HOW CAN WE LIST ALL Web ACLs and the all the rules inside of those Web ACLs.

There is no direct way to list ACLs alongwith rules, needs to be two step process, first you list ACLs and then rules. Please check the below two links.

https://docs.aws.amazon.com/cli/latest/reference/waf/list-web-acls.html https://docs.aws.amazon.com/cli/latest/reference/wafv2/list-resources-for-web-acl.html

WAFv2 (the newest WAF) has a nice property where all rules are explicitly listed inside web ACL. You have to fetch the list of web ACLs using list-web-acls and then cycle through the list to fetch individual web ACL using get-web-acl. Pipe the output into a file.

For WAF Classic, the process is similar but rules are referenced from web ACL. So you need to do addition step of cycling through the rules inside web ACL and then fetch individual rule using get-rule. Note the difference in API documentation for WAF Classic and WAFv2.

Doable in most shell using CLI but probably easier to use scripting language like Python for better formatting.