New resource: aws_wafv2_web_acl_rule_group_association

[YakDriver]

Rollback Plan

If a change needs to be reverted, we will publish an updated version of the library.

Changes to Security Controls

Are there any changes to security controls (access controls, encryption, logging) in this pull request? If so, explain.

Description

This pull request introduces a new Terraform resource aws_wafv2_web_acl_rule_group_association to the AWS Provider, addressing a long-standing community need for managing WAFv2 Web ACL rule group associations. The resource enables users to associate rule groups with Web ACLs programmatically through Terraform, providing fine-grained control over WAF configurations including support for override actions. This enhancement fills a critical gap in the provider's WAFv2 coverage.

The implementation includes comprehensive test coverage with three test scenarios covering basic functionality, resource disappears behavior, and override action configurations. All acceptance tests pass successfully, demonstrating the resource's reliability and proper integration with the AWS WAFv2 API. The PR is marked as prioritized by the maintainer team and represents a significant addition to the provider's security-focused capabilities, enabling more complete infrastructure-as-code management of AWS WAF configurations.

Relations

Closes #36941

Relates:

• aws_wafv2_web_acl resource dependency wrong way around #17601
• Updates to rules inside wafv2 web acl forces recreation for all rules #25669
• [Bug]: destruction of wafv2 rule group happens in wrong order #28331
• [New Resource]: WAFv2 update rules shared with Firewall Manager  #36941
• [Enhancement]: aws_wafv2_web_acl rules order is not preserved #36856

