Want to delete Web ACL

Question

I tried to delete Web ACL. However, there was a following error.

```
You can't delete a web ACL that is associated with any CloudFront distributions.
```
Then, I opened the WebACL and from the 'Associated AWS resources', I tried to diassociate CloudFront Distribution. The next error was the following.

```
An unspecified error occurred. Follow these steps, in order, to try and remediate the problem:

Check your network connectivity - Check that your internet connection is stable.
Reload the page - Sometimes a page refresh can help.
Return to the AWS WAF home page - Some issues can arise from page routing. Return to the home page, then navigate back to where you were and try again.
Clear your browser cache and cookies - Outdated caches can sometimes cause problems. Clear your browser cache and cookies, then try again.
Contact support - If the prior steps don't solve the problem, reach out to AWS support  for further assistance.
```
I asked the AWS support and shared the log. According to them, 
```
Part of the console is making an update cloudfront API call.  That CF distro has CloudFront level logging enabled but the S3 bucket it points to doesn't exist/can't be access causing the update call to fail.
```

I checked the S3 bucket and I realized that I deleted the S3 bucket which associated with CloudFront distribution.

I tried to create a new S3 bucket and update a CloudFront Distribution withe a new bucket. But I can't do that. I'd like to know how to solve this problem.

re:Post Agent · Answer

To resolve this issue and delete your Web ACL, you'll need to follow these steps:

1. First, you need to address the CloudFront distribution issue. Since the S3 bucket associated with the CloudFront distribution's logging has been deleted, you can't simply update it through the console.

2. You'll need to use the AWS CLI or AWS SDK to update the CloudFront distribution. Specifically, you should disable logging for the distribution. This can be done by updating the distribution configuration and setting the logging to 'disabled' or removing the logging configuration entirely.

3. Once you've successfully updated the CloudFront distribution to disable logging, you should be able to disassociate the Web ACL from the CloudFront distribution through the AWS WAF console.

4. After disassociating the Web ACL from all resources, including the CloudFront distribution, you'll be able to delete the Web ACL.

5. If you still encounter issues, you may need to delete the CloudFront distribution entirely and recreate it with the correct logging configuration or without logging.

6. As a final step, if you want to re-enable logging for your CloudFront distribution, create a new S3 bucket for this purpose and update the distribution's configuration to use the new bucket.

Remember to be cautious when making these changes, as they can affect your application's functionality. It's always a good idea to have backups and to test changes in a non-production environment first if possible.

If you continue to face issues after trying these steps, you may need to escalate the issue with AWS Support, providing them with the specific error messages and actions you've taken.  
**Sources**  
[Deleting a Web ACL - AWS WAF, AWS Firewall Manager, and AWS Shield Advanced](https://docs.aws.amazon.com/waf/latest/developerguide/classic-web-acl-deleting.html)  
[Deleting a web ACL - AWS WAF, AWS Firewall Manager, and AWS Shield Advanced](https://docs.aws.amazon.com/waf/latest/developerguide/web-acl-deleting.html)  
[Disassociating a web ACL from an AWS resource - AWS WAF, AWS Firewall Manager, and AWS Shield Advanced](https://docs.aws.amazon.com/waf/latest/developerguide/web-acl-dissociating-aws-resource.html)

Want to delete Web ACL

Add your answer

Relevant content