## Summary - Problem: The standalone WAFv2 web ACL rule lost `andStatement`, `notStatement`, and `orStatement` under managed and rate-based scope-down statements after the Plugin Framework migration. The migration also generated 1,578 invalid nested statement types and substantially expanded bridge metadata. - Change: Carry hashicorp/terraform-provider-aws#48280 as an upstream patch, constrain root-only WAF statements to the root level, and teach tfgen to project Plugin Framework scalar NOT statements recursively. Regenerate the schema and all SDKs. - Related issue/PR: Fixes #6546. Upstream: hashicorp/terraform-provider-aws#48280 ## Change Type - [ ] Provider logic only (`provider/`) - [x] Schema or mapping change (may require SDK regeneration) - [x] Upstream or patch pipeline change (`upstream/`, `patches/`, `scripts/upstream.sh`) - [ ] CI workflow source change (`.ci-mgmt.yaml`) ## Validation Evidence - [ ] `make lint` (local `golangci-lint` was built with Go 1.25 and cannot lint a Go 1.26.5 module) - [x] `make test_provider` - [x] If schema-affecting: `make schema` - [x] If schema-affecting: `make build_sdks` - [ ] If CI source changed: `make ci-mgmt` ### Command output snippets ```text make build BUILD SUCCESSFUL memrun: make exited 0; peak RSS 10.8 GB make test_provider PASS ok github.com/pulumi/pulumi-aws/provider/v7 31.633s memrun: make exited 0; peak RSS 10.4 GB make tfgen memrun: make exited 0 # A second forced run produced byte-for-byte identical schema and metadata. make -C upstream test-compile TEST=./internal/service/wafv2 memrun: make exited 0 make -C upstream fmt-check memrun: make exited 0 ``` All v7.23 `WebAclRuleStatement*` schema types remain. The generated type count returns from 2,111 to 533 (v7.23 had 532), removing only the accidental standalone-rule projections introduced in v7.24. Node.js, Python, .NET, Go, and Java SDK builds all pass. ## Risk - Blast radius: The standalone `aws_wafv2_web_acl_rule` resource and its generated SDK types. The longstanding `aws_wafv2_web_acl` resource is unaffected. - Edge cases: This removes invalid nested managed-rule-group, rate-based, and rule-group-reference projections introduced in v7.24. Those statement kinds are now root-only, matching AWS validation and the pre-regression v7.23 schema. Scope-down logical statements recursively reference the root statement type in Pulumi SDKs. ## Rollback - Revert this PR to restore the previous generated schema and SDKs. - Follow-up cleanup: Remove the carried patch after the upstream Terraform provider includes hashicorp/terraform-provider-aws#48280 with equivalent nesting limits. --------- Co-authored-by: Alberto Pose <apose@pulumi.com>