Free plan Signups are open now. The full audytx engine — Terraform and CloudFormation — is live. The Free plan is 100 scans a month and stays free — paid tiers arrive Nov 01, 2026 from $20/month for unlimited repositories. Try it on your own code.

WAFv2 web ACL default action is ALLOW with no rules configured

AWS_WAF_001 HIGH Security

What it checks

WAFv2 web ACL: default action is ALLOW with no rules configured.

Where it applies

Terraform: aws_wafv2_web_acl

CloudFormation: AWS::WAFv2::WebACL

How to fix it

  1. Add at minimum the AWSManagedRulesCommonRuleSet managed rule group to the WAF ACL

Frameworks

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules