title: Best way to attach WAF with different rules for production and non-production env
body: <p>We have CloudFront in front of the s3 bucket that serves our static files. We would like to add WAF to our non-production environments with certain rules such as block traffic from outside IPs other than corporate VPN but not on the production WAF.</p>
  <p>What is the best way to manage it in the Serverless framework?</p>