How to fix Error: Error creating WAF WebACL: WAFLimitsExceededException in Terraform

TerraformINTERMEDIATEHIGHUpdated Dec 31, 2025· 85 views

AWS WAF has account-level quotas on the number of WebACLs, rules, and other resources you can create. This error occurs when you exceed those limits. Resolve it by consolidating resources, removing unused WAF entities, or requesting quota increases.

Quick fix

Fixes WAFLimitsExceededException

# BAD: Creating a separate IP set for each WebACL
resource "aws_wafv2_ip_set" "api_ips_webacl1" {
  name = "api-ips-webacl1"
  # ...
}

resource "aws_wafv2_ip_set" "api_ips_webacl2" {
  name = "api-ips-webacl2"
  # ...
}

# GOOD: Create one shared IP set
resource "aws_wafv2_ip_set" "api_ips" {
  name = "api-ips-shared"
  # ...
}

# Reference the same IP set in multiple WebACLs
resource "aws_wafv2_web_acl" "api_protection_1" {
  name = "api-protection-1"
  rules {
    statement {
      ip_set_reference_statement {
        arn = aws_wafv2_ip_set.api_ips.arn
      }
    }
  }
}

resource "aws_wafv2_web_acl" "api_protection_2" {
  name = "api-protection-2"
  rules {
    statement {
      ip_set_reference_statement {
        arn = aws_wafv2_ip_set.api_ips.arn
      }
    }
  }
}
  1. Check which limit you've exceeded in the AWS console
  2. Consolidate rule groups and IP sets
  3. Simplify WebACL rules using nested statements
  4. Remove unused WAF resources
terraform — error
# BAD: Creating a separate IP set for each WebACL
resource "aws_wafv2_ip_set" "api_ips_webacl1" {
  name = "api-ips-webacl1"
  # ...
}
resource "aws_wafv2_ip_set" "api_ips_webacl2" {
  name = "api-ips-webacl2"
  # ...
}
# GOOD: Create one shared IP set
resource "aws_wafv2_ip_set" "api_ips" {
  name = "api-ips-shared"
  # ...
}
# Reference the same IP set in multiple WebACLs
resource "aws_wafv2_web_acl" "api_protection_1" {
  name = "api-protection-1"
  rules {
    statement {
      ip_set_reference_statement {
        arn = aws_wafv2_ip_set.api_ips.arn
      }
    }
  }
}
resource "aws_wafv2_web_acl" "api_protection_2" {
  name = "api-protection-2"
  rules {
    statement {
      ip_set_reference_statement {
        arn = aws_wafv2_ip_set.api_ips.arn
      }
    }
  }
}
Error: Error creating WAF WebACL: WAFLimitsExceededException

What this error means

The WAFLimitsExceededException error occurs when you attempt to create or modify an AWS WAF WebACL (Web Access Control List) and the operation would exceed one of AWS's account-level resource quotas. AWS WAF enforces several limits per account per region, including: - Maximum number of WebACLs per account (default: 100, can be increased) - Maximum Web ACL Capacity Units (WCU) per WebACL (currently up to 5,000) - Maximum number of rule groups, IP sets, and regex pattern sets This error commonly appears in Terraform when deploying or updating aws_wafv2_web_acl resources. The error message from AWS doesn't always specify which quota was exceeded, making troubleshooting more difficult.

