Free plan Signups are open now. The full audytx engine — Terraform and CloudFormation — is live. The Free plan is 100 scans a month and stays free — paid tiers arrive Nov 01, 2026 from $20/month for unlimited repositories. Try it on your own code.

WAFv2 web ACL should have logging enabled

AWS_WAF_004 MEDIUM Observability

What it checks

WAFv2 web ACL: no logging configuration is associated.

Where it applies

Terraform: aws_wafv2_web_acl

CloudFormation: AWS::WAFv2::WebACL

How to fix it

  1. Create an aws_wafv2_web_acl_logging_configuration pointing to a Kinesis Firehose or CloudWatch Logs destination. WAF log group names must start with 'aws-waf-logs-'.

Frameworks

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules