Free plan Signups are open now. The full audytx engine — Terraform and CloudFormation — is live. The Free plan is 100 scans a month and stays free — paid tiers arrive Nov 01, 2026 from $20/month for unlimited repositories. Try it on your own code.

WAFv2 web ACL should include AWSManagedRulesCommonRuleSet

AWS_WAF_003 MEDIUM Security

What it checks

WAFv2 web ACL: AWSManagedRulesCommonRuleSet is not included.

Where it applies

Terraform: aws_wafv2_web_acl

CloudFormation: AWS::WAFv2::WebACL

How to fix it

  1. Add AWSManagedRulesCommonRuleSet to the WAF ACL. Start in Count mode to identify false positives before switching to Block.

Frameworks

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules