Overview
Clean up unused AWS WAF Classic Regional rule groups by safely identifying and deleting those that contain no rules. The plan inventories all WAF Classic Regional rule groups across selected Regions, inspects them to find truly empty groups, guides you through approving which ones to delete, removes the approved empty groups, and then validates that the deletions were successful. Throughout, it emphasizes user review, re‑verification before deletion, and clear reporting of outcomes and exceptions.
Execution Details
Assessment
Inventory WAF Classic Regional rule groups
First, build a complete inventory of WAF Classic Regional rule groups in the Regions you define as in scope. The plan:
- Identifies the Regions where WAF Classic Regional is being used or that you specify.
- Lists all WAF Classic Regional rule groups in each Region.
- Captures key attributes such as rule group IDs, names/descriptions, Regions, metric or logging identifiers, and any available tags (for example, Name, environment, owner).
- Stores this inventory in a structured format (such as a table or JSON file) for later analysis.
Inspect rule groups for associated rules
Next, examine each rule group to understand whether it is in use:
- Iterates over the inventoried rule groups in each Region.
- Retrieves the rules associated with each rule group.
- Records the rule count per rule group and minimal details about each rule (such as rule IDs and optional names/descriptions).
- Marks each rule group as having zero rules or one or more rules.
- Updates the stored inventory to include rule counts and rule lists for subsequent filtering.
Identify empty WAF Classic Regional rule groups
Then, isolate the rule groups that have no rules:
- Filters the updated inventory to find rule groups with a recorded rule count of zero.
- Re-checks each candidate rule group’s current rule list to confirm that no rules have been added since the prior inspection.
- Retains relevant attributes (ID, name/description, Region, tags) for each confirmed empty rule group.
- Compiles a structured candidate list of empty rule groups that are potential deletion targets for user review.
User: Approve empty rule groups for deletion
You are then guided through reviewing and approving which empty rule groups should be deleted:
- Presents the candidate list of empty WAF Classic Regional rule groups, including IDs, names/descriptions, Regions, and tags.
- Highlights rule groups whose names or tags suggest special or future use so you can make an informed decision.
- Allows you to select which empty rule groups to delete.
- Lets you mark specific empty rule groups as exceptions to retain, optionally capturing the rationale.
- Produces and stores a final, user-approved list of rule group IDs and Regions to be used in the configuration phase.
Configuration
Delete approved empty WAF Classic Regional rule groups
With your approvals captured, the plan safely removes the selected empty rule groups:
- Retrieves the user-approved list of empty rule groups to delete.
- Immediately re-verifies that each rule group still has zero rules just before deletion.
- Skips deletion and records an exception for any rule group that now has rules.
- Attempts to delete each remaining approved empty rule group in its respective Region.
- Records the outcome of each deletion attempt, including success, failure, and any error details.
- Confirms that successfully deleted rule groups are no longer present by checking the current rule groups in affected Regions.
- Produces a summary of all rule groups that were deleted and those that could not be removed, along with reasons and recommended follow-up actions.
Validation
Validate empty WAF Classic Regional rule groups are deleted
Finally, the plan verifies that the cleanup completed as intended:
- Retrieves the current list of WAF Classic Regional rule groups for each Region where deletions were performed.
- Confirms that each rule group ID reported as successfully deleted no longer appears.
- For any rule group that still exists, determines whether the deletion failed or was intentionally skipped because rules were added, referencing recorded error or exception details.
- Documents any rule groups that were meant to be deleted but remain, including the cause and suggested remediation.
- Produces a validation report summarizing which empty rule groups were successfully removed and which require further follow-up.