diff --git a/content/en/docs/ambient/usage/extend-waypoint-wasm/index.md b/content/en/docs/ambient/usage/extend-waypoint-wasm/index.md
index 5591eab9e9..afd4e9c280 100644
--- a/content/en/docs/ambient/usage/extend-waypoint-wasm/index.md
+++ b/content/en/docs/ambient/usage/extend-waypoint-wasm/index.md
@@ -4,7 +4,7 @@ description: Describes how to make remote WebAssembly modules available for ambi
 weight: 55
 keywords: [extensibility,Wasm,WebAssembly,Ambient]
 owner: istio/wg-policies-and-telemetry-maintainers
-test: no
+test: yes
 status: Alpha
 ---
 
diff --git a/content/en/docs/ambient/usage/extend-waypoint-wasm/snips.sh b/content/en/docs/ambient/usage/extend-waypoint-wasm/snips.sh
new file mode 100644
index 0000000000..84611e6c19
--- /dev/null
+++ b/content/en/docs/ambient/usage/extend-waypoint-wasm/snips.sh
@@ -0,0 +1,224 @@
+#!/bin/bash
+# shellcheck disable=SC2034,SC2153,SC2155,SC2164
+
+# Copyright Istio Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+####################################################################################################
+# WARNING: THIS IS AN AUTO-GENERATED FILE, DO NOT EDIT. PLEASE MODIFY THE ORIGINAL MARKDOWN FILE:
+#          docs/ambient/usage/extend-waypoint-wasm/index.md
+####################################################################################################
+
+snip_configure_wasmplugin_for_gateway_1() {
+kubectl get gateway
+}
+
+! IFS=$'\n' read -r -d '' snip_configure_wasmplugin_for_gateway_1_out <<\ENDSNIP
+NAME               CLASS            ADDRESS        PROGRAMMED   AGE
+bookinfo-gateway   istio            172.18.7.110   True         23h
+ENDSNIP
+
+snip_configure_wasmplugin_for_gateway_2() {
+kubectl apply -f - <<EOF
+apiVersion: extensions.istio.io/v1alpha1
+kind: WasmPlugin
+metadata:
+  name: basic-auth-at-gateway
+spec:
+  targetRefs:
+    - kind: Gateway
+      group: gateway.networking.k8s.io
+      name: bookinfo-gateway # gateway name retrieved from previous step
+  url: oci://ghcr.io/istio-ecosystem/wasm-extensions/basic_auth:1.12.0
+  phase: AUTHN
+  pluginConfig:
+    basic_auth_rules:
+      - prefix: "/productpage"
+        request_methods:
+          - "GET"
+          - "POST"
+        credentials:
+          - "ok:test"
+          - "YWRtaW4zOmFkbWluMw=="
+EOF
+}
+
+snip_verify_the_traffic_via_the_gateway_1() {
+kubectl exec deploy/sleep -- curl -s -w "%{http_code}" -o /dev/null "http://$GATEWAY_HOST/productpage"
+}
+
+! IFS=$'\n' read -r -d '' snip_verify_the_traffic_via_the_gateway_1_out <<\ENDSNIP
+401
+ENDSNIP
+
+snip_verify_the_traffic_via_the_gateway_2() {
+kubectl exec deploy/sleep -- curl -s -o /dev/null -H "Authorization: Basic YWRtaW4zOmFkbWluMw==" -w "%{http_code}" "http://$GATEWAY_HOST/productpage"
+}
+
+! IFS=$'\n' read -r -d '' snip_verify_the_traffic_via_the_gateway_2_out <<\ENDSNIP
+200
+ENDSNIP
+
+snip_deploy_a_waypoint_proxy_1() {
+istioctl x waypoint apply --enroll-namespace --wait
+}
+
+snip_verify_traffic_without_wasmplugin_at_the_waypoint_1() {
+kubectl exec deploy/sleep -- curl -s -w "%{http_code}" -o /dev/null http://productpage:9080/productpage
+}
+
+! IFS=$'\n' read -r -d '' snip_verify_traffic_without_wasmplugin_at_the_waypoint_1_out <<\ENDSNIP
+200
+ENDSNIP
+
+snip_apply_wasmplugin_at_waypoint_proxy_1() {
+kubectl get gateway
+}
+
+! IFS=$'\n' read -r -d '' snip_apply_wasmplugin_at_waypoint_proxy_1_out <<\ENDSNIP
+NAME               CLASS            ADDRESS        PROGRAMMED   AGE
+bookinfo-gateway   istio            172.18.7.110   True         23h
+waypoint           istio-waypoint   10.96.202.82   True         21h
+ENDSNIP
+
+snip_apply_wasmplugin_at_waypoint_proxy_2() {
+kubectl apply -f - <<EOF
+apiVersion: extensions.istio.io/v1alpha1
+kind: WasmPlugin
+metadata:
+  name: basic-auth-at-waypoint
+spec:
+  targetRefs:
+    - kind: Gateway
+      group: gateway.networking.k8s.io
+      name: waypoint # gateway name retrieved from previous step
+  url: oci://ghcr.io/istio-ecosystem/wasm-extensions/basic_auth:1.12.0
+  phase: AUTHN
+  pluginConfig:
+    basic_auth_rules:
+      - prefix: "/productpage"
+        request_methods:
+          - "GET"
+          - "POST"
+        credentials:
+          - "ok:test"
