AWSWAFFullAccess

OperatorAWS managedActivePermissions reviewedShow on map Compare

Summary

Provides full access to AWS WAF actions.

Permissions imported from the AWS Managed Policy Reference Guide; other sections pending editorial review.

Identity

ARN: arn:aws:iam::aws:policy/AWSWAFFullAccess
Default version: v18
Created: 2015-10-06
Last edited: 2026-11-05
Services: amplify, apigateway, apprunner, appsync, bedrock-agentcore, cognito-idp, ec2, elasticloadbalancing, logs, payments, s3, waf, waf-regional, wafv2

Control-plane actions (262)

By access level: 54 List, 16 Permissions management, 72 Read, 6 Tagging, 114 Write.

Control-plane actions by service
Service	Granted	Access levels and limits	Granted by
Amplify	4 of 41	1 List, 1 Read, 2 Write; 3 restricted, 0 conditional	amplify:AssociateWebACL, amplify:DisassociateWebACL, amplify:GetWebACLForResource, amplify:ListResourcesForWebACL
API Gateway	1 of 44	1 Permissions management; 1 restricted, 0 conditional	apigateway:SetWebACL
App Runner	5 of 42	2 List, 1 Read, 2 Write; 3 restricted, 0 conditional	apprunner:AssociateWebAcl, apprunner:DescribeWebAclForService, apprunner:DisassociateWebAcl, apprunner:ListAssociatedServicesForWebAcl, apprunner:ListServices
AppSync	5 of 87	1 List, 1 Permissions management, 1 Read, 2 Write; 4 restricted, 0 conditional	appsync:AssociateWebACL, appsync:DisassociateWebACL, appsync:GetWebACLForResource, appsync:ListResourcesForWebACL, appsync:SetWebACL
Bedrock-Agentcore	4 of 197	1 List, 1 Read, 2 Write; 3 restricted, 0 conditional	bedrock-agentcore:GatewayAssociateWebACL, bedrock-agentcore:GatewayDisassociateWebACL, bedrock-agentcore:GatewayGetWebACLForResource, bedrock-agentcore:GatewayListResourcesForWebACL
Cognito User Pools	4 of 139	1 List, 1 Read, 2 Write; 3 restricted, 0 conditional	cognito-idp:AssociateWebACL, cognito-idp:DisassociateWebACL, cognito-idp:GetWebACLForResource, cognito-idp:ListResourcesForWebACL
EC2	4 of 834	2 List, 2 Write; 3 restricted, 0 conditional	ec2:AssociateVerifiedAccessInstanceWebAcl, ec2:DescribeVerifiedAccessInstanceWebAclAssociations, ec2:DisassociateVerifiedAccessInstanceWebAcl, ec2:GetVerifiedAccessInstanceWebAcl
ELB	5 of 77	1 List, 1 Read, 3 Write; 4 restricted, 0 conditional	elasticloadbalancing:CreateWebACLAssociation, elasticloadbalancing:DeleteWebACLAssociation, elasticloadbalancing:DescribeWebACLAssociation, elasticloadbalancing:GetLoadBalancerWebACL, elasticloadbalancing:SetWebAcl
CloudWatch Logs	5 of 133	2 List, 1 Permissions management, 2 Write; 1 restricted, 1 conditional	logs:CreateLogDelivery, logs:DeleteLogDelivery, logs:DescribeLogGroups, logs:DescribeResourcePolicies, logs:PutResourcePolicy
Payments	1 of 28	1 Read; 1 restricted, 0 conditional	payments:GetConnectedAccount
S3	2 of 155	1 Permissions management, 1 Read; 2 restricted, 0 conditional	s3:GetBucketPolicy, s3:PutBucketPolicy
WAF	All 77 actions (see the WAF page)	15 List, 5 Permissions management, 19 Read, 2 Tagging, 36 Write; 77 restricted, 0 conditional	waf:*
WAF Regional	All 81 actions (see the WAF Regional page)	16 List, 5 Permissions management, 20 Read, 2 Tagging, 38 Write; 81 restricted, 0 conditional	waf-regional:*, waf-regional:GetWebACLForResource
WAF V2	All 64 actions (see the WAF V2 page)	12 List, 2 Permissions management, 25 Read, 2 Tagging, 23 Write; 63 restricted, 0 conditional	wafv2:*, wafv2:DisassociateWebACL

