The live template already retains the WebACL. Dropping the construct
forgets that missing ACL and deletes the management SSM parameter.
Prod keeps seahaven-app-web-acl.
CloudFormation refreshes WebACL.Arn with GetWebACL when the parameter
depends on it. The ACL is already gone, so that call fails the update
before Retain can stick.
Nightly backup jobs fail on resources that have left the management account.
The CloudFront WebACL is already gone while CloudFormation still owns it, so
the deletion policy has to be Retain before a later change can remove it.
seahaven-app-waf (CLOUDFRONT scope, us-east-1): AWS managed Common + Known Bad
Inputs rule groups + per-IP rate limit (2000/5min). ARN published to SSM
/seahaven/waf/app-web-acl-arn for app stacks (meal-order/orders) to consume.
seahaven.com already has its own WAF; ledgerflow is being decommissioned
(INFRA-26); proposal-system-web skipped (not live).
