WAFv2 web ACL rate limit rule threshold is too permissive

What it checks

WAFv2 web ACL rate limit rule threshold is too permissive

Where it applies

Terraform: aws_wafv2_web_acl, aws_wafv2_rule_group

CloudFormation: AWS::WAFv2::WebACL, AWS::WAFv2::RuleGroup

How to fix it

1. Review rate_based_statement.limit with the configured evaluation window, aggregation keys, scope-down statement, and rule action. Tune and test a lower limit against legitimate traffic for the affected endpoints.

Frameworks

• SOC 2 CC6.6

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules