Status: IN
WAF web ACL association with API Gateway is per API stage, not per API — different stages can have different web ACLs, and only Regional web ACLs (not CloudFront-scoped) work with API Gateway.
Source: entries/2026/03/11/apigateway-latest-developerguide-apigateway-control-access-aws-wafhtml.md