How to safely delete AWS WAF Classic (v1)

Question

There is an existing AWS WAF Classic (v1). Is there a way to check if it is being used between services? I want to know how to check if it is safe to delete this AWS WAF Classic (v1).

Riku_Kobayashi · Accepted Answer

Hello.

If you check the WAFv1 Web ACL as shown in the image below, you can see the associated AWS resources.  
![a](/media/postImages/original/IMPxJS2JGNQX2Vnot_P7s6lA)

If you do not need to configure WAF, it is a good idea to remove the resource binding from WAF and delete the Web ACL.  
If you want to continue using AWS WAF, please create and configure a new Web ACL with WAFv2.  
Although there are some limitations, AWS provides tools to help you migrate to AWS WAFv2, so I recommend that you check the following documentation.  
https://docs.aws.amazon.com/waf/latest/developerguide/waf-migrating-procedure-automatic.html

re:Post Agent · Answer

To safely delete an AWS WAF Classic (v1), you should follow these steps:

1. Check for usage: Before deleting, it's crucial to verify if the WAF Classic is being used by any services. AWS WAF will typically warn you if an entity (like a web ACL, rule, or rule group) is currently in use when you attempt to delete it. However, to be absolutely certain:

- Check your web ACLs: Look for any web ACLs that might be using rules or rule groups from the WAF Classic you want to delete.
   - Examine associated resources: Check if the web ACLs are associated with any AWS resources like Application Load Balancers, or API Gateway APIs.

2. Remove associations: If you find any associations, you'll need to remove them before deletion:
   - For each web ACL, go to the "AWS resources using this web ACL" section.
   - Remove associations by choosing the "x" next to each listed resource.

3. Remove rules from web ACLs: 
   - Edit each web ACL that's using rules from the WAF Classic you want to delete.
   - Remove all associated rules by choosing the "x" next to each rule.
   - Update the web ACL after removing the rules.

4. Delete the web ACLs: Once all associations and rules are removed, you can delete the web ACLs themselves.

5. Delete rules and rule groups: After ensuring they're not used in any web ACLs, you can delete individual rules and rule groups.

6. Final deletion: Once all dependencies are removed, you can proceed with deleting the AWS WAF Classic (v1) itself.

Remember, AWS WAF Classic support will end on September 30, 2025, so it's advisable to migrate to the latest version of AWS WAF if you haven't already done so. Always double-check your actions when deleting security-related resources to avoid unintended consequences.  
**Sources**  
[Deleting a rule - AWS WAF, AWS Firewall Manager, and AWS Shield Advanced](https://docs.aws.amazon.com/waf/latest/developerguide/classic-web-acl-rules-deleting.html)  
[Deleting a Web ACL - AWS WAF, AWS Firewall Manager, and AWS Shield Advanced](https://docs.aws.amazon.com/waf/latest/developerguide/classic-web-acl-deleting.html)  
[Deleting a rule group - AWS WAF, AWS Firewall Manager, and AWS Shield Advanced](https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-group-deleting.html)  
[Data protection in AWS WAF Classic - AWS WAF, AWS Firewall Manager, and AWS Shield Advanced](https://docs.aws.amazon.com/waf/latest/developerguide/classic-data-protection.html)

How to safely delete AWS WAF Classic (v1)

Add your answer

Relevant content