ALB not associated with a WAF Web ACL

Severity: Medium
Service: Elastic Load Balancing
Check ID: WAF_NOT_ON_ALB

What this check finds

This Application Load Balancer has no AWS WAF Web ACL attached. Without WAF, the ALB lacks protection against common web exploits such as SQL injection, XSS, and bot traffic.

Passing looks like: ALB associated with a WAF Web ACL.

How to fix it

Create or associate a WAF Web ACL with the ALB.

AWS CLI

aws wafv2 associate-web-acl --web-acl-arn WEB_ACL_ARN --resource-arn ALB_ARN --scope REGIONAL

Names in capitals are placeholders for your own resource. Review a command before you run it.

AWS console

WAF → Web ACLs → select ACL → Associated AWS resources → Add.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to ALB not associated with a WAF Web ACL
Framework	Controls
NIST SP 800-53 Rev5 (Moderate)	SC-7 Boundary Protection SI-4 System Monitoring
NIST Cybersecurity Framework 2.0	PR.IR-01 Networks and environments are protected from unauthorized logical access and usage DE.CM-01 Networks are monitored
ISO/IEC 27001:2022 Annex A	A.8.16 Monitoring activities A.8.20 Networks security

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More Elastic Load Balancing checks

All Elastic Load Balancing checks