AWS WAF Classic Regional rules should have at least one condition

How to fix it

Attach at least one condition to the WAF Classic Regional rule, so its allow, block or count action applies to traffic the rule matched. The condition is a separate Classic object in the same Region, an IP set, a string or regex match, a size constraint, a SQL injection or cross-site scripting match, or a geo match, and has to exist before it can be attached as a predicate.

In the console

AWS WAF Classic → the Region → Rules → the rule → Conditions

With the AWS CLI

aws waf-regional update-rule --rule-id <rule-id> --change-token <change-token> --updates '[{"Action":"INSERT","Predicate":{"Negated":false,"Type":"IPMatch","DataId":"<condition-id>"}}]' --region <region>

With Terraform

resource "aws_wafregional_rule" "this" {
  name        = var.name
  metric_name = var.metric_name

  predicate {
    data_id = var.condition_id
    negated = false
    type    = "IPMatch"
  }
}