References

Output from Acceptance Testing

% make t T=TestAccWAFV2WebACLRuleGroupAssociation_ K=wafv2     
make: Verifying source code with gofmt...
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go1.24.5 test ./internal/service/wafv2/... -v -count 1 -parallel 20 -run='TestAccWAFV2WebACLRuleGroupAssociation_'  -timeout 360m -vet=off
2025/07/30 13:31:20 Creating Terraform AWS Provider (SDKv2-style)...
2025/07/30 13:31:20 Initializing Terraform AWS Provider (SDKv2-style)...
=== RUN   TestAccWAFV2WebACLRuleGroupAssociation_basic
=== PAUSE TestAccWAFV2WebACLRuleGroupAssociation_basic
=== RUN   TestAccWAFV2WebACLRuleGroupAssociation_disappears
=== PAUSE TestAccWAFV2WebACLRuleGroupAssociation_disappears
=== RUN   TestAccWAFV2WebACLRuleGroupAssociation_RuleGroupReference_overrideAction
=== PAUSE TestAccWAFV2WebACLRuleGroupAssociation_RuleGroupReference_overrideAction
=== RUN   TestAccWAFV2WebACLRuleGroupAssociation_RuleGroupReference_ruleActionOverride
=== PAUSE TestAccWAFV2WebACLRuleGroupAssociation_RuleGroupReference_ruleActionOverride
=== RUN   TestAccWAFV2WebACLRuleGroupAssociation_RuleGroupReference_ruleActionOverrideUpdate
=== PAUSE TestAccWAFV2WebACLRuleGroupAssociation_RuleGroupReference_ruleActionOverrideUpdate
=== RUN   TestAccWAFV2WebACLRuleGroupAssociation_RuleGroupReference_priorityUpdate
=== PAUSE TestAccWAFV2WebACLRuleGroupAssociation_RuleGroupReference_priorityUpdate
=== RUN   TestAccWAFV2WebACLRuleGroupAssociation_RuleGroupReference_overrideActionUpdate
=== PAUSE TestAccWAFV2WebACLRuleGroupAssociation_RuleGroupReference_overrideActionUpdate
=== RUN   TestAccWAFV2WebACLRuleGroupAssociation_RuleGroupReference_ruleNameRequiresReplace
=== PAUSE TestAccWAFV2WebACLRuleGroupAssociation_RuleGroupReference_ruleNameRequiresReplace
=== RUN   TestAccWAFV2WebACLRuleGroupAssociation_RuleGroupReference_webACLARNRequiresReplace
=== PAUSE TestAccWAFV2WebACLRuleGroupAssociation_RuleGroupReference_webACLARNRequiresReplace
=== RUN   TestAccWAFV2WebACLRuleGroupAssociation_ManagedRuleGroup_basic
=== PAUSE TestAccWAFV2WebACLRuleGroupAssociation_ManagedRuleGroup_basic
=== RUN   TestAccWAFV2WebACLRuleGroupAssociation_ManagedRuleGroup_withVersion
=== PAUSE TestAccWAFV2WebACLRuleGroupAssociation_ManagedRuleGroup_withVersion
=== RUN   TestAccWAFV2WebACLRuleGroupAssociation_ManagedRuleGroup_ruleActionOverride
=== PAUSE TestAccWAFV2WebACLRuleGroupAssociation_ManagedRuleGroup_ruleActionOverride
=== CONT  TestAccWAFV2WebACLRuleGroupAssociation_basic
=== CONT  TestAccWAFV2WebACLRuleGroupAssociation_RuleGroupReference_overrideActionUpdate
=== CONT  TestAccWAFV2WebACLRuleGroupAssociation_ManagedRuleGroup_basic
=== CONT  TestAccWAFV2WebACLRuleGroupAssociation_RuleGroupReference_webACLARNRequiresReplace
=== CONT  TestAccWAFV2WebACLRuleGroupAssociation_RuleGroupReference_ruleNameRequiresReplace
=== CONT  TestAccWAFV2WebACLRuleGroupAssociation_RuleGroupReference_ruleActionOverride
=== CONT  TestAccWAFV2WebACLRuleGroupAssociation_RuleGroupReference_overrideAction
=== CONT  TestAccWAFV2WebACLRuleGroupAssociation_ManagedRuleGroup_ruleActionOverride
=== CONT  TestAccWAFV2WebACLRuleGroupAssociation_RuleGroupReference_priorityUpdate
=== CONT  TestAccWAFV2WebACLRuleGroupAssociation_ManagedRuleGroup_withVersion
=== CONT  TestAccWAFV2WebACLRuleGroupAssociation_RuleGroupReference_ruleActionOverrideUpdate
=== CONT  TestAccWAFV2WebACLRuleGroupAssociation_disappears
--- PASS: TestAccWAFV2WebACLRuleGroupAssociation_RuleGroupReference_overrideAction (25.53s)
--- PASS: TestAccWAFV2WebACLRuleGroupAssociation_ManagedRuleGroup_basic (25.56s)
--- PASS: TestAccWAFV2WebACLRuleGroupAssociation_RuleGroupReference_ruleActionOverride (28.94s)
--- PASS: TestAccWAFV2WebACLRuleGroupAssociation_disappears (38.99s)
--- PASS: TestAccWAFV2WebACLRuleGroupAssociation_RuleGroupReference_overrideActionUpdate (41.14s)
--- PASS: TestAccWAFV2WebACLRuleGroupAssociation_basic (44.90s)
--- PASS: TestAccWAFV2WebACLRuleGroupAssociation_RuleGroupReference_webACLARNRequiresReplace (49.64s)
--- PASS: TestAccWAFV2WebACLRuleGroupAssociation_ManagedRuleGroup_withVersion (53.63s)
--- PASS: TestAccWAFV2WebACLRuleGroupAssociation_RuleGroupReference_ruleNameRequiresReplace (55.91s)
--- PASS: TestAccWAFV2WebACLRuleGroupAssociation_RuleGroupReference_ruleActionOverrideUpdate (60.33s)
--- PASS: TestAccWAFV2WebACLRuleGroupAssociation_RuleGroupReference_priorityUpdate (60.87s)
--- PASS: TestAccWAFV2WebACLRuleGroupAssociation_ManagedRuleGroup_ruleActionOverride (63.24s)
PASS
ok  	github.com/hashicorp/terraform-provider-aws/internal/service/wafv2	68.241s

