Help: My ALB health checks are getting blocked by my WAF. Facepalm.

Setting up a new staging environment with an Application Load Balancer and WAFv2. Health checks from the ALB to my EC2 instances are failing with a 403 from the WAF. The ALB itself is healthy, but the targets are marked unhealthy because the WAF is blocking the health check requests.

I've verified the ALB security group allows traffic, and the target instances are reachable on the health check port when the WAF is bypassed. The issue is clearly the WAF rules.

My current WAF setup is a basic managed rule group (AWSManagedRulesCommonRuleSet) and a few custom rate-based rules. The health check path is `/api/health`, a simple GET.

I need to know the most efficient way to allow ALB health checks through the WAF without disabling security. I've seen suggestions about using the `aws:forwarded_ip` condition, but the documentation is unclear.

Here are my specific questions:

* Is the correct approach to create a rule that whitelists the source IP of the ALB's health checks? If so, how do I reliably get that IP range? Is it the VPC CIDR?
* Or should I use a custom rule that matches the `User-Agent` header (the ALB's health checker has a specific one)?
* What's the most precise condition key to use in the WAFv2 rule statement to avoid creating a loophole?

My current, failing ACL association looks like this:

```json
{
"Name": "staging-web-acl",
"DefaultAction": {
"Allow": {}
},
"Scope": "REGIONAL",
"VisibilityConfig": {
"SampledRequestsEnabled": true,
"CloudWatchMetricsEnabled": true,
"MetricName": "staging-web-acl"
},
"Rules": [
{
"Name": "AWS-AWSManagedRulesCommonRuleSet",
"Priority": 0,
"Statement": {
"ManagedRuleGroupStatement": {
"VendorName": "AWS",
"Name": "AWSManagedRulesCommonRuleSet"
}
},
"OverrideAction": {
"None": {}
},
"VisibilityConfig": {
"SampledRequestsEnabled": true,
"CloudWatchMetricsEnabled": true,
"MetricName": "AWSManagedRulesCommonRuleSet"
}
}
]
}
```

The health check requests are likely being blocked by the Common Rule Set (probably the `GenericRFI` or `SizeRestrictions` rules?). I need a solution that doesn't involve blindly setting rule overrides to `Count` for the entire managed group.