resource/aws_wafv2_web_acl: add monetize action and monetization_config

[arditti]

Description

AWS WAF now supports charging for a web request natively — a new per-rule monetize action (alongside allow / block / count / captcha / challenge) plus a WebACL/RuleGroup-level monetization_config. This PR adds Terraform support to aws_wafv2_web_acl and aws_wafv2_rule_group.

Announced GA 2026-06-15: https://aws.amazon.com/blogs/aws/aws-waf-adds-ai-traffic-monetization-capability-to-help-content-owners-charge-ai-bots-for-content-access/

Changes

• aws_wafv2_web_acl / aws_wafv2_rule_group: new monetize rule action with price_multiplier (integer 1–100).
• aws_wafv2_web_acl / aws_wafv2_rule_group: new monetization_config block — crypto_config.payment_network[].{chain, wallet_address, prices[].{amount, currency}} and currency_mode. The API requires this when any rule uses the monetize action.
• Field validation mirrors the WAF API Reference (enums for chain/currency/currency_mode; length + pattern for amount, wallet_address, price_multiplier).
• Acceptance tests (CLOUDFRONT scope), website docs, and changelog.

Depends on aws-sdk-go-v2/service/wafv2 v1.73.0 (merged via #48423).

Relations

Closes #48418

References

• https://aws.amazon.com/blogs/aws/aws-waf-adds-ai-traffic-monetization-capability-to-help-content-owners-charge-ai-bots-for-content-access/
• https://docs.aws.amazon.com/waf/latest/APIReference/API_CreateWebACL.html

Output from Acceptance Testing

$ make testacc TESTS=TestAccWAFV2WebACL_monetize\|TestAccWAFV2RuleGroup_monetize PKG=wafv2

--- PASS: TestAccWAFV2RuleGroup_monetize (30.82s)
--- PASS: TestAccWAFV2WebACL_monetize (32.59s)
PASS
ok  	github.com/hashicorp/terraform-provider-aws/internal/service/wafv2	41.321s

[github-actions]

Community Guidelines

This comment is added to every new Pull Request to provide quick reference to how the Terraform AWS Provider is maintained. Please review the information below, and thank you for contributing to the community that keeps the provider thriving! 🚀

Voting for Prioritization

• Please vote on this Pull Request by adding a 👍 reaction to the original post to help the community and maintainers prioritize it.
• Please see our prioritization guide for additional information on how the maintainers handle prioritization.
• Please do not leave +1 or other comments that do not add relevant new information or questions; they generate extra noise for others following the Pull Request and do not help prioritize the request.

Pull Request Authors

• Review the contribution guide relating to the type of change you are making to ensure all of the necessary steps have been taken.
• Whether or not the branch has been rebased will not impact prioritization, but doing so is always a welcome surprise.

[arditti]

Blocked on aws-sdk-go-v2/service/wafv2 — requires the MonetizeAction / MonetizationConfig shapes, not yet in the pinned v1.71.5. The live API already accepts the Monetize rule action (verified via CheckCapacity) and the API Reference documents both shapes, so this is purely waiting on the SDK release. Will bump go.mod, add the schema/expand/flatten + acceptance tests, and mark ready for review once available.

[github-actions]

✅ Thank you for correcting the previously detected issues! The maintainers appreciate your efforts to make the review process as smooth as possible.

[arditti]

Unblocked: aws-sdk-go-v2/service/wafv2 v1.73.0 ships the MonetizeAction and MonetizationConfig shapes. The implementation (schema, expand/flatten, CRUD wiring, acceptance tests, docs, changelog) is complete and go build / gofmt / go vet pass locally. Marking ready for review.

[arditti]

Re: the dependency-changes automation warning — understood, and converting back to draft.

This feature requires aws-sdk-go-v2/service/wafv2 v1.73.0 (first release with the MonetizeAction and MonetizationConfig shapes); main currently pins v1.72.4, which does not have them. Per the Dependency Updates guidance that SDK bumps are handled by dependabot/maintainers rather than in feature PRs, the go.mod/go.sum changes here should not be part of this PR.

Plan: once wafv2 is bumped to >= v1.73.0 (via dependabot), I'll rebase this branch onto it and drop the dependency changes so this PR contains only the resource code, tests, docs, and changelog. Keeping it as a draft until then. Please let me know if you'd prefer I close and re-open after the bump, or keep this branch parked.

[ewbankkit]

@arditti Thanks for the contribution 🎉 👏.
I have just merged the AWS SDK for Go v2 update: #48423.

[arditti]

Thanks for merging #48423. I've rebased onto main (now on aws-sdk-go-v2/service/wafv2 v1.73.0) and dropped the dependency changes, so this PR is now code-only.

While running the acceptance tests I found that aws_wafv2_rule_group also requires a MonetizationConfig when a rule uses the Monetize action (the API returns MonetizeAction requires MonetizationConfig to be configured on the RuleGroup), so I added monetization_config to the rule group resource as well, mirroring the web ACL.

Both acceptance tests pass against CLOUDFRONT scope:

--- PASS: TestAccWAFV2RuleGroup_monetize (30.82s)
--- PASS: TestAccWAFV2WebACL_monetize (32.59s)
PASS
ok  	github.com/hashicorp/terraform-provider-aws/internal/service/wafv2	41.321s

Marking ready for review.

[arditti]

Full test run

Verified the complete change set locally before review. Summary:

Acceptance tests (CLOUDFRONT scope, us-east-1):

$ TF_ACC=1 go test ./internal/service/wafv2/ \
    -run '^TestAccWAFV2WebACL_monetize$|^TestAccWAFV2RuleGroup_monetize$' -v -timeout 40m

--- PASS: TestAccWAFV2RuleGroup_monetize (30.82s)
--- PASS: TestAccWAFV2WebACL_monetize (32.59s)
PASS
ok  	github.com/hashicorp/terraform-provider-aws/internal/service/wafv2	41.321s

Each test exercises the full lifecycle: create → read → ImportStateVerify → destroy, covering both the per-rule monetize action (price_multiplier) and the monetization_config block (crypto_config.payment_network[].{chain, wallet_address, prices[].{amount, currency}}, currency_mode).

Static checks (against main @ aws-sdk-go-v2/service/wafv2 v1.73.0):

• go build ./internal/service/wafv2/ — ok
• gofmt -l internal/service/wafv2/ — clean
• go vet ./internal/service/wafv2/ — ok
• go test ./internal/service/wafv2/ (unit) — ok
• terraform fmt -check on the new config blocks — clean

The diff is code-only (no go.mod/go.sum changes); the SDK bump landed separately via #48423.

[robertgv]

Hi @ewbankkit @arditti !

Thanks for working on this. 🎉

Do you have any idea when this feature might be released?

Thanks!

[arditti]

Hi @robertgv — release timing depends on when this gets reviewed and merged; after that it ships with the next weekly provider release.

To ease the review, I've just rebased the branch onto the latest main (still a code-only, single-commit diff) and re-ran the acceptance tests — both pass against CLOUDFRONT scope:

--- PASS: TestAccWAFV2RuleGroup_monetize (19.54s)
--- PASS: TestAccWAFV2WebACL_monetize (19.73s)

[robertgv]

Thank you @arditti! 👏

@ewbankkit @justinretzolk I’d be very interested in trying out this new feature via Terraform. Is there anything I can help with to prioritize the merge?

Thank you!