Typical symptoms

  • Terraform apply fails when creating or modifying aws_wafv2_web_acl
  • Error message mentions WAFLimitsExceededException without specifying which limit
  • Successfully created WAF resources previously, now hitting limits after adding more rules
  • WebACL creation works in one region but fails in another (quotas are per-region)
  • Rule groups or IP sets appear in UI but can't be referenced in WebACL due to capacity

Common causes

  1. You've created the maximum number of WebACLs allowed for your account in a region (typically 100, but varies by quota type)
  2. Your WebACL has reached the 5,000 Web ACL Capacity Unit (WCU) limit by adding too many rules or complex rule groups
  3. You have too many rule groups, IP sets, or regex pattern sets created (each has its own quota)
  4. You're using single-use rule groups or IP sets instead of consolidating shared resources across multiple WebACLs
  5. A complex rule statement with deep nesting or many conditions exceeds the WCU calculation for a single rule

How to fix "Error: Error creating WAF WebACL: WAFLimitsExceededException"

1Check which limit you've exceeded in the AWS console

Navigate to AWS WAF & Shield in the AWS Management Console and check your current usage against limits:

1. Go to AWS WAF & Shield > Web ACLs > check how many exist in your region
2. Select your WebACL and review the "Capacity" tab to see current WCU usage vs 5,000 limit
3. Check Rule groups, IP sets, and Regex pattern sets quotas under "Resources"
4. Compare against your region's limits in the AWS WAF quotas documentation

This helps identify which specific resource limit is being exceeded.

2Consolidate rule groups and IP sets

Instead of creating single-use rule groups or IP sets, reuse them across multiple WebACLs:

hcl
# BAD: Creating a separate IP set for each WebACL
resource "aws_wafv2_ip_set" "api_ips_webacl1" {
  name = "api-ips-webacl1"
  # ...
}

resource "aws_wafv2_ip_set" "api_ips_webacl2" {
  name = "api-ips-webacl2"
  # ...
}

# GOOD: Create one shared IP set
resource "aws_wafv2_ip_set" "api_ips" {
  name = "api-ips-shared"
  # ...
}

# Reference the same IP set in multiple WebACLs
resource "aws_wafv2_web_acl" "api_protection_1" {
  name = "api-protection-1"
  rules {
    statement {
      ip_set_reference_statement {
        arn = aws_wafv2_ip_set.api_ips.arn
      }
    }
  }
}

resource "aws_wafv2_web_acl" "api_protection_2" {
  name = "api-protection-2"
  rules {
    statement {
      ip_set_reference_statement {
        arn = aws_wafv2_ip_set.api_ips.arn
      }
    }
  }
}

This reduces your total resource count significantly.

3Simplify WebACL rules using nested statements

Instead of many individual rules, use nested AND/OR statements within a single rule to reduce WCU consumption:

hcl
# BAD: Multiple rules consuming more WCU
resource "aws_wafv2_web_acl" "example" {
  rules {
    action {
      block {}
    }
    statement {
      rate_based_statement {
        limit = 2000
      }
    }
  }
  rules {
    action {
      block {}
    }
    statement {
      ip_set_reference_statement {
        arn = aws_wafv2_ip_set.malicious_ips.arn
      }
    }
  }
  rules {
    action {
      block {}
    }
    statement {
      sql_injection_match_statement {}
    }
  }
}

# GOOD: Combine with AND statement
resource "aws_wafv2_web_acl" "example" {
  rules {
    action {
      block {}
    }
    statement {
      and_statement {
        statement {
          rate_based_statement {
            limit = 2000
          }
        }
        statement {
          or_statement {
            statement {
              ip_set_reference_statement {
                arn = aws_wafv2_ip_set.malicious_ips.arn
              }
            }
            statement {
              sql_injection_match_statement {}
            }
          }
        }
      }
    }
  }
}

Check your WebACL capacity usage in the console to understand WCU consumption before and after optimizations.

4Remove unused WAF resources

Identify and remove WebACLs, rule groups, IP sets, and regex pattern sets that are no longer in use:

hcl
# In Terraform, remove unused resources from your configuration,
# then run terraform plan to verify what will be deleted
terraform plan

# Once verified, apply the changes
terraform apply

Use the AWS CLI to find unused resources:

bash
# List all WebACLs in a region
aws wafv2 list-web-acls --scope REGIONAL --region us-east-1

# List all rule groups
aws wafv2 list-rule-groups --scope REGIONAL --region us-east-1

# List all IP sets
aws wafv2 list-ip-sets --scope REGIONAL --region us-east-1

Check your CloudFront or ALB associations to ensure you're not deleting WebACLs that are still in use.

