Best Practices for Managing AWS WAF with Code

AWS WAF looks simple until it becomes important. At first it is a few managed rule groups, an IP allowlist, maybe a rate limit on /login . Then a real application grows around it. You add exceptions. ...