WAF Web ACL logging is disabled
- Severity
- High
- Service
- AWS WAF
- Check ID
- WAF_NO_LOGGING
What this check finds
This Web ACL does not have logging enabled. Without logs, blocked requests, attack patterns, and traffic anomalies cannot be investigated or used to tune rules.
Passing looks like: WAF logging enabled.
How to fix it
Enable WAF logging to an S3 bucket, CloudWatch Logs, or Kinesis Firehose.
AWS CLI
aws wafv2 put-logging-configuration --logging-configuration ResourceArn=ACL_ARN,LogDestinationConfigs=LOG_ARN
Names in capitals are placeholders for your own resource. Review a command before you run it.
AWS console
WAF → Web ACLs → Logging and metrics.
Compliance controls it is evidence for
A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works
| Framework | Controls |
|---|---|
| NIST SP 800-53 Rev5 (Moderate) |
|
| NIST Cybersecurity Framework 2.0 |
|
| ISO/IEC 27001:2022 Annex A |
|
Checked on every scan
KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs