WAF new rules warning

Yes, with the release of versioning for managed rule groups, you can choose a specific version of the managed rules you wish to use. Updates are released as new versions, providing you the ability to test them before enabling them in block mode. You can also receive notifications of updates to managed rules via SNS. The announcement here: https://aws.amazon.com/about-aws/whats-new/2021/08/aws-waf-offers-managed-rule-group-versioning/ has further information and links to documentation.

If you have another IAM User/Role who can create new rule and you want to enforce the rule after review from your side, you can guide the IAM User/Role to create new rule with count action. Count action will not allow or block HTTP request but will just count if the request match the rule. So there should be no impact on service traffic and you can change the action to allow/block if you like the rule.

You can also create CloudWatch alarm if someone create new rule.

Below link is for creating CloudWatch Alarm using CloudTrail. The example in this link is for changing security group but you can create CloudWatch alarm for changing WAF rule group with eventName:UpdateWebACL.

https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html

Thanks

Getting notified of new versions and updates to a managed rule group