List rules across each region and find any whose predicate set is empty. Decide per rule whether it should hold a condition (IP match, byte-match, SQL-injection, size constraint) or be deleted as dead scaffolding. Attach the right condition via the WAF Classic change-token workflow, or remove the empty rule. Add a guardrail so hollow rules can't be created and left unfinished.

Compliance Medium severity

AWS Security Hub · WAF

WAF.2: WAF Classic regional rules should have a condition

Written and reviewed by Emnode · Last reviewed 27 May 2026

What does AWS Security Hub WAF.2 check?

WAF.2 checks AWS WAF Classic Regional rules (`AWS::WAFRegional::Rule`, the kind attached via web ACLs to ALBs and API Gateway). It reports FAILED the moment a rule has zero conditions (an empty `Predicates` array): the rule object is valid but inspects nothing.

Why does WAF.2 matter?

A rule with no conditions never matches any request, so whatever action it carries, traffic passes through untouched. Worse than useless, it's misleading: a rule named `block-sqli` or `BlockBadBots` with no conditions creates a false sense of protection that operators read off the name and trust, while the rule is a half-finished placeholder nobody ever wired up.

How do I fix WAF.2?

List rules across each region and find any whose predicate set is empty.
Decide per rule whether it should hold a condition (IP match, byte-match, SQL-injection, size constraint) or be deleted as dead scaffolding.
Attach the right condition via the WAF Classic change-token workflow, or remove the empty rule.
Add a guardrail so hollow rules can't be created and left unfinished.

Remediation script · bash

# Attach the AWS Managed Rules common baseline to an empty web ACL, in Count mode.
# update-web-acl REPLACES the entire Rules array, so supply the full desired set and the current LockToken.
aws wafv2 update-web-acl \
  --scope REGIONAL --name public-alb-waf --id a1b2c3d4-0000-1111-2222-3333 \
  --lock-token e4f5g6h7 --default-action Allow={} \
  --visibility-config SampledRequestsEnabled=true,CloudWatchMetricsEnabled=true,MetricName=public-alb-waf \
  --rules '[{"Name":"AWS-CommonRuleSet","Priority":0,"Statement":{"ManagedRuleGroupStatement":{"VendorName":"AWS","Name":"AWSManagedRulesCommonRuleSet"}},"OverrideAction":{"Count":{}},"VisibilityConfig":{"SampledRequestsEnabled":true,"CloudWatchMetricsEnabled":true,"MetricName":"AWS-CommonRuleSet"}}]'

# Associate a baseline web ACL with an unprotected API Gateway stage (the resource ARN is the stage, not the API).
aws wafv2 associate-web-acl \
  --web-acl-arn arn:aws:wafv2:us-east-1:111122223333:regional/webacl/prod-api-baseline/1a2b3c4d \
  --resource-arn arn:aws:apigateway:us-east-1::/restapis/a1b2c3d4e5/stages/prod

# Protect a Network Firewall from accidental deletion.
aws network-firewall update-firewall-delete-protection \
  --firewall-name prod-egress-inspection --delete-protection

Full walkthrough (console steps, edge cases and verification) in the lesson Protect APIs and edge with WAF.

Is WAF.2 a false positive?

A legitimate trigger is a Regional rule kept deliberately empty as a staging placeholder, for example an IP-match rule whose `Predicates` array is cleared while an allowlist or blocklist is being rebuilt, or a templated rule provisioned ahead of the conditions that will populate it. Because WAF.2 only checks that conditions exist, not what they do, an empty rule that is not attached to any web ACL still inspects no traffic and so fails by design even though it is harmless in isolation. If the empty rule is a sanctioned, unattached placeholder, document it and suppress the finding (or set a Security Hub automation rule to NOT_AFFECTED) rather than adding a throwaway condition just to clear the check.

Full lesson Protect APIs and edge with WAF Step-by-step remediation with CLI, code and persona-specific context.

AWS documentation for WAF controls ↗ Check your own account for WAF.2 →

Part of the learning path Lock down access

WAF.1 WAF Classic global web ACL logging
WAF.3 WAF Classic regional rule groups should have a rule
WAF.4 WAF Classic regional web ACLs should have a rule
WAF.6 WAF Classic global rules should have a condition
WAF.7 WAF Classic global rule groups should have a rule
WAF.8 WAF Classic global web ACLs should have a rule
WAF.10 WAFv2 web ACLs should have a rule or rule group
WAF.11 WAFv2 web ACL logging should be enabled