Amplify: 4 actions

amplify:AssociateWebACL (Write)
amplify:DisassociateWebACL (Write)
amplify:GetWebACLForResource (Read)
amplify:ListResourcesForWebACL (List)

API Gateway: 1 actions

apigateway:SetWebACL (Permissions management)

App Runner: 5 actions

apprunner:AssociateWebAcl (Write)
apprunner:DescribeWebAclForService (Read)
apprunner:DisassociateWebAcl (Write)
apprunner:ListAssociatedServicesForWebAcl (List)
apprunner:ListServices (List)

AppSync: 5 actions

appsync:AssociateWebACL (Write)
appsync:DisassociateWebACL (Write)
appsync:GetWebACLForResource (Read)
appsync:ListResourcesForWebACL (List)
appsync:SetWebACL (Permissions management)

Bedrock-Agentcore: 4 actions

bedrock-agentcore:GatewayAssociateWebACL (Write)
bedrock-agentcore:GatewayDisassociateWebACL (Write)
bedrock-agentcore:GatewayGetWebACLForResource (Read)
bedrock-agentcore:GatewayListResourcesForWebACL (List)

Cognito User Pools: 4 actions

cognito-idp:AssociateWebACL (Write)
cognito-idp:DisassociateWebACL (Write)
cognito-idp:GetWebACLForResource (Read)
cognito-idp:ListResourcesForWebACL (List)

EC2: 4 actions

ec2:AssociateVerifiedAccessInstanceWebAcl (Write)
ec2:DescribeVerifiedAccessInstanceWebAclAssociations (List)
ec2:DisassociateVerifiedAccessInstanceWebAcl (Write)
ec2:GetVerifiedAccessInstanceWebAcl (List)

ELB: 5 actions

elasticloadbalancing:CreateWebACLAssociation (Write)
elasticloadbalancing:DeleteWebACLAssociation (Write)
elasticloadbalancing:DescribeWebACLAssociation (List)
elasticloadbalancing:GetLoadBalancerWebACL (Read)
elasticloadbalancing:SetWebAcl (Write)

CloudWatch Logs: 5 actions

logs:CreateLogDelivery (Write)
logs:DeleteLogDelivery (Write)
logs:DescribeLogGroups (List)
logs:DescribeResourcePolicies (List)
logs:PutResourcePolicy (Permissions management)

Payments: 1 actions

payments:GetConnectedAccount (Read)

S3: 2 actions

s3:GetBucketPolicy (Read)
s3:PutBucketPolicy (Permissions management)

Data-plane actions (0)

By access level: none.

This policy grants no actions in this plane.

Excluded and conditional actions

No patterns are excluded by NotAction or Deny statements.

Resource scope and attachment

Resource scope across granted actions: mixed.

Can be attached: Yes, to users, groups and roles.

Why this tier

Grants 136 write, tagging or permissions-management actions, short of full control of any service.

Guidance

Pending editorial review. The permission data on this page comes straight from AWS; this section will be filled in once a reviewed guide exists.

Same service

Same domain

Frequently asked questions

Pending editorial review. The permission data on this page comes straight from AWS; this section will be filled in once a reviewed guide exists.

