AWS WAFv2 Web ACLs with logging capture details of inspected requests and rule evaluations. The assessment determines for each Web ACL whether logging is configured to record traffic analyzed by that ACL.
Risk
Without WAF logging, visibility into allowed/blocked requests is lost, degrading detection and response. SQLi, credential stuffing, and bot/DDoS probes can go unnoticed, risking data exposure (C), undetected rule misuse (I), and service instability from unseen abuse (A).
prowler aws --checks wafv2_webacl_logging_enabled
Recommendation
Enable logging on all WAFv2 Web ACLs to a centralized destination. Apply least privilege for log delivery, redact sensitive fields, and filter to retain high-value events. Integrate with monitoring/SIEM for alerting and correlation, and review routinely as part of defense in depth.
Remediation
aws wafv2 put-logging-configuration --logging-configuration ResourceArn=<WEB_ACL_ARN>,LogDestinationConfigs=<DESTINATION_ARN>
- In the AWS Console, go to AWS WAF & Shield > Web ACLs
- Select the target Web ACL
- Open the Logging and metrics (or Logging) section and click Enable logging
- Choose a log destination (CloudWatch Logs log group, S3 bucket, or Kinesis Data Firehose)
- Click Save to enable logging
Source Code
Resource Type
AwsWafv2WebAcl
References
- https://www.trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/aws/WAF/enable-web-acls-logging.html
- https://docs.aws.amazon.com/securityhub/latest/userguide/waf-controls.html#waf-11
- https://docs.aws.amazon.com/cli/latest/reference/wafv2/put-logging-configuration.html
- https://docs.aws.amazon.com/waf/latest/developerguide/logging.html