Hi again, 
For anyone who stumbles across this post, according to AWS Support as of November 2019:
Unfortunately, at the moment of writing, the API call to subscribe managed WAF rule group is not yet supported in CloudFormation and is only available with AWS CLI/SDK and console.
TL;DR: It’s not possible to create Web ACLs configured with marketplace rule groups via CloudFormation/Serverless templates.
Forlornly,
James
