AWSWAFReadOnlyAccess

Summary

Provides read only access to AWS WAF actions.

Permissions imported from the AWS Managed Policy Reference Guide; other sections pending editorial review.

Identity

ARN

arn:aws:iam::aws:policy/AWSWAFReadOnlyAccessCopy ARN

Default version

v13

Created

2015-10-06

Last edited

2026-07-01

Services

amplify, apprunner, appsync, bedrock-agentcore, cognito-idp, ec2, elasticloadbalancing, waf, waf-regional, wafv2

Control-plane actions (119)

By access level: 52 List, 67 Read.

Data-plane actions (0)

By access level: none.

This policy grants no actions in this plane.

Excluded and conditional actions

No patterns are excluded by NotAction or Deny statements.

Resource scope and attachment

Resource scope across granted actions: mixed.

Can be attached: Yes, to users, groups and roles.

Why this tier

• Grants only List and Read actions.

Guidance

Pending editorial review. The permission data on this page comes straight from AWS; this section will be filled in once a reviewed guide exists.

Related policies

Same service

• AWSFMAdminFullAccess
• AWSFMAdminReadOnlyAccess
• AWSFMMemberReadOnlyAccess
• AWSShieldDRTAccessPolicy
• AWSShieldServiceRolePolicy
• AWSWAFConsoleFullAccess
• AWSWAFConsoleReadOnlyAccess
• AWSWAFFullAccess

Same domain

• AccessAnalyzerServiceRolePolicy
• AccountManagementFromVercel
• AlexaForBusinessNetworkProfileServicePolicy
• AmazonAppStreamPCAAccess
• AmazonBioDiscoveryFullAccess
• AmazonBioDiscoveryInAppFullAccess
• AmazonChimeServiceRolePolicy
• AmazonCloudDirectoryFullAccess

Frequently asked questions

Pending editorial review. The permission data on this page comes straight from AWS; this section will be filled in once a reviewed guide exists.

Policy JSON

Download policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowReadOnlyOfAWSWAFClassic",
      "Effect": "Allow",
      "Action": [
        "waf:Get*",
        "waf:List*",
        "waf-regional:Get*",
        "waf-regional:List*"
      ],
      "Resource": [
        "arn:aws:waf::*:bytematchset/*",
        "arn:aws:waf::*:ipset/*",
        "arn:aws:waf::*:ratebasedrule/*",
        "arn:aws:waf::*:rule/*",
        "arn:aws:waf::*:sizeconstraintset/*",
        "arn:aws:waf::*:sqlinjectionset/*",
        "arn:aws:waf::*:webacl/*",
        "arn:aws:waf::*:xssmatchset/*",
        "arn:aws:waf::*:regexmatch/*",
        "arn:aws:waf::*:regexpatternset/*",
        "arn:aws:waf::*:geomatchset/*",
        "arn:aws:waf::*:rulegroup/*",
        "arn:aws:waf::*:changetoken/*",
        "arn:aws:waf-regional:*:*:bytematchset/*",
        "arn:aws:waf-regional:*:*:ipset/*",
        "arn:aws:waf-regional:*:*:ratebasedrule/*",
        "arn:aws:waf-regional:*:*:rule/*",
        "arn:aws:waf-regional:*:*:sizeconstraintset/*",
        "arn:aws:waf-regional:*:*:sqlinjectionset/*",
        "arn:aws:waf-regional:*:*:webacl/*",
        "arn:aws:waf-regional:*:*:xssmatchset/*",
        "arn:aws:waf-regional:*:*:regexmatch/*",
        "arn:aws:waf-regional:*:*:regexpatternset/*",
        "arn:aws:waf-regional:*:*:geomatchset/*",
        "arn:aws:waf-regional:*:*:rulegroup/*",
        "arn:aws:waf-regional:*:*:changetoken/*"
      ]
    },
    {
      "Sid": "AllowWAFClassicGetWebACLForResource",
      "Effect": "Allow",
      "Action": [
        "waf-regional:GetWebACLForResource"
      ],
      "Resource": "arn:aws:waf-regional:*:*:*/*"
    },
    {
      "Sid": "AllowReadOnlyOfAWSWAF",
      "Effect": "Allow",
      "Action": [
        "wafv2:Get*",
        "wafv2:List*",
        "wafv2:Describe*",
        "wafv2:CheckCapacity"
      ],
      "Resource": [
        "arn:aws:wafv2:*:*:*/webacl/*/*",
        "arn:aws:wafv2:*:*:*/ipset/*/*",
        "arn:aws:wafv2:*:*:*/managedruleset/*/*",
        "arn:aws:wafv2:*:*:*/rulegroup/*/*",
        "arn:aws:wafv2:*:*:*/regexpatternset/*/*"
      ]
    },
    {
      "Sid": "AllowGetActionForCognito",
      "Effect": "Allow",
      "Action": [
        "cognito-idp:GetWebACLForResource"
      ],
      "Resource": "arn:aws:cognito-idp:*:*:userpool/*"
    },
    {
      "Sid": "AllowListActionsForCognito",
      "Effect": "Allow",
      "Action": [
        "cognito-idp:ListResourcesForWebACL"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AllowGetActionForAppRunner",
      "Effect": "Allow",
      "Action": [
        "apprunner:DescribeWebAclForService"
      ],
      "Resource": "arn:aws:apprunner:*:*:service/*/*"
    },
    {
      "Sid": "AllowListActionsForAppRunner",
      "Effect": "Allow",
      "Action": [
        "apprunner:ListServices",
        "apprunner:ListAssociatedServicesForWebAcl"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AllowGetActionForAVA",
      "Effect": "Allow",
      "Action": [
        "ec2:GetVerifiedAccessInstanceWebAcl"
      ],
      "Resource": "arn:aws:ec2:*:*:verified-access-instance/*"
    },
    {
      "Sid": "AllowListActionsForAVA",
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeVerifiedAccessInstanceWebAclAssociations"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AllowGetActionