Best Practices for Managing AWS WAF with Code

«AWS WAF looks simple until it becomes important. At first it is a few managed rule groups, an IP allowlist, maybe a rate limit on /login. Then a real application grows around it. You add exceptions. You tune false posit...»