Rule: Logging should be enabled on AWS WAFv2 web ACLs

Logging for AWS WAFv2 Regional and Global Web ACLs for FedRAMP Moderate Revision 4

Rule Description

Troubleshooting Steps

2. 1.

   Verify IAM Permissions: Ensure that the user or role attempting to enable logging has the necessary permissions to modify AWS WAFv2 ACL settings and create related resources.

4. 2.

   Check Firewall Availability: Make sure that the Web ACL is accessible and available in the desired region or globally. If it's not available, create a new Web ACL.

6. 3.

   Check Logging Configuration: Validate the logging configuration settings to ensure they are correctly defined. Verify the destination S3 bucket and the desired CloudWatch logging level.

8. 4.

   Verify Resource Associations: Ensure that the Web ACL is correctly associated with the desired resources, such as AWS CloudFront distributions or Application Load Balancers (ALBs).

10. 5.

    Review Error Messages: If any error messages are encountered during the logging enablement process, examine them carefully to identify the root cause. Common errors could include permission issues, invalid bucket policies, or incorrect configurations.

Necessary Codes

Step-by-Step Guide for Remediation

2. 1.

   AWS Console: a. Open the AWS Management Console and navigate to the AWS WAFv2 service. b. Select the desired region or the Global default web ACL. c. Identify the Web ACL you want to enable logging for and click on its name. d. Click on the "Logging & Publishing" tab. e. Enable logging by toggling the "Enable logging" option. f. Configure the desired logging destination by selecting an existing S3 bucket or creating a new one. g. Set the appropriate logging level based on your requirements. h. Click "Save changes" to apply the logging configuration.

4. 2.

   AWS CLI: a. Open the AWS CLI on your local machine or terminal. b. Run the following command to enable logging on a regional Web ACL:

        aws wafv2 update-web-acl --name <web-acl-name> --scope REGIONAL --logging-configuration file://logging-config.json     

   Replace

   <web-acl-name>

   with the actual name of the Web ACL you want to enable logging for.

   c. For enabling logging on a global Web ACL, run the following command:

        aws wafv2 update-web-acl --name <web-acl-name> --scope CLOUDFRONT --logging-configuration file://logging-config.json     

   Replace

   <web-acl-name>

   with the actual name of the Web ACL you want to enable logging for.

   d. Create a JSON file called

   logging-config.json

   with the following content:

   json      {          "logDestinationConfigs": [              {                  "logDestinationType": "S3",                  "logDestination": "arn:aws:s3:::<bucket-name>"              }          ],          "redactedFields": {              "fieldToMatches": [                  {                      "type": "URI"                  }              ]          }      }      

   Replace

   <bucket-name>

   with the name of your S3 bucket that will store the logs.

   e. Run the appropriate command based on the Web ACL scope (regional or global) to enable logging.