AWS WAF looks simple until it becomes important.

At first it is a few managed rule groups, an IP allowlist, maybe a rate limit on /login. Then a real application grows around it. You add exceptions. You tune false positives. You need different behavior for APIs, static assets, GraphQL, login pages, admin paths, mobile clients, partners, scanners, and known noisy endpoints.

If all of that logic lives as a pile of one-off console edits, the Web ACL eventually becomes a place people are afraid to touch.

The fix is not only "put it in Terraform." The better fix is to model AWS WAF like a small policy engine:

Rules classify traffic.