In the documentation it says that WAF works with API Gateway as well, out of box – or so I understand. https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-control-access-aws-waf.html