AWS WAF rules should have CloudWatch metrics enabled

How to fix it

Turn CloudWatch metrics on in the visibility configuration of the rule group and of every rule inside it; this passes only when all of them are on. A metric name is fixed when the rule is created and cannot be changed afterwards. An empty rule group is still evaluated here, on its own visibility configuration, where AWS reports the control as not applicable.

In the console

AWS WAF → Rule groups → the scope and Region → the rule group → Visibility configuration

With the AWS CLI

aws wafv2 update-rule-group --name <name> --scope REGIONAL --id <rule-group-id> --lock-token <lock-token> --visibility-config '{"SampledRequestsEnabled":true,"CloudWatchMetricsEnabled":true,"MetricName":"<metric-name>"}' --rules file://rules.json --region <region>

With Terraform

resource "aws_wafv2_rule_group" "this" {
  name     = var.name
  capacity = var.capacity
  scope    = "REGIONAL"

  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name                = var.metric_name
    sampled_requests_enabled   = true
  }
}