Terraform AWS WAFv2

WAFv2 web ACLs, rule groups, IP sets, and regex pattern sets with managed and custom rules, CloudWatch visibility metrics, logging configuration, and CloudFront or regional scope for request filtering.

Controls enforced

These compliance controls are checked at terraform plan time.

WAFv2 rules should have CloudWatch metrics enabled(low effort)

Quick start

module "wafv2" {
  source  = "acscessentialeight.compliance.tf/terraform-aws-modules/wafv2/aws"
  version = ">= 2.0.0, < 3.0.0"

  # ... your arguments here
}

module "wafv2" {
  source  = "hipaa.compliance.tf/terraform-aws-modules/wafv2/aws"
  version = ">= 2.0.0, < 3.0.0"

  # ... your arguments here
}

module "wafv2" {
  source  = "iso27001.compliance.tf/terraform-aws-modules/wafv2/aws"
  version = ">= 2.0.0, < 3.0.0"

  # ... your arguments here
}

module "wafv2" {
  source  = "nis2.compliance.tf/terraform-aws-modules/wafv2/aws"
  version = ">= 2.0.0, < 3.0.0"

  # ... your arguments here
}

module "wafv2" {
  source  = "nist800171.compliance.tf/terraform-aws-modules/wafv2/aws"
  version = ">= 2.0.0, < 3.0.0"

  # ... your arguments here
}

module "wafv2" {
  source  = "pcidss.compliance.tf/terraform-aws-modules/wafv2/aws"
  version = ">= 2.0.0, < 3.0.0"

  # ... your arguments here
}

module "wafv2" {
  source  = "soc2.compliance.tf/terraform-aws-modules/wafv2/aws"
  version = ">= 2.0.0, < 3.0.0"

  # ... your arguments here
}

View this module on the compliance.tf registry — versions, inputs, and outputs →

See the Get Started guide and Registry Endpoints for details on how to customize the module for your requirements.

Migration from upstream

Already using terraform-aws-modules? Change only the source URL:

module "wafv2" {
  source  = "terraform-aws-modules/wafv2/aws"
  version = ">= 2.0.0, < 3.0.0"
}

module "wafv2" {
  source  = "soc2.compliance.tf/terraform-aws-modules/wafv2/aws"
  version = ">= 2.0.0, < 3.0.0"
}

Same arguments. Same outputs. Controls are checked at terraform plan. See the Migration Guide for step-by-step instructions.

Reversibility

No lock-in. Switch back by reverting the source URL:

module "wafv2" {
  source  = "terraform-aws-modules/wafv2/aws"
}

Run terraform init -upgrade. Terraform state is unchanged — same resource addresses, same provider, no compliance.tf-specific resources. Controls you already applied remain in AWS.

Mapped compliance frameworks

ACSC-EE-ML3-7.10: Multi-factor authentication ML3

WAFv2 rules should have CloudWatch metrics enabled

164.308(a)(1)(ii)(D): Administrative Safeguards

WAFv2 rules should have CloudWatch metrics enabled

1 controls from this module are active under ISO/IEC 27001:2022.

1 controls from this module are active under NIS2 Directive (EU 2022/2555).

3.14.6: Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.

WAFv2 rules should have CloudWatch metrics enabled

3.14.7: Identify unauthorized use of organizational systems.

WAFv2 rules should have CloudWatch metrics enabled

1 controls from this module are active under PCI DSS v4.0.

A1.2 The entity authorizes, designs, develops or acquires, implements, operates, approves, maintains, and monitors environmental protections, software, data back-up processes, and recovery infrastructure to meet its objectives

WAFv2 rules should have CloudWatch metrics enabled

CC7.2: The entity monitors system components and the operation of those components for anomalies that are indicative of malicious acts, natural disasters, and errors affecting the entity's ability to meet its objectives; anomalies are analyzed to determine whether they represent security events.

WAFv2 rules should have CloudWatch metrics enabled

Framework coverage

Which controls from this module are active under each framework endpoint.

Control	HIPAA Omnibus Rule 2013	PCI DSS v4.0	SOC 2
WAFv2 rules should have CloudWatch metrics enabled	●	○	●

● enforced by default · ○ not activated by this endpoint