AWS WAF Classic Regional web ACLs should have at least one rule or rule group

How to fix it

Attach at least one rule or rule group to the WAF Classic Regional web ACL, so requests to the load balancers and API Gateway stages it is associated with are inspected instead of falling through to the default action. Put a new rule in count mode and read its metrics before switching it to block. The same protection in another Region is a separate web ACL.

In the console

AWS WAF Classic → the Region → Web ACLs → the web ACL → Rules

With the AWS CLI

aws waf-regional update-web-acl --web-acl-id <web-acl-id> --change-token <change-token> --updates '[{"Action":"INSERT","ActivatedRule":{"Priority":1,"RuleId":"<rule-id>","Action":{"Type":"BLOCK"},"Type":"REGULAR"}}]' --region <region>

With Terraform

resource "aws_wafregional_web_acl" "this" {
  name        = var.name
  metric_name = var.metric_name

  default_action {
    type = "ALLOW"
  }

  rule {
    priority = 1
    rule_id  = var.rule_id
    type     = "REGULAR"

    action {
      type = "BLOCK"
    }
  }
}