Policy JSON

Download policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowUseOfAWSWAFClassic",
      "Effect": "Allow",
      "Action": [
        "waf:*",
        "waf-regional:*"
      ],
      "Resource": [
        "arn:aws:waf::*:bytematchset/*",
        "arn:aws:waf::*:ipset/*",
        "arn:aws:waf::*:ratebasedrule/*",
        "arn:aws:waf::*:rule/*",
        "arn:aws:waf::*:sizeconstraintset/*",
        "arn:aws:waf::*:sqlinjectionset/*",
        "arn:aws:waf::*:webacl/*",
        "arn:aws:waf::*:xssmatchset/*",
        "arn:aws:waf::*:regexmatch/*",
        "arn:aws:waf::*:regexpatternset/*",
        "arn:aws:waf::*:geomatchset/*",
        "arn:aws:waf::*:rulegroup/*",
        "arn:aws:waf::*:changetoken/*",
        "arn:aws:waf-regional:*:*:bytematchset/*",
        "arn:aws:waf-regional:*:*:ipset/*",
        "arn:aws:waf-regional:*:*:ratebasedrule/*",
        "arn:aws:waf-regional:*:*:rule/*",
        "arn:aws:waf-regional:*:*:sizeconstraintset/*",
        "arn:aws:waf-regional:*:*:sqlinjectionset/*",
        "arn:aws:waf-regional:*:*:webacl/*",
        "arn:aws:waf-regional:*:*:xssmatchset/*",
        "arn:aws:waf-regional:*:*:regexmatch/*",
        "arn:aws:waf-regional:*:*:regexpatternset/*",
        "arn:aws:waf-regional:*:*:geomatchset/*",
        "arn:aws:waf-regional:*:*:rulegroup/*",
        "arn:aws:waf-regional:*:*:changetoken/*"
      ]
    },
    {
      "Sid": "AllowWAFClassicGetWebACLForResource",
      "Effect": "Allow",
      "Action": [
        "waf-regional:GetWebACLForResource"
      ],
      "Resource": "arn:aws:waf-regional:*:*:*/*"
    },
    {
      "Sid": "AllowUseOfAWSWAF",
      "Effect": "Allow",
      "Action": [
        "wafv2:*"
      ],
      "Resource": [
        "arn:aws:wafv2:*:*:*/webacl/*/*",
        "arn:aws:wafv2:*:*:*/ipset/*/*",
        "arn:aws:wafv2:*:*:*/managedruleset/*/*",
        "arn:aws:wafv2:*:*:*/rulegroup/*/*",
        "arn:aws:wafv2:*:*:*/regexpatternset/*/*"
      ]
    },
    {
      "Sid": "AllowDisassociateWebACL",
      "Effect": "Allow",
      "Action": [
        "wafv2:DisassociateWebACL"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AllowGetActionForPaymentsConnectedAccount",
      "Effect": "Allow",
      "Action": [
        "payments:GetConnectedAccount"
      ],
      "Resource": "arn:aws:payments::*:connectedaccount/*"
    },
    {
      "Sid": "AllowListActionsForALB",
      "Effect": "Allow",
      "Action": [
        "elasticloadbalancing:DescribeWebACLAssociation"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AllowActionsForALB",
      "Effect": "Allow",
      "Action": [
        "elasticloadbalancing:SetWebAcl",
        "elasticloadbalancing:CreateWebACLAssociation",
        "elasticloadbalancing:DeleteWebACLAssociation",
        "elasticloadbalancing:GetLoadBalancerWebACL"
      ],
      "Resource": "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*"
    },
    {
      "Sid": "AllowActionsForAPIGateway",
      "Effect": "Allow",
      "Action": [
        "apigateway:SetWebACL"
      ],
      "Resource": "arn:aws:apigateway:*::/restapis/*/stages/*"
    },
    {
      "Sid": "AllowListActionsForAppSync",
      "Effect": "Allow",
      "Action": [
        "appsync:ListResourcesForWebACL"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AllowActionsForAppSync",
      "Effect": "Allow",
      "Action": [
        "appsync:SetWebACL",
        "appsync:AssociateWebACL",
        "appsync:DisassociateWebACL",
        "appsync:GetWebACLForResource"
      ],
      "Resource": "arn:aws:appsync:*:*:apis/*"
    },
    {
      "Sid": "AllowActionsForCognito",
      "Effect": "Allow",
      "Action": [
        "cognito-idp:AssociateWebACL",
        "cognito-idp:DisassociateWebACL",
        "cognito-idp:GetWebACLForResource"
      ],
      "Resource": "arn:aws:cognito-idp:*:*:userpool/*"
    },
    {
      "Sid": "AllowListActionsForCognito",
      "Effect": "Allow",
      "Action": [
