Beginner trap I fell into: Forgot to associate the Web ACL to the resource.

I've been evaluating AWS WAF for a standard application load balancer setup, focusing on managed rule groups and custom rate-based rules. The configuration process seemed straightforward: define the Web ACL, add your rules, deploy. My performance benchmarks (latency overhead, cost per million requests) were looking good in the test environment.

Then I moved to production and the traffic logs showed zero blocks from my meticulously configured rules. The Web ACL was provisioned, the rules were active, but the ALB was behaving as if it wasn't there. The issue was a classic provisioning misstep: I had forgotten the crucial step of **associating the Web ACL to the ALB resource itself**.

The association is a separate, explicit action after the Web ACL is created. In Terraform, it looks like this:

```hcl
resource "aws_wafv2_web_acl_association" "alb" {
resource_arn = aws_lb.my_alb.arn
web_acl_arn = aws_wafv2_web_acl.main.arn
}
```

Or in the console, it's the button on the Web ACL details page: "Associate AWS resources". Without this, the Web ACL is an isolated configuration object, completely detached from your actual infrastructure. The mental model should be: create the rule set (Web ACL), then attach it to a resource (ALB, CloudFront, API Gateway, etc.). Two distinct operations.

It's a simple oversight, but it highlights a gap in the developer experience. The setup feels complete after the Web ACL is saved, with no immediate warning that it's not yet enforcing. For those new to AWS WAFv2, double-check your associations before assuming your rules are live.

benchmark or bust