5Request a quota increase (if necessary)

If you've optimized your resources and still need more capacity, request a quota increase:

1. Go to AWS Service Quotas console
2. Search for "WAF" or "Web ACL"
3. Find the quota you need to increase (e.g., "Web ACLs per account")
4. Click on the quota and select "Request quota increase"
5. Enter the desired count and submit
6. Wait for AWS to process the request (typically 1-2 hours, but can take longer)

Example quota names:
- Web ACLs per account (default: 100)
- Web ACL capacity units (WCU) per Web ACL (current: 5000)
- Rule groups per account (default: 100)
- IP sets per account (default: 100)
- Regex pattern sets per account (default: 10)

After approval, your Terraform apply should succeed.

6Spread resources across regions if appropriate

AWS WAF quotas are per-region. If you're deploying to multiple regions and hitting limits, this is expected behavior:

hcl
# Each region has independent quotas
provider "aws" {
  alias  = "us-east-1"
  region = "us-east-1"
}

provider "aws" {
  alias  = "eu-west-1"
  region = "eu-west-1"
}

# These use separate quotas and don't count against each other
resource "aws_wafv2_web_acl" "us" {
  provider = aws.us-east-1
  name     = "api-protection-us"
  # ...
}

resource "aws_wafv2_web_acl" "eu" {
  provider = aws.eu-west-1
  name     = "api-protection-eu"
  # ...
}

If you're seeing errors in multiple regions, check each region's quota separately. You may only need to increase quotas in specific regions.

Advanced notes

Web ACL Capacity Units (WCU) Calculation: AWS WAF assigns WCU values to rules based on complexity. Simple rules (IP match, string match) cost fewer WCU than complex nested statements. If approaching the 5,000 WCU limit, review the "Capacity" tab in your WebACL to see which rules consume the most units.

Region-Specific Limits: Quotas are per-region and per-account. A WebACL in us-east-1 doesn't count toward your quota in eu-west-1. However, the total number of entities across all regions may hit your account-level limits for some resource types.

Managed Rules Consideration: AWS Managed Rules consume WCU when referenced. A single AWS Managed Rule Group (e.g., AWSManagedRulesCommonRuleSet) can consume 700+ WCU, so account for this when designing your WebACL.

Terraform State: When requesting quota increases, you may need to adjust your Terraform configuration after the quota is approved. Sometimes re-running terraform apply without changes is necessary to trigger the operation against the higher quota.

Frequently asked questions

What does "WAFLimitsExceededException" mean?
The WAFLimitsExceededException error occurs when you attempt to create or modify an AWS WAF WebACL (Web Access Control List) and the operation would exceed one of AWS's account-level resource quotas. AWS WAF enforces several limits per account per region, including: - Maximum number of WebACLs per account (default: 100, can be increased) - Maximum Web ACL Capacity Units (WCU) per WebACL (currently up to 5,000) - Maximum number of rule groups, IP sets, and regex pattern sets This error commonly appears in Terraform when deploying or updating aws_wafv2_web_acl resources. The error message from AWS doesn't always specify which quota was exceeded, making troubleshooting more difficult.
How do I fix "WAFLimitsExceededException"?
AWS WAF has account-level quotas on the number of WebACLs, rules, and other resources you can create. This error occurs when you exceed those limits. Resolve it by consolidating resources, removing unused WAF entities, or requesting quota increases.
What causes "WAFLimitsExceededException"?
You've created the maximum number of WebACLs allowed for your account in a region (typically 100, but varies by quota type) Your WebACL has reached the 5,000 Web ACL Capacity Unit (WCU) limit by adding too many rules or complex rule groups You have too many rule groups, IP sets, or regex pattern sets created (each has its own quota)
Is the "WAFLimitsExceededException" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading