Comment by aynsof

This isn't accurate. AWS added Managed Rulesets several years ago: https://aws.amazon.com/marketplace/solutions/security/waf-ma...