wafv2: support native WAF request monetization (Monetize action + MonetizationConfig)

[arditti]

Description

AWS WAF now supports charging for a web request natively — a new per-rule
Monetize action (alongside the existing Allow / Block / Count /
Captcha / Challenge) together with a WebACL-level monetization configuration.
This enables pay-per-request / AI-traffic monetization (x402-style HTTP 402
"Payment Required" challenges) directly at the edge, without Lambda@Edge.

The provider's wafv2 rule action block and aws_wafv2_web_acl schema do not
yet expose this. I'd like to add support.

Announcement: https://aws.amazon.com/blogs/aws/aws-waf-adds-ai-traffic-monetization-capability-to-help-content-owners-charge-ai-bots-for-content-access/ (2026-06-15 (GA))

I'm planning to implement this myself. The live wafv2 API already accepts a
Monetize rule action (verified via CheckCapacity); the remaining dependency
is the aws-sdk-go-v2/service/wafv2 release carrying the Monetize shape and
WebACL MonetizationConfig. If the SDK shape is available I'll open a complete
PR; otherwise I'll open it as a draft and finalize on the SDK bump.

Affected Resource(s) or Data Source(s)

• aws_wafv2_web_acl
• aws_wafv2_rule_group
• aws_wafv2_web_acl (data source)
• aws_wafv2_rule_group (data source)

Potential Terraform Configuration

resource "aws_wafv2_web_acl" "example" {
  name  = "monetize-example"
  scope = "CLOUDFRONT"

  default_action {
    allow {}
  }

  # New: WebACL-level monetization configuration
  monetization_config {
    crypto_config {
      payment_network {
        chain          = "BASE"
        wallet_address = "0x0000000000000000000000000000000000000000"

        prices {
          amount   = "0.001"
          currency = "USDC"
        }
      }
    }

    currency_mode = "REAL" # or "TEST"
  }

  rule {
    name     = "monetize-api"
    priority = 10

    statement {
      byte_match_statement {
        search_string         = "/api"
        positional_constraint = "STARTS_WITH"
        field_to_match {
          uri_path {}
        }
        text_transformation {
          priority = 0
          type     = "NONE"
        }
      }
    }

    # New: per-rule Monetize action
    action {
      monetize {
        price_multiplier = "5"
      }
    }

    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "monetize-api"
      sampled_requests_enabled   = true
    }
  }

  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name                = "monetize-example"
    sampled_requests_enabled   = true
  }
}

References

• AWS What's New: https://aws.amazon.com/blogs/aws/aws-waf-adds-ai-traffic-monetization-capability-to-help-content-owners-charge-ai-bots-for-content-access/
• AWS WAF Developer Guide — rule actions: https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-action.html
• Live API surface (observed): per-rule Action: { Monetize: { PriceMultiplier } }
  and WebACL-level MonetizationConfig { CryptoConfig { PaymentNetworks[] { Chain, WalletAddress, Prices[] { Amount, Currency } } }, CurrencyMode }.

Would you like to implement the enhancement?

Yes.

[github-actions]

Community Guidelines

This comment is added to every new Issue to provide quick reference to how the Terraform AWS Provider is maintained. Please review the information below, and thank you for contributing to the community that keeps the provider thriving! 🚀

Voting for Prioritization

• Please vote on this Issue by adding a 👍 reaction to the original post to help the community and maintainers prioritize it.
• Please see our prioritization guide for additional information on how the maintainers handle prioritization.
• Please do not leave +1 or other comments that do not add relevant new information or questions; they generate extra noise for others following the Issue and do not help prioritize the request.

Volunteering to Work on This Issue

• If you are interested in working on this issue, please leave a comment.
• If this would be your first contribution, please review the contribution guide.
• For new resources and data sources, use skaff to generate scaffolding with comments detailing common expectations.

[ewbankkit]

Requires AWS SDK for Go v2 Release 2026-06-15: #48423.

[arditti]

Update: the SDK dependency has landed and the PR (#48419) is ready for review.

• SDK: main now pins aws-sdk-go-v2/service/wafv2 v1.73.0 (the first release carrying the MonetizeAction / MonetizationConfig shapes), via build(deps): bump the aws-sdk-go-v2 group across 1 directory with 6 updates #48423. resource/aws_wafv2_web_acl: add monetize action and monetization_config #48419 has been rebased onto main and the diff is code-only — no go.mod/go.sum changes.
• Scope: implemented on both aws_wafv2_web_acl and aws_wafv2_rule_group — the per-rule monetize action (price_multiplier) plus the monetization_config block (crypto_config.payment_network[].{chain, wallet_address, prices[].{amount, currency}}, currency_mode). Acceptance testing surfaced that the API also requires MonetizationConfig on the rule group when a rule uses the Monetize action, so the rule group got the block too.

Full test run (CLOUDFRONT scope, us-east-1):

$ TF_ACC=1 go test ./internal/service/wafv2/ \
    -run '^TestAccWAFV2WebACL_monetize$|^TestAccWAFV2RuleGroup_monetize$' -v -timeout 40m

--- PASS: TestAccWAFV2RuleGroup_monetize (30.82s)
--- PASS: TestAccWAFV2WebACL_monetize (32.59s)
PASS
ok  	github.com/hashicorp/terraform-provider-aws/internal/service/wafv2	41.321s

Each test exercises the full create → read → ImportStateVerify → destroy lifecycle. Static checks (go build, gofmt -l, go vet, unit go test, terraform fmt -check) all pass against main.

Schema validation mirrors the public API Reference (API_CreateWebACL): required/optional flags, enums, length, and patterns per the documented field constraints.