[github-actions]

Community Guidelines

This comment is added to every new Pull Request to provide quick reference to how the Terraform AWS Provider is maintained. Please review the information below, and thank you for contributing to the community that keeps the provider thriving! 🚀

Voting for Prioritization

• Please vote on this Pull Request by adding a 👍 reaction to the original post to help the community and maintainers prioritize it.
• Please see our prioritization guide for additional information on how the maintainers handle prioritization.
• Please do not leave +1 or other comments that do not add relevant new information or questions; they generate extra noise for others following the Pull Request and do not help prioritize the request.

Pull Request Authors

• Review the contribution guide relating to the type of change you are making to ensure all of the necessary steps have been taken.
• Whether or not the branch has been rebased will not impact prioritization, but doing so is always a welcome surprise.

[ewbankkit]

LGTM 🚀.

% make testacc TESTARGS='-run=TestAccWAFV2WebACLRuleGroupAssociation_' PKG=wafv2
make: Verifying source code with gofmt...
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go1.24.5 test ./internal/service/wafv2/... -v -count 1 -parallel 20  -run=TestAccWAFV2WebACLRuleGroupAssociation_ -timeout 360m -vet=off
2025/08/07 10:17:10 Creating Terraform AWS Provider (SDKv2-style)...
2025/08/07 10:17:10 Initializing Terraform AWS Provider (SDKv2-style)...
=== RUN   TestAccWAFV2WebACLRuleGroupAssociation_basic
=== PAUSE TestAccWAFV2WebACLRuleGroupAssociation_basic
=== RUN   TestAccWAFV2WebACLRuleGroupAssociation_disappears
=== PAUSE TestAccWAFV2WebACLRuleGroupAssociation_disappears
=== RUN   TestAccWAFV2WebACLRuleGroupAssociation_RuleGroupReference_overrideAction
=== PAUSE TestAccWAFV2WebACLRuleGroupAssociation_RuleGroupReference_overrideAction
=== RUN   TestAccWAFV2WebACLRuleGroupAssociation_RuleGroupReference_ruleActionOverride
=== PAUSE TestAccWAFV2WebACLRuleGroupAssociation_RuleGroupReference_ruleActionOverride
=== RUN   TestAccWAFV2WebACLRuleGroupAssociation_RuleGroupReference_ruleActionOverrideUpdate
=== PAUSE TestAccWAFV2WebACLRuleGroupAssociation_RuleGroupReference_ruleActionOverrideUpdate
=== RUN   TestAccWAFV2WebACLRuleGroupAssociation_RuleGroupReference_priorityUpdate
=== PAUSE TestAccWAFV2WebACLRuleGroupAssociation_RuleGroupReference_priorityUpdate
=== RUN   TestAccWAFV2WebACLRuleGroupAssociation_RuleGroupReference_overrideActionUpdate
=== PAUSE TestAccWAFV2WebACLRuleGroupAssociation_RuleGroupReference_overrideActionUpdate
=== RUN   TestAccWAFV2WebACLRuleGroupAssociation_RuleGroupReference_ruleNameRequiresReplace
=== PAUSE TestAccWAFV2WebACLRuleGroupAssociation_RuleGroupReference_ruleNameRequiresReplace
=== RUN   TestAccWAFV2WebACLRuleGroupAssociation_RuleGroupReference_webACLARNRequiresReplace
=== PAUSE TestAccWAFV2WebACLRuleGroupAssociation_RuleGroupReference_webACLARNRequiresReplace
=== RUN   TestAccWAFV2WebACLRuleGroupAssociation_ManagedRuleGroup_basic
=== PAUSE TestAccWAFV2WebACLRuleGroupAssociation_ManagedRuleGroup_basic
