diff --git a/modules/l1/vpc/examples/complex.yml b/modules/l1/vpc/examples/complex.yml
index bc28386..4687346 100644
--- a/modules/l1/vpc/examples/complex.yml
+++ b/modules/l1/vpc/examples/complex.yml
@@ -1,12 +1,12 @@
-# Complex VPC with 3 AZs and a custom CIDR
+# Complex VPC with 3 AZs (same CIDR as simple — modify, not replace)
 environment: dev
 id: vpc
 infrastructure:
   vpc:
     inputs:
       azs: us-east-1a,us-east-1b,us-east-1c
-      cidr: 10.50.0.0/16
-      name: my-production-vpc
+      cidr: 10.0.0.0/16
+      name: my-vpc
       region: us-east-1
     version: 1.0.0
 name: vpc-network
diff --git a/modules/l1/vpc/terraform/main.tf b/modules/l1/vpc/terraform/main.tf
index 3b23246..de17778 100644
--- a/modules/l1/vpc/terraform/main.tf
+++ b/modules/l1/vpc/terraform/main.tf
@@ -3,6 +3,10 @@ resource "aws_vpc" "this" {
   tags = {
     Name = local.name_tag
   }
+
+  lifecycle {
+    create_before_destroy = true
+  }
 }
 
 resource "aws_subnet" "this" {
diff --git a/modules/l1/waf/examples/complex.yml b/modules/l1/waf/examples/complex.yml
index bb032c7..0cbef8b 100644
--- a/modules/l1/waf/examples/complex.yml
+++ b/modules/l1/waf/examples/complex.yml
@@ -7,6 +7,6 @@ infrastructure:
       default_action: allow
       name: my-production-waf
       region: us-east-1
-      scope: cloudfront
+      scope: CLOUDFRONT
     version: 1.0.0
 name: waf-firewall
diff --git a/modules/l1/waf/terraform/locals.tf b/modules/l1/waf/terraform/locals.tf
index c2ae966..4656e46 100644
--- a/modules/l1/waf/terraform/locals.tf
+++ b/modules/l1/waf/terraform/locals.tf
@@ -1,3 +1,4 @@
 locals {
   action_type = var.default_action == "block" ? "block" : "allow"
+  scope       = upper(var.scope)
 }
diff --git a/modules/l1/waf/terraform/main.tf b/modules/l1/waf/terraform/main.tf
index 942eef4..700bb0d 100644
--- a/modules/l1/waf/terraform/main.tf
+++ b/modules/l1/waf/terraform/main.tf
@@ -1,6 +1,6 @@
 resource "aws_wafv2_web_acl" "this" {
   name  = var.name
-  scope = var.scope
+  scope = local.scope
 
   default_action {
     dynamic "allow" {