aws waf-regional list-web-acls

aws waf-regional update-web-acl --web-acl-id <WebACLID> --updates file://update-rules.json

[
    {
        "Action": "INSERT",
        "ActivatedRule": {
            "Priority": 1,
            "RuleId": "AWSManagedRulesCommonRuleSet"
        }
    },
    {
        "Action": "INSERT",
        "ActivatedRule": {
            "Priority": 2,
            "RuleId": "AWSManagedRulesKnownBadInputsRuleSet"
        }
    }
]

aws waf-regional list-web-acls

import boto3

def remediate_empty_waf_rules():
    # Create a WAF client
    waf_client = boto3.client('waf-regional')

    # Get the list of WebACLs
    response = waf_client.list_web_acls()

    for web_acl in response['WebACLs']:
        web_acl_id = web_acl['WebACLId']
        
        # Get the rules for the WebACL
        rules_response = waf_client.get_web_acl(WebACLId=web_acl_id)
        
        # Check if the rules are empty
        if not rules_response['WebACL']['Rules']:
            # Add a default rule to the WebACL
            default_rule = {
                'Priority': 1,
                'RuleId': 'WAFRuleId',  # Add your desired WAF rule ID
                'Action': {
                    'Type': 'BLOCK'
                }
            }
            waf_client.update_web_acl(
                WebACLId=web_acl_id,
                ChangeToken=waf_client.get_change_token()['ChangeToken'],
                Updates=[
                    {
                        'Action': 'INSERT',
                        'ActivatedRule': {
                            'Priority': 1,
                            'RuleId': default_rule['RuleId'],
                            'Action': default_rule['Action']
                        }
                    }
                ]
            )
            print(f"WebACL {web_acl_id} updated with default WAF rule.")
        else:
            print(f"WebACL {web_acl_id} already has WAF rules.")

if __name__ == '__main__':
    remediate_empty_waf_rules()

# Example WAF Regional Web ACL with at least one rule attached (not empty)
resource "aws_wafregional_web_acl" "this" {
  name        = "WEB_ACL_NAME"        # replace with your Web ACL name
  metric_name = "WEB_ACL_METRIC_NAME" # replace with a valid CloudWatch metric name (A–Z only)

  default_action {
    type = "BLOCK" # or "ALLOW"/"COUNT" to match your desired default behavior
  }

  # This block is the equivalent of the CLI "update-web-acl ... --updates '[{\"Action\": \"INSERT\", ...}]'"
  rule {
    priority = 1           # must be unique within the ACL
    rule_id  = aws_wafregional_rule.example.id
    type     = "REGULAR"

    action {
      type = "BLOCK"       # adjust to "ALLOW" or "COUNT" as appropriate
    }
  }
}

# Example rule to attach to the Web ACL (you can use an existing rule instead)
resource "aws_wafregional_rule" "example" {
  name        = "RULE_NAME"          # replace with your rule name
  metric_name = "RULE_METRIC_NAME"   # replace with a valid CloudWatch metric name (A–Z only)

  # Optionally add predicates here (IP sets, byte match sets, etc.)
  # predicate {
  #   data_id = aws_wafregional_ipset.example.id
  #   negated = false
  #   type    = "IPMatch"
  # }
}