AWS WAF Classic Regional rule groups should have at least one rule

How to fix it

Activate at least one rule in the WAF Classic Regional rule group. The rule has to exist first as its own Classic rule in the same Region, so create it before the update; each activation carries a priority and an action of allow, block or count. The same protection in another Region is a separate group with its own finding, and Marketplace groups are not yours to edit.

In the console

AWS WAF Classic → the Region → Rule groups → the rule group → Rules

With the AWS CLI

aws waf-regional update-rule-group --rule-group-id <rule-group-id> --change-token <change-token> --updates '[{"Action":"INSERT","ActivatedRule":{"Priority":1,"RuleId":"<rule-id>","Action":{"Type":"BLOCK"},"Type":"REGULAR"}}]' --region <region>

With Terraform

resource "aws_wafregional_rule_group" "this" {
  name        = var.name
  metric_name = var.metric_name

  activated_rule {
    priority = 1
    rule_id  = var.rule_id

    action {
      type = "BLOCK"
    }
  }
}