Can I associate the WebACL directly with the API Gateway instead?
Yeah the web ACL should be associated directly with the API Gateway. Edge-optimized API Gateway is still a regional resource so the web ACL should be created in the same region as the API Gateway.