=== RUN   TestAccWAFV2WebACLRuleGroupAssociation_ManagedRuleGroup_withVersion
=== PAUSE TestAccWAFV2WebACLRuleGroupAssociation_ManagedRuleGroup_withVersion
=== RUN   TestAccWAFV2WebACLRuleGroupAssociation_ManagedRuleGroup_ruleActionOverride
=== PAUSE TestAccWAFV2WebACLRuleGroupAssociation_ManagedRuleGroup_ruleActionOverride
=== CONT  TestAccWAFV2WebACLRuleGroupAssociation_basic
=== CONT  TestAccWAFV2WebACLRuleGroupAssociation_RuleGroupReference_overrideActionUpdate
=== CONT  TestAccWAFV2WebACLRuleGroupAssociation_ManagedRuleGroup_basic
=== CONT  TestAccWAFV2WebACLRuleGroupAssociation_ManagedRuleGroup_ruleActionOverride
=== CONT  TestAccWAFV2WebACLRuleGroupAssociation_ManagedRuleGroup_withVersion
=== CONT  TestAccWAFV2WebACLRuleGroupAssociation_RuleGroupReference_webACLARNRequiresReplace
=== CONT  TestAccWAFV2WebACLRuleGroupAssociation_RuleGroupReference_ruleActionOverride
=== CONT  TestAccWAFV2WebACLRuleGroupAssociation_RuleGroupReference_priorityUpdate
=== CONT  TestAccWAFV2WebACLRuleGroupAssociation_RuleGroupReference_ruleActionOverrideUpdate
=== CONT  TestAccWAFV2WebACLRuleGroupAssociation_RuleGroupReference_ruleNameRequiresReplace
=== CONT  TestAccWAFV2WebACLRuleGroupAssociation_RuleGroupReference_overrideAction
=== CONT  TestAccWAFV2WebACLRuleGroupAssociation_disappears
--- PASS: TestAccWAFV2WebACLRuleGroupAssociation_ManagedRuleGroup_withVersion (31.64s)
--- PASS: TestAccWAFV2WebACLRuleGroupAssociation_ManagedRuleGroup_ruleActionOverride (39.17s)
--- PASS: TestAccWAFV2WebACLRuleGroupAssociation_basic (42.99s)
--- PASS: TestAccWAFV2WebACLRuleGroupAssociation_ManagedRuleGroup_basic (43.33s)
--- PASS: TestAccWAFV2WebACLRuleGroupAssociation_RuleGroupReference_ruleNameRequiresReplace (46.34s)
--- PASS: TestAccWAFV2WebACLRuleGroupAssociation_RuleGroupReference_ruleActionOverride (48.20s)
--- PASS: TestAccWAFV2WebACLRuleGroupAssociation_RuleGroupReference_priorityUpdate (50.00s)
--- PASS: TestAccWAFV2WebACLRuleGroupAssociation_RuleGroupReference_webACLARNRequiresReplace (53.43s)
--- PASS: TestAccWAFV2WebACLRuleGroupAssociation_RuleGroupReference_overrideActionUpdate (58.60s)
--- PASS: TestAccWAFV2WebACLRuleGroupAssociation_disappears (60.70s)
--- PASS: TestAccWAFV2WebACLRuleGroupAssociation_RuleGroupReference_overrideAction (69.06s)
--- PASS: TestAccWAFV2WebACLRuleGroupAssociation_RuleGroupReference_ruleActionOverrideUpdate (75.19s)
PASS
ok  	github.com/hashicorp/terraform-provider-aws/internal/service/wafv2	80.539s

[github-actions]

Warning

This Issue has been closed, meaning that any additional comments are much easier for the maintainers to miss. Please assume that the maintainers will not see them.

Ongoing conversations amongst community members are welcome, however, the issue will be locked after 30 days. Moving conversations to another venue, such as the AWS Provider forum, is recommended. If you have additional concerns, please open a new issue, referencing this one where needed.

[github-actions]

This functionality has been released in v6.8.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.