title: Error AWS WAFv2 web ACL managed rules when created with terraform
body: <p>I want to create an AWS WAFv2 web acl of Cloudfront scope. I am using AWS managed rules. For Some rules in the managed rule group I have a scop-down statement. The json that I get from AWS is as follows:</p>
  <pre><code>{
    &quot;Name&quot;: &quot;AWS-AWSManagedRulesAdminProtectionRuleSet&quot;,
    &quot;Priority&quot;: 0,
    &quot;Statement&quot;: {
      &quot;ManagedRuleGroupStatement&quot;: {
        &quot;VendorName&quot;: &quot;AWS&quot;,
        &quot;Name&quot;: &quot;AWSManagedRulesAdminProtectionRuleSet&quot;,
        &quot;ScopeDownStatement&quot;: {
          &quot;ByteMatchStatement&quot;: {
            &quot;SearchString&quot;: &quot;abc&quot;,
            &quot;FieldToMatch&quot;: {
              &quot;UriPath&quot;: {}
            },
            &quot;TextTransformations&quot;: [
              {
                &quot;Priority&quot;: 0,
                &quot;Type&quot;: &quot;NONE&quot;
              }
            ],
            &quot;PositionalConstraint&quot;: &quot;CONTAINS_WORD&quot;
          }
        }
      }
    },
    &quot;OverrideAction&quot;: {
      &quot;Count&quot;: {}
    },
    &quot;VisibilityConfig&quot;: {
      &quot;SampledRequestsEnabled&quot;: true,
      &quot;CloudWatchMetricsEnabled&quot;: true,
      &quot;MetricName&quot;: &quot;AWS-AWSManagedRulesAdminProtectionRuleSet&quot;
    }
  }
  </code></pre>
  <p>The AWS documentation <a href="https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-scope-down-statements.html" rel="nofollow noreferrer">here</a> says that scope-down statements are allowed in the Managed rule group statement. However, when I read the Terraform docs <a href="https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/wafv2_web_acl#managed-rule-group-statement" rel="nofollow noreferrer">here</a> we don’t have any option for scope-down statements. When I try to create a rule like the following, it passes terraform validation, however when I apply it I get an AWS error that says that I have added two statements, where one is required. This is very confusing. Is there a way I can achieve this, if yes how? Any help will be highly appreciated.</p>
  <pre><code>rule                                {
      name                            = &quot;AWS-AWSManagedRulesAdminProtectionRuleSet&quot;
      priority                        = 0
      override_action                 {
          count                       {}
      }
      statement                       {
          managed_rule_group_statement {
              name                    = &quot;AWSManagedRulesAdminProtectionRuleSet&quot;
              vendor_name             = &quot;AWS&quot;
          }                      {
          byte_match_statement {
              field_to_match   { 
                  uri_path     {}
              }
              search_string    = &quot;abc&quot;
              text_transformation {
                  priority        = 0
                  type            = &quot;NONE&quot;
              }
              positional_constraint = &quot;CONTAINS_WORD&quot;
          }
      }
      visibility_config               {
          sampled_requests_enabled    = true
          metric_name                 = &quot;AWS-AWSManagedRulesAdminProtectionRuleSet&quot;
          cloudwatch_metrics_enabled  = true
      }
  }
  </code></pre>