How to fix Error: Error creating WAF WebACL: WAFLimitsExceededException in Terraform

# BAD: Creating a separate IP set for each WebACL
resource "aws_wafv2_ip_set" "api_ips_webacl1" {
  name = "api-ips-webacl1"
  # ...
}

resource "aws_wafv2_ip_set" "api_ips_webacl2" {
  name = "api-ips-webacl2"
  # ...
}

# GOOD: Create one shared IP set
resource "aws_wafv2_ip_set" "api_ips" {
  name = "api-ips-shared"
  # ...
}

# Reference the same IP set in multiple WebACLs
resource "aws_wafv2_web_acl" "api_protection_1" {
  name = "api-protection-1"
  rules {
    statement {
      ip_set_reference_statement {
        arn = aws_wafv2_ip_set.api_ips.arn
      }
    }
  }
}

resource "aws_wafv2_web_acl" "api_protection_2" {
  name = "api-protection-2"
  rules {
    statement {
      ip_set_reference_statement {
        arn = aws_wafv2_ip_set.api_ips.arn
      }
    }
  }
}

# BAD: Multiple rules consuming more WCU
resource "aws_wafv2_web_acl" "example" {
  rules {
    action {
      block {}
    }
    statement {
      rate_based_statement {
        limit = 2000
      }
    }
  }
  rules {
    action {
      block {}
    }
    statement {
      ip_set_reference_statement {
        arn = aws_wafv2_ip_set.malicious_ips.arn
      }
    }
  }
  rules {
    action {
      block {}
    }
    statement {
      sql_injection_match_statement {}
    }
  }
}

# GOOD: Combine with AND statement
resource "aws_wafv2_web_acl" "example" {
  rules {
    action {
      block {}
    }
    statement {
      and_statement {
        statement {
          rate_based_statement {
            limit = 2000
          }
        }
        statement {
          or_statement {
            statement {
              ip_set_reference_statement {
                arn = aws_wafv2_ip_set.malicious_ips.arn
              }
            }
            statement {
              sql_injection_match_statement {}
            }
          }
        }
      }
    }
  }
}

# In Terraform, remove unused resources from your configuration,
# then run terraform plan to verify what will be deleted
terraform plan

# Once verified, apply the changes
terraform apply

# List all WebACLs in a region
aws wafv2 list-web-acls --scope REGIONAL --region us-east-1

# List all rule groups
aws wafv2 list-rule-groups --scope REGIONAL --region us-east-1

# List all IP sets
aws wafv2 list-ip-sets --scope REGIONAL --region us-east-1

# Each region has independent quotas
provider "aws" {
  alias  = "us-east-1"
  region = "us-east-1"
}

provider "aws" {
  alias  = "eu-west-1"
  region = "eu-west-1"
}

# These use separate quotas and don't count against each other
resource "aws_wafv2_web_acl" "us" {
  provider = aws.us-east-1
  name     = "api-protection-us"
  # ...
}

resource "aws_wafv2_web_acl" "eu" {
  provider = aws.eu-west-1
  name     = "api-protection-eu"
  # ...
}