

  default_action {
    type = "ALLOW"
  }

  logging_configuration {
    log_destination = var.firehose_delivery_stream_arn
  }
}