Rule: Logging should be enabled on AWS WAFv2 regional and global web access control list (ACLs)
A guideline stating that logging must be enabled on AWS WAFv2 regional and global web access control list (ACLs)
| Rule | Logging should be enabled on AWS WAFv2 regional and global web access control list (ACLs) |
| Framework | SOC 2 |
| Severity | ✔ Low |
Logging Enabled on AWS WAFv2 Regional and Global Web ACLs for SOC 2
Rule Description
To meet the requirements of SOC 2 compliance, it is necessary to enable logging on AWS WAFv2 regional and global Web Access Control Lists (ACLs). Logging provides important information for monitoring and analysis, helping to detect and respond to security incidents effectively. This rule ensures that logging is configured correctly on AWS WAFv2 regional and global ACLs to maintain SOC 2 compliance.
Troubleshooting
If logging is not enabled on the AWS WAFv2 regional and global ACLs, it may indicate a misconfiguration or an oversight while setting up the security controls. Troubleshooting steps may include:
- 1.Check if the ACLs have been properly associated with the desired resources (e.g., CloudFront distributions, Application Load Balancers).
- 2.Validate the logging settings within the ACLs to ensure they are correctly configured.
- 3.Verify if the necessary IAM permissions are assigned to the user or role that needs to access the logs.
- 4.Ensure that the desired logging destination (e.g., Amazon S3 bucket, CloudWatch Logs) is correctly configured and accessible.
Necessary Codes (if applicable)
There are no specific codes for enabling logging on AWS WAFv2 regional and global ACLs. Configuration is done through the AWS Management Console or AWS Command Line Interface (CLI).
Step-by-Step Guide for Remediation
1. Open AWS WAFv2 Management Console
- Log in to the AWS Management Console.
- Navigate to the AWS WAF & Shield service.
2. Select a Regional or Global ACL
- Choose the appropriate regional or global ACL for which logging needs to be enabled.
3. Configure Logging
- Within the ACL settings, navigate to the "Logging and monitoring" section.
- Click on the "Edit" button.
4. Enable Logging
- Check the box to enable logging for the ACL.
- Specify the desired logging destination, such as an Amazon S3 bucket or CloudWatch Logs.
5. Configure Logging Settings (if applicable)
- If additional logging settings are available, configure them as per your requirements.
- For example, you might want to set the log sample rate or adjust the log format.
6. Save the Changes
- Click on the "Save" or "Update" button to apply the logging configuration to the ACL.
7. Validate Logging
- Monitor the logging destination (e.g., Amazon S3 bucket or CloudWatch Logs) to ensure logs are being generated.
- Verify that the logs contain the expected information regarding the requests and responses to the associated resources.
By following these steps, you will enable logging on AWS WAFv2 regional or global ACLs, contributing to SOC 2 compliance requirements.