Determine the scope: use REGIONAL for Application Load Balancers, API Gateway, or AppSync; use CLOUDFRONT for CloudFront distributions (must be created in us-east-1 regardless of distribution region).
Create a web ACL with the create-web-acl CLI command or CreateWebACL API call; provide Name, Scope, DefaultAction (Allow or Block), and VisibilityConfig with CloudWatch metric name and sampling enabled.
Add managed rule groups inside the Rules array using ManagedRuleGroupStatement: set VendorName to AWS for AWS Managed Rules; set Name to the rule group (for example AWSManagedRulesCommonRuleSet or AWSManagedRulesKnownBadInputsRuleSet); set Priority to a unique integer (lower number evaluates first).
Attach the web ACL to your resource with associate-web-acl (for ALB or API Gateway) or by referencing the ACL ARN in your CloudFormation/Terraform template for CloudFront.
Enable AWS WAF logging by creating a Kinesis Data Firehose delivery stream or CloudWatch Log Group and calling PutLoggingConfiguration with the web ACL ARN and the log destination ARN.
Use DescribeManagedRuleGroup to inspect which rules a managed rule group contains and their labels before deploying, so you can add RuleActionOverrides to count (rather than block) specific rules during initial rollout.
Known gotchas
Web ACL capacity units (WCUs) are limited to 5,000 per ACL; each managed rule group consumes a fixed WCU amount (for example AWSManagedRulesCommonRuleSet consumes 700 WCUs)—verify your total before adding multiple groups.
CloudFront-scoped web ACLs must be created in the us-east-1 region even if your CloudFront distribution serves global traffic; creating an ACL in another region and trying to attach it to CloudFront will fail.
AWS Managed Rules update their rule content without version bumps by default (dynamic versioning); pin to a specific static version via ManagedRuleGroupStatement.Version if you need stable, tested rule behaviour and can tolerate manual update workflows.
Give your agent this knowledge — and 200+ more routes
One MCP install gives any agent live access to the full route map, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp