AWS Bot Control managed rule group not configured
- Severity
- Medium
- Service
- AWS WAF
- Check ID
- WAF_NO_BOT_CONTROL
What this check finds
This Web ACL does not include the AWS Bot Control managed rule group. Bot Control detects and blocks common bot traffic including scrapers, scanners, and credential-stuffing bots.
Passing looks like: WAF Bot Control configured.
How to fix it
Add AWSManagedRulesBotControlRuleSet to the Web ACL.
AWS console
WAF → Web ACLs → Rules → Add managed rule groups → Bot Control.
Compliance controls it is evidence for
A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works
| Framework | Controls |
|---|---|
| NIST SP 800-53 Rev5 (Moderate) |
|
| NIST Cybersecurity Framework 2.0 |
|
| ISO/IEC 27001:2022 Annex A |
|
Checked on every scan
KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs