Troubleshooting: Managed rule group is enabled but shows 0 blocked requests.

Hey folks, I've been diving deep into configuring AWS WAF on our EKS ingress controllers lately, and I've hit a puzzling scenario I wanted to run by the community. I've set up the AWS Managed Rule Groups—specifically the `AWSManagedRulesCommonRuleSet`—on our Application Load Balancer, and the CloudWatch metrics show the rule group is `Enabled`. However, when I check the sampled requests or the metrics for `BlockedRequests`, it's consistently showing **0**, even though I'm *certain* there's malicious traffic that should be tripping these rules. Our own custom rules are blocking things just fine, so the WAF is operational.

Here's a snippet of the relevant part from my Terraform configuration for the web ACL association and rule priority. We're using a Terraform-based GitOps flow, so everything is declarative.

```hcl
resource "aws_wafv2_web_acl" "main" {
name = "eks-ingress-waf"
scope = "REGIONAL"
description = "WAF for EKS ingress ALB"

default_action {
allow {}
}

rule {
name = "AWSManagedRulesCommonRuleSet"
priority = 10

override_action {
none {}
}

statement {
managed_rule_group_statement {
name = "AWSManagedRulesCommonRuleSet"
vendor_name = "AWS"
}
}

visibility_config {
cloudwatch_metrics_enabled = true
metric_name = "AWSManagedRulesCommonRuleSet"
sampled_requests_enabled = true
}
}

visibility_config {
cloudwatch_metrics_enabled = true
sampled_requests_enabled = true
}
}

# Association to ALB
resource "aws_wafv2_web_acl_association" "main" {
resource_arn = aws_lb.main.arn
web_acl_arn = aws_wafv2_web_acl.main.arn
}
```

I've double-checked a few things, but maybe I'm missing a nuance:

* The rule group's **override action** is set to `none`, which means it should be using the individual rule actions within the managed group (which are mostly `Block`).
* The web ACL's **default action** is `allow`, which is correct—I want explicit blocks to come from the rules.
* CloudWatch shows the `AllowedRequests` metric is counting, so traffic is flowing through the WAF.

Has anyone else encountered this? I'm wondering if:

* There's a known delay or quirk with how managed rule group metrics are reported?
* The traffic patterns need to be *extremely* obvious for the managed rules to trigger? I've tried simple SQLi attempts in query params.
* Could it be related to the **request body inspection** configuration? I haven't explicitly set `forwarded_ip_config` or `cookies` override for the managed group.
* Or perhaps the ALB listener protocol/ports (we're HTTPS:443) influence how rules are evaluated?

I'm planning to run some more controlled tests, but any insights from your own battles with WAFv2 and managed rules would be super helpful. The documentation says it "just works," but we all know the devil's in the details when it comes to cloud security! 🔍