+          - "YWRtaW4zOmFkbWluMw=="
+EOF
+}
+
+snip_view_the_configured_wasmplugin_1() {
+kubectl get wasmplugin
+}
+
+! IFS=$'\n' read -r -d '' snip_view_the_configured_wasmplugin_1_out <<\ENDSNIP
+NAME                     AGE
+basic-auth-at-gateway    28m
+basic-auth-at-waypoint   14m
+ENDSNIP
+
+snip_verify_the_traffic_via_waypoint_proxy_1() {
+kubectl exec deploy/sleep -- curl -s -w "%{http_code}" -o /dev/null http://productpage:9080/productpage
+}
+
+! IFS=$'\n' read -r -d '' snip_verify_the_traffic_via_waypoint_proxy_1_out <<\ENDSNIP
+401
+ENDSNIP
+
+snip_verify_the_traffic_via_waypoint_proxy_2() {
+kubectl exec deploy/sleep -- curl -s -w "%{http_code}" -o /dev/null -H "Authorization: Basic YWRtaW4zOmFkbWluMw==" http://productpage:9080/productpage
+}
+
+! IFS=$'\n' read -r -d '' snip_verify_the_traffic_via_waypoint_proxy_2_out <<\ENDSNIP
+200
+ENDSNIP
+
+snip_apply_wasmplugin_for_a_specific_service_using_waypoint_1() {
+istioctl experimental waypoint apply -n default --name reviews-svc-waypoint --wait
+}
+
+! IFS=$'\n' read -r -d '' snip_apply_wasmplugin_for_a_specific_service_using_waypoint_1_out <<\ENDSNIP
+waypoint default/reviews-svc-waypoint applied
+ENDSNIP
+
+snip_apply_wasmplugin_for_a_specific_service_using_waypoint_2() {
+kubectl label service reviews istio.io/use-waypoint=reviews-svc-waypoint
+}
+
+! IFS=$'\n' read -r -d '' snip_apply_wasmplugin_for_a_specific_service_using_waypoint_2_out <<\ENDSNIP
+service/reviews labeled
+ENDSNIP
+
+snip_apply_wasmplugin_for_a_specific_service_using_waypoint_3() {
+kubectl get gateway
+}
+
+! IFS=$'\n' read -r -d '' snip_apply_wasmplugin_for_a_specific_service_using_waypoint_3_out <<\ENDSNIP
+NAME                   CLASS            ADDRESS         PROGRAMMED   AGE
+bookinfo-gateway       istio            172.18.7.110    True         46h
+reviews-svc-waypoint   istio-waypoint   10.96.177.137   True         30s
+waypoint               istio-waypoint   10.96.202.82    True         44h
+ENDSNIP
+
+snip_apply_wasmplugin_for_a_specific_service_using_waypoint_4() {
+kubectl apply -f - <<EOF
+apiVersion: extensions.istio.io/v1alpha1
+kind: WasmPlugin
+metadata:
+  name: basic-auth-for-service
+spec:
+  targetRefs:
+    - kind: Gateway
+      group: gateway.networking.k8s.io
+      name: reviews-svc-waypoint
+  url: oci://ghcr.io/istio-ecosystem/wasm-extensions/basic_auth:1.12.0
+  phase: AUTHN
+  pluginConfig:
+    basic_auth_rules:
+      - prefix: "/reviews"
+        request_methods:
+          - "GET"
+          - "POST"
+        credentials:
+          - "ok:test"
+          - "MXQtaW4zOmFkbWluMw=="
+EOF
+}
+
+snip_verify_the_traffic_targeting_the_service_1() {
+kubectl exec deploy/sleep -- curl -s -w "%{http_code}" -o /dev/null -H "Authorization: Basic YWRtaW4zOmFkbWluMw==" http://productpage:9080/productpage
+}
+
+! IFS=$'\n' read -r -d '' snip_verify_the_traffic_targeting_the_service_1_out <<\ENDSNIP
+200
+ENDSNIP
+
+snip_verify_the_traffic_targeting_the_service_2() {
+kubectl exec deploy/sleep -- curl -s -w "%{http_code}" -o /dev/null -H "Authorization: Basic MXQtaW4zOmFkbWluMw==" http://reviews:9080/reviews/1
+}
+
+! IFS=$'\n' read -r -d '' snip_verify_the_traffic_targeting_the_service_2_out <<\ENDSNIP
+200
+ENDSNIP
+
+snip_verify_the_traffic_targeting_the_service_3() {
+kubectl exec deploy/sleep -- curl -s -w "%{http_code}" -o /dev/null http://reviews:9080/reviews/1
+}
+
+! IFS=$'\n' read -r -d '' snip_verify_the_traffic_targeting_the_service_3_out <<\ENDSNIP
+401
+ENDSNIP
+
+snip_cleanup_1() {
+kubectl delete wasmplugin basic-auth-at-gateway basic-auth-at-waypoint basic-auth-for-service
+}
diff --git a/content/en/docs/ambient/usage/extend-waypoint-wasm/test.sh b/content/en/docs/ambient/usage/extend-waypoint-wasm/test.sh
new file mode 100644
index 0000000000..368ddcade4
--- /dev/null
+++ b/content/en/docs/ambient/usage/extend-waypoint-wasm/test.sh
@@ -0,0 +1,105 @@
+#!/usr/bin/env bash
+# shellcheck disable=SC2154
+
+# Copyright 2023 Istio Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# @setup profile=none
+
+set -e
+set -u
+set -o pipefail
+
+source "content/en/docs/ambient/getting-started/snips.sh"
+
+# Kubernetes Gateway API CRDs are required by waypoint proxy.
