AWS WAF web ACLs should have at least one rule or rule group

How to fix it

Attach at least one rule or rule group to the web ACL. The AWS managed group AWSManagedRulesCommonRuleSet is the quickest real fix and costs 700 of the web ACL's capacity units. UpdateWebACL replaces the whole web ACL rather than patching it, so read the current state back first and send it complete; omitting the rules deletes every rule it has. Start a new rule in count mode.

In the console

AWS WAF → Web ACLs → the scope and Region → the web ACL → Rules

With the AWS CLI

aws wafv2 update-web-acl --name <name> --scope REGIONAL --id <web-acl-id> --lock-token <lock-token> --default-action file://default-action.json --visibility-config file://visibility-config.json --rules file://rules.json --region <region>

With Terraform

resource "aws_wafv2_web_acl" "this" {
  name  = var.name
  scope = "REGIONAL"

  default_action {
    allow {}
  }

  rule {
    name     = "aws-common-rule-set"
    priority = 1

    override_action {
      none {}
    }

    statement {
      managed_rule_group_statement {
        name        = "AWSManagedRulesCommonRuleSet"
        vendor_name = "AWS"
      }
    }

    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "aws-common-rule-set"
      sampled_requests_enabled   = true
    }
  }

  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name                = var.name
    sampled_requests_enabled   = true
  }
}