AWS WAF web ACL logging should be enabled

How to fix it

Point the web ACL at a logging destination: a CloudWatch Logs log group, an S3 bucket, or an Amazon Data Firehose delivery stream. It has to exist first, in the same account and Region as the web ACL, and its name must start with aws-waf-logs-, which AWS enforces. For a CloudFront-scope web ACL that Region is US East (N. Virginia). Logging is not retroactive; it records from when it is attached.

In the console

AWS WAF → Web ACLs → the scope and Region → the web ACL → Logging and metrics

With the AWS CLI

aws wafv2 put-logging-configuration --logging-configuration '{"ResourceArn":"<web-acl-arn>","LogDestinationConfigs":["<log-destination-arn>"]}' --region <region>

With Terraform

resource "aws_wafv2_web_acl_logging_configuration" "this" {
  resource_arn            = var.web_acl_arn
  log_destination_configs = [var.log_destination_arn]
}