WAF Web ACL not associated with any resource
- Severity
- High
- Service
- AWS WAF
- Check ID
- WAF_UNASSOCIATED_ACL
What this check finds
This Web ACL exists but is not associated with any ALB, API Gateway stage, CloudFront distribution, or AppSync API. The ACL incurs charges but provides no protection.
Passing looks like: WAF Web ACL associated with a resource.
How to fix it
Associate the Web ACL with a resource or delete it if unused.
AWS CLI
aws wafv2 associate-web-acl --web-acl-arn ACL_ARN --resource-arn RESOURCE_ARN --scope REGIONAL
Names in capitals are placeholders for your own resource. Review a command before you run it.
AWS console
WAF → Web ACLs → Associated AWS resources.
Compliance controls it is evidence for
A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works
| Framework | Controls |
|---|---|
| PCI-DSS v4.0.1 |
|
| NIST SP 800-53 Rev5 (Moderate) |
|
| NIST Cybersecurity Framework 2.0 |
|
| ISO/IEC 27001:2022 Annex A |
|
Checked on every scan
KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs