MEDIUMWAFSecurity

WAF Logging Disabled

waf-logging-disabled

What this rule checks

Detects WAFv2 WebACLs without logging configuration for analysed requests.

How to fix it

1Create an AWS::WAFv2::LoggingConfiguration for the WebACL

FlaggedThe WebACL (well-formed here: Block default action, CloudWatch metrics on, one managed rule) has no companion AWS::WAFv2::LoggingConfiguration referencing it. The check flags WebACLs that have no logging configuration.

import * as wafv2 from 'aws-cdk-lib/aws-wafv2';

new wafv2.CfnWebACL(this, 'Acl', {
  scope: 'REGIONAL',
  defaultAction: { block: {} },
  visibilityConfig: { cloudWatchMetricsEnabled: true, metricName: 'acl', sampledRequestsEnabled: true },
  rules: [{
    name: 'AWSCommon',
    priority: 0,
    overrideAction: { none: {} },
    statement: { managedRuleGroupStatement: { vendorName: 'AWS', name: 'AWSManagedRulesCommonRuleSet' } },
    visibilityConfig: { cloudWatchMetricsEnabled: true, metricName: 'common', sampledRequestsEnabled: true },
  }],
});

FixedAdding a CfnLoggingConfiguration whose resourceArn references the WebACL (via acl.attrArn) directs analysed requests to a log destination, clearing the finding.

import * as wafv2 from 'aws-cdk-lib/aws-wafv2';

const acl = new wafv2.CfnWebACL(this, 'Acl', {
  scope: 'REGIONAL',
  defaultAction: { block: {} },
  visibilityConfig: { cloudWatchMetricsEnabled: true, metricName: 'acl', sampledRequestsEnabled: true },
  rules: [{
    name: 'AWSCommon',
    priority: 0,
    overrideAction: { none: {} },
    statement: { managedRuleGroupStatement: { vendorName: 'AWS', name: 'AWSManagedRulesCommonRuleSet' } },
    visibilityConfig: { cloudWatchMetricsEnabled: true, metricName: 'common', sampledRequestsEnabled: true },
  }],
});
new wafv2.CfnLoggingConfiguration(this, 'AclLogging', {
  resourceArn: acl.attrArn,
  logDestinationConfigs: ['arn:aws:logs:us-east-1:111122223333:log-group:aws-waf-logs-example'],
});

CDK Insights pinpoints the exact file and line in your CDK source for every finding, so you can jump straight to the fix.

Affected resource types

AWS::WAFv2::WebACLAWS::WAFv2::LoggingConfiguration

Compliance frameworks

SOC2HIPAAPCI-DSSNIST

AWS documentation

Read the AWS guidance

Intentional? Suppress this finding

Sometimes a flag is deliberate — a genuinely public endpoint, say. You can dismiss waf-logging-disabled and the reason is kept in the report, not silently hidden.

In .cdk-insights.json:

{
  "ignoreRules": [
    { "id": "waf-logging-disabled", "reason": "Why this is intentional" }
  ]
}

Or inline in your CDK code:

Validations.of(scope).acknowledge({
  id: 'cdk-insights::waf-logging-disabled',
  reason: 'Why this is intentional',
});

Use the rule ID waf-logging-disabled shown above — not the CDK-* ID from SARIF / GitHub code scanning. To dismiss every finding on one construct instead, use ignorePaths. Suppression docs →

Catch this in your stack

$ npx cdk-insights scan

CDK Insights runs this and 118+ other rules locally against your synthesised CDK app — free, no account, your code never leaves your machine.

More WAF rules

HIGHWAF WebACL Misconfigured

All rules How static analysis works