Rule: Logging should be enabled on AWS WAFv2 Web ACLs
Ensure logging is enabled on AWS WAFv2 regional and global web access control list (ACLs) for improved security.
| Rule | Logging should be enabled on AWS WAFv2 regional and global web access control list (ACLs) |
| Framework | NIST 800-171 Revision 2 |
| Severity | ✔ Low |
Logging for AWS WAFv2 Regional and Global Web ACLs for NIST 800-171 Revision 2
Description
The logging feature should be enabled on AWS WAFv2 Regional and Global Web Access Control Lists (ACLs) to ensure compliance with NIST 800-171 Revision 2. Enabling logging allows capturing detailed information about web traffic and potential security threats or attacks. This information is crucial for monitoring and analysis purposes, and it also helps in meeting regulatory requirements such as NIST 800-171 Revision 2.
Troubleshooting Steps (if applicable)
- 1.Ensure that you have the necessary permissions to modify AWS WAFv2 ACLs and enable logging.
- 2.Check if your AWS WAFv2 Web ACLs are associated with the appropriate resources (e.g., CloudFront distributions, Application Load Balancers) for effective logging.
Necessary Code (if applicable)
There are no specific code snippets required for enabling logging on AWS WAFv2 ACLs. Instead, configuration changes need to be made through the AWS Management Console or AWS Command Line Interface (CLI).
Step-by-Step Guide for Remediation
Step 1: Access the AWS Management Console
Navigate to the AWS Management Console using your provided credentials.
Step 2: Open AWS WAFv2 Console
From the dashboard, search for and select "AWS WAFv2" to open the AWS WAFv2 console.
Step 3: Choose Global or Regional Web ACLs
Select either the "Global Web ACLs" or "Regional Web ACLs" tab based on the type of ACLs you want to enable logging for.
Step 4: Select the Web ACL
Choose the Web ACL for which you want to enable logging by clicking on its name.
Step 5: Enable Logging
Under the "Logging and monitoring" section, click on "Edit" to modify the ACL settings.
Step 6: Enable Logging Configuration
Enable the "Logging configuration" toggle switch to turn on logging for the selected ACL.
Step 7: Specify Log Destination
Specify the log destination where the logs will be sent. This can be an Amazon Kinesis Data Firehose delivery stream, Amazon S3 bucket, or AWS CloudWatch Logs.
Step 8: Configure Logging Filters (Optional)
Optionally, you can configure logging filters to specify the type of requests you want to log. This helps in reducing the log size and focusing on specific events of interest.
Step 9: Save Changes
Click on "Save changes" to apply the logging configuration to the selected Web ACL.
Conclusion
Enabling logging on AWS WAFv2 Regional and Global Web ACLs is essential for NIST 800-171 Revision 2 compliance. By following the step-by-step guide provided, you can ensure that the necessary logging configuration is correctly applied for monitoring and analyzing web traffic and potential security threats.