The Complete Production SOP: How to Deploy and Run AWS WAF Managed Rule Groups & Web ACL Rules in Autonomous AI Agents

---
name: "aws-waf-managed-rule-groups"
description: "Deploy AWS WAF to protect CloudFront distributions and Application Load Balancers."
metadata:
  author: "AWS"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "configure aws waf web acl"
  - "enable aws managed rule sets"
  - "create rate-based rule aws waf"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

resource "aws_wafv2_web_acl" "main" {
  name        = "production-web-acl"
  description = "Managed rule groups with rate limiting in count/evaluation mode"
  scope       = "REGIONAL"

  default_action {
    allow {}
  }

  rule {
    name     = "AWS-AWSManagedRulesCommonRuleSet"
    priority = 1

    override_action {
      count {}
    }

    statement {
      managed_rule_group_statement {
        name        = "AWSManagedRulesCommonRuleSet"
        vendor_name = "AWS"
      }
    }

    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "ProductionWebACL-CommonRuleSet"
      sampled_requests_enabled   = true
    }
  }

  rule {
    name     = "RateLimitRule"
    priority = 2

    action {
      count {}
    }

    statement {
      rate_based_statement {
        limit              = 2000
        aggregate_key_type = "IP"
      }
    }

    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "ProductionWebACL-RateLimit"
      sampled_requests_enabled   = true
    }
  }

  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name                = "ProductionWebACL-Total"
    sampled_requests_enabled   = true
  }
}