+snip_download_and_install_2
+
+# install istio with ambient profile
+snip_download_and_install_3
+
+_wait_for_deployment istio-system istiod
+_wait_for_daemonset istio-system ztunnel
+_wait_for_daemonset istio-system istio-cni-node
+
+_verify_like snip_download_and_install_5 "$snip_download_and_install_5_out"
+
+# deploy test application
+snip_deploy_the_sample_application_1
+snip_deploy_the_sample_application_2
+
+snip_deploy_the_sample_application_3
+snip_deploy_the_sample_application_4
+
+# adding applications to ambient mesh
+_verify_same snip_adding_your_application_to_the_ambient_mesh_1 "$snip_adding_your_application_to_the_ambient_mesh_1_out"
+
+# ambient mode enabled
+snip_adding_your_application_to_the_ambient_mesh_2
+
+# test traffic after ambient mode is enabled
+_verify_contains snip_adding_your_application_to_the_ambient_mesh_3 "$snip_adding_your_application_to_the_ambient_mesh_3_out"
+_verify_same snip_adding_your_application_to_the_ambient_mesh_4 "$snip_adding_your_application_to_the_ambient_mesh_4_out"
+
+# Display existing gateways and verify output
+_verify_like snip_configure_wasmplugin_for_gateway_1 "$snip_configure_wasmplugin_for_gateway_1_out"
+
+# Configure WASM plugin for gateway
+snip_configure_wasmplugin_for_gateway_2
+
+# verify traffic via gateway
+_verify_same snip_verify_the_traffic_via_the_gateway_1 "$snip_verify_the_traffic_via_the_gateway_1_out"
+_verify_same snip_verify_the_traffic_via_the_gateway_2 "$snip_verify_the_traffic_via_the_gateway_2_out"
+
+# Deploy a waypoint proxy
+snip_deploy_a_waypoint_proxy_1
+
+# verify traffic_without wasmplugin at the waypoint
+_verify_same snip_verify_traffic_without_wasmplugin_at_the_waypoint_1 "$snip_verify_traffic_without_wasmplugin_at_the_waypoint_1_out"
+
+# Display existing gateways and verify output
+_verify_like snip_apply_wasmplugin_at_waypoint_proxy_1 "$snip_apply_wasmplugin_at_waypoint_proxy_1_out"
+
+# apply wasmplugin at waypoint proxy
+snip_apply_wasmplugin_at_waypoint_proxy_2
+
+# Display applied wasmplugins and verify output
+_verify_like snip_view_the_configured_wasmplugin_1 "$snip_view_the_configured_wasmplugin_1_out"
+
+# verify the traffic via waypoint proxy
+_verify_same snip_verify_the_traffic_via_waypoint_proxy_1 "$snip_verify_the_traffic_via_waypoint_proxy_1_out"
+_verify_same snip_verify_the_traffic_via_waypoint_proxy_2 "$snip_verify_the_traffic_via_waypoint_proxy_2_out"
+
+# Apply Waypoint configuration for 'reviews' service
+_verify_same snip_apply_wasmplugin_for_a_specific_service_using_waypoint_1 "$snip_apply_wasmplugin_for_a_specific_service_using_waypoint_1_out"
+_verify_same snip_apply_wasmplugin_for_a_specific_service_using_waypoint_2 "$snip_apply_wasmplugin_for_a_specific_service_using_waypoint_2_out"
+
+# Display existing gateways and verify output
+_verify_like snip_apply_wasmplugin_for_a_specific_service_using_waypoint_3 "$snip_apply_wasmplugin_for_a_specific_service_using_waypoint_3_out"
+
+# apply wasmplugin for a specific service using waypoint
+snip_apply_wasmplugin_for_a_specific_service_using_waypoint_4
+
+# verify the traffic targeting the service
+_verify_same snip_verify_the_traffic_targeting_the_service_1 "$snip_verify_the_traffic_targeting_the_service_1_out"
+_verify_same snip_verify_the_traffic_targeting_the_service_2 "$snip_verify_the_traffic_targeting_the_service_2_out"
+_verify_same snip_verify_the_traffic_targeting_the_service_3 "$snip_verify_the_traffic_targeting_the_service_3_out"
+
+# @cleanup
+snip_cleanup_1
+snip_uninstall_1
+snip_uninstall_2
+snip_uninstall_3
+samples/bookinfo/platform/kube/cleanup.sh
+snip_uninstall_4