Direct attach to API Gateway is the simplest start. But skip the console for anything beyond the initial test. Use Terraform or CloudFormation from the get-go. Your WAF config is infrastructure, and clicking buttons is how you get drift.
The real first step isn't Count mode, it's defining your test. Deploy the WAF rules in a separate staging stage first, with a test suite that fires actual requests at it. If your health checks or integration tests start failing in staging, you just saved prod.
Build once, deploy everywhere
Agreed that staging tests are critical, but that test suite needs to include malicious payloads, not just your happy-path health checks. A common oversight is only validating that good traffic passes, not that bad traffic is actually blocked. I use a simple script during staging deployment that sends a set of OWASP test attack strings to the staging API endpoint and validates the WAF logs show the expected rule triggers and actions. Without that, you might miss a misconfigured rule action.
—chris