        "cognito-idp:ListResourcesForWebACL"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AllowActionsForAppRunner",
      "Effect": "Allow",
      "Action": [
        "apprunner:AssociateWebAcl",
        "apprunner:DisassociateWebAcl",
        "apprunner:DescribeWebAclForService"
      ],
      "Resource": "arn:aws:apprunner:*:*:service/*/*"
    },
    {
      "Sid": "AllowListActionsForAppRunner",
      "Effect": "Allow",
      "Action": [
        "apprunner:ListServices",
        "apprunner:ListAssociatedServicesForWebAcl"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AllowActionsForAVA",
      "Effect": "Allow",
      "Action": [
        "ec2:AssociateVerifiedAccessInstanceWebAcl",
        "ec2:DisassociateVerifiedAccessInstanceWebAcl",
        "ec2:GetVerifiedAccessInstanceWebAcl"
      ],
      "Resource": "arn:aws:ec2:*:*:verified-access-instance/*"
    },
    {
      "Sid": "AllowListActionsForAVA",
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeVerifiedAccessInstanceWebAclAssociations"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AllowActionsForAmplify",
      "Effect": "Allow",
      "Action": [
        "amplify:AssociateWebACL",
        "amplify:DisassociateWebACL",
        "amplify:GetWebACLForResource"
      ],
      "Resource": "arn:aws:amplify:*:*:apps/*"
    },
    {
      "Sid": "AllowListActionsForAmplify",
      "Effect": "Allow",
      "Action": [
        "amplify:ListResourcesForWebACL"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AllowLogGroupDescribeActions",
      "Effect": "Allow",
      "Action": [
        "logs:DescribeResourcePolicies",
        "logs:DescribeLogGroups"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AllowLogDeliverySubscription",
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogDelivery",
        "logs:DeleteLogDelivery"
      ],
      "Resource": "*"
    },
    {
      "Sid": "GrantLogDeliveryPermissionForS3Bucket",
      "Effect": "Allow",
      "Action": [
        "s3:PutBucketPolicy",
        "s3:GetBucketPolicy"
      ],
      "Resource": [
        "arn:aws:s3:::aws-waf-logs-*"
      ]
    },
    {
      "Sid": "GrantLogDeliveryPermissionForCloudWatchLogGroup",
      "Effect": "Allow",
      "Action": [
        "logs:PutResourcePolicy"
      ],
      "Resource": "arn:aws:logs:*:*:log-group:*",
      "Condition": {
        "ForAnyValue:StringEquals": {
          "aws:CalledVia": [
            "wafv2.amazonaws.com"
          ]
        }
      }
    },
    {
      "Sid": "AllowActionsForAgentCoreGateway",
      "Effect": "Allow",
      "Action": [
        "bedrock-agentcore:GatewayAssociateWebACL",
        "bedrock-agentcore:GatewayDisassociateWebACL",
        "bedrock-agentcore:GatewayGetWebACLForResource"
      ],
      "Resource": "arn:aws:bedrock-agentcore:*:*:gateway/*"
    },
    {
      "Sid": "AllowListActionsForAgentCoreGateway",
      "Effect": "Allow",
      "Action": [
        "bedrock-agentcore:GatewayListResourcesForWebACL"
      ],
      "Resource": "*"
    }
  ]
}

Version history

Current version v18, edited by AWS on 2026-11-05. Version history is recorded from 2026-11-11. Earlier versions are in the IAM console under Policy versions.

Attach snippets

AWS CLI

aws iam attach-role-policy --role-name ROLE_NAME --policy-arn arn:aws:iam::aws:policy/AWSWAFFullAccess
aws iam attach-user-policy --user-name USER_NAME --policy-arn arn:aws:iam::aws:policy/AWSWAFFullAccess
aws iam attach-group-policy --group-name GROUP_NAME --policy-arn arn:aws:iam::aws:policy/AWSWAFFullAccess

CloudFormation

Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: {}  # replace with your trust policy
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AWSWAFFullAccess

Terraform

resource "aws_iam_role_policy_attachment" "awswaffullaccess" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/AWSWAFFullAccess"
}

CDK (TypeScript)

role.addManagedPolicy(
  iam.ManagedPolicy.fromAwsManagedPolicyName("AWSWAFFullAccess"),
);

Sources

Pending editorial review. No editorial sources are listed yet.