How to Import an AWS WAFv2 Web ACL Association into Terraform

Import AWS WAFv2 Web ACL Association with Terraback (recommended)

Terraback reverse-engineers your live infrastructure: it reads the AWS WAF resource with read-only credentials, generates the HCL, and produces the exact import block. Two commands take you from a live AWS WAFv2 Web ACL Association to managed Terraform.

terraback scan all aws --region us-east-1

terraback aws import --method bulk

The Terraform import block

Terraback emits a Terraform 1.5+ import block like the one below. Because the block lives in your configuration, the import is reviewable in a pull request and repeatable across environments.

import {
  to = aws_wafv2_web_acl_association.example
  id = "arn:aws:wafv2:us-east-1:123456789012:regional/webacl/example/abcd1234,arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/app/example/0123456789abcdef"
}

Example aws_wafv2_web_acl_association configuration

Here is a realistic AWS WAFv2 Web ACL Association block. Terraback generates a fuller version from your actual resource attributes; this is a minimal, valid starting point.

resource "aws_wafv2_web_acl_association" "example" {
  web_acl_arn  = "arn:aws:wafv2:us-east-1:123456789012:regional/webacl/example/abcd1234"
  resource_arn = "arn:aws:elasticloadbalancing:us-east-1:123456789012:loadbalancer/app/example/0123456789abcdef"
}

Gotchas when importing a AWS WAFv2 Web ACL Association

• The association links an existing aws_wafv2_web_acl to a protected resource (ALB, API Gateway stage, AppSync, Cognito); the import ID is the two ARNs joined by a comma, web ACL ARN first.
• Only REGIONAL-scope web ACLs use this resource; CloudFront associations are set on the distribution's web_acl_id instead, so do not try to associate a CLOUDFRONT-scope ACL here.
• Both ARNs are force-new; changing either re-creates the association, briefly leaving the resource unprotected during the swap.
• The web ACL and the protected resource are separate resources with their own IDs; importing the association does not import the ACL rules or the load balancer.

Doing it manually with terraform import

The native approach is to write the aws_wafv2_web_acl_association block by hand, then run terraform import aws_wafv2_web_acl_association.example <import-id> for every resource, one at a time. That works for a handful of resources, but it does not scale: you author all the HCL yourself and repeat the command for each item. Terraback generates the HCL and the import blocks for your whole account in one pass.

Import other AWS resources