Ensure AWS WAF Classic Regional Rule Groups Contain Rules
This control verifies that AWS WAF Classic Regional rule groups have at least one rule, essential for effective traffic management.
| Rule | AWS WAF Classic Regional rule groups should have at least one rule |
| Framework | AWS Foundational Security Best Practices |
| Severity | ✔ Medium |
Rule Description:
AWS WAF Classic Regional rule groups must contain at least one rule that aligns with AWS Foundational Security Best Practices. This ensures that the AWS resources are protected against known security risks and vulnerabilities.
Troubleshooting Steps:
- 1.Check the existing rules in the AWS WAF Classic Regional rule groups.
- 2.Verify if there is a rule that is aligned with AWS Foundational Security Best Practices.
- 3.If there is no such rule present, add a rule that complies with the security best practices.
Necessary Codes/CLI Commands:
- To list the existing rules in the AWS WAF Classic Regional rule group:
aws waf list-rules
- To create a rule based on AWS Foundational Security Best Practices:
aws waf create-rule --name "AWS Foundational Security Best Practices Rule" --type "XSS" --priority 1 --action "BLOCK" --override-action "COUNT"
Step-by-Step Guide for Remediation:
- 1.Log in to the AWS Management Console.
- 2.Navigate to the AWS WAF service.
- 3.Select the AWS WAF Classic Regional rule group that needs to be updated.
- 4.Check the existing rules by using the CLI command
.aws waf list-rules - 5.If there is no rule aligned with AWS Foundational Security Best Practices, create a new rule using the CLI command provided above.
- 6.Ensure the newly created rule is added to the rule group with the appropriate priority.
- 7.Test the rule to confirm that it is effectively mitigating security risks.
- 8.Monitor the AWS WAF logs for any potential security incidents.
By following these steps and ensuring that AWS WAF Classic Regional rule groups have at least one rule for AWS Foundational Security Best Practices, you can enhance the security posture of your AWS resources and mitigate potential security threats effectively.