WAF Web ACL has no AWS managed rule groups enabled

Severity: High
Service: AWS WAF
Check ID: WAF_NO_MANAGED_RULES

What this check finds

This Web ACL contains no AWS managed rule groups. Managed rules provide protection against common threats (OWASP Top 10, known bad IPs, bot signatures) with no custom rule authoring.

Passing looks like: WAF has AWS managed rule groups enabled.

How to fix it

Add at least the AWSManagedRulesCommonRuleSet to the Web ACL.

AWS console

WAF → Web ACLs → Rules → Add managed rule groups.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to WAF Web ACL has no AWS managed rule groups enabled
Framework	Controls
PCI-DSS v4.0.1	6.4 Public-facing web applications are protected against attacks
NIST SP 800-53 Rev5 (Moderate)	SC-7 Boundary Protection SI-4 System Monitoring SI-10 Information Input Validation
NIST Cybersecurity Framework 2.0	PR.IR-01 Networks and environments are protected from unauthorized logical access and usage PR.PS-02 Software is maintained commensurate with risk DE.CM-01 Networks are monitored
ISO/IEC 27001:2022 Annex A	A.8.16 Monitoring activities A.8.20 Networks security A.8.26 Application security requirements

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More AWS WAF checks

All AWS WAF checks