I know this is an old thread now, but I just came back to it and thought to dig in a bit. First thing my Googling hit was this, which provides a good comparison of App Runner and Fargate

https://cloudonaut.io/fargate-vs-apprunner/

That lack of WAF support stood out. So Googling that:

https://github.com/aws/apprunner-roadmap/issues/58

"Hello, we are looking at supporting WAF in App Runner and will have more updates on this thread going forward. "