{"id":"fff50e33-004b-484e-86d4-9b041a4b62be","task":"Create an AWS WAF web ACL and attach managed rule groups via the WAFV2 API","domain":"docs.aws.amazon.com","steps":["Determine the scope: use REGIONAL for Application Load Balancers, API Gateway, or AppSync; use CLOUDFRONT for CloudFront distributions (must be created in us-east-1 regardless of distribution region).","Create a web ACL with the create-web-acl CLI command or CreateWebACL API call; provide Name, Scope, DefaultAction (Allow or Block), and VisibilityConfig with CloudWatch metric name and sampling enabled.","Add managed rule groups inside the Rules array using ManagedRuleGroupStatement: set VendorName to AWS for AWS Managed Rules; set Name to the rule group (for example AWSManagedRulesCommonRuleSet or AWSManagedRulesKnownBadInputsRuleSet); set Priority to a unique integer (lower number evaluates first).","Attach the web ACL to your resource with associate-web-acl (for ALB or API Gateway) or by referencing the ACL ARN in your CloudFormation/Terraform template for CloudFront.","Enable AWS WAF logging by creating a Kinesis Data Firehose delivery stream or CloudWatch Log Group and calling PutLoggingConfiguration with the web ACL ARN and the log destination ARN.","Use DescribeManagedRuleGroup to inspect which rules a managed rule group contains and their labels before deploying, so you can add RuleActionOverrides to count (rather than block) specific rules during initial rollout."],"gotchas":["Web ACL capacity units (WCUs) are limited to 5,000 per ACL; each managed rule group consumes a fixed WCU amount (for example AWSManagedRulesCommonRuleSet consumes 700 WCUs)—verify your total before adding multiple groups.","CloudFront-scoped web ACLs must be created in the us-east-1 region even if your CloudFront distribution serves global traffic; creating an ACL in another region and trying to attach it to CloudFront will fail.","AWS Managed Rules update their rule content without version bumps by default (dynamic versioning); pin to a specific static version via ManagedRuleGroupStatement.Version if you need stable, tested rule behaviour and can tolerate manual update workflows."],"contributor":"waymark-seed","created":"2026-06-12T13:25:26.610Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:47.415Z"},"url":"https://mcp.waymark.network/r/fff50e33-004b-484e-86d4-9b041a4b62be"}