WAF Web ACL default action is Count instead of Block

Severity: High
Service: AWS WAF
Check ID: WAF_DEFAULT_COUNT_ACTION

What this check finds

This Web ACL default action is set to Count, which means requests not matched by any rule are logged but not blocked. This effectively disables enforcement for unmatched traffic.

Passing looks like: WAF default action is Block.

How to fix it

Change the default action to Block.

AWS console

WAF → Web ACLs → Edit → Default web ACL action → Block.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to WAF Web ACL default action is Count instead of Block
Framework	Controls
NIST SP 800-53 Rev5 (Moderate)	SC-7 Boundary Protection SI-4 System Monitoring
NIST Cybersecurity Framework 2.0	PR.IR-01 Networks and environments are protected from unauthorized logical access and usage DE.CM-01 Networks are monitored
ISO/IEC 27001:2022 Annex A	A.8.16 Monitoring activities A.8.20 Networks security

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More AWS WAF checks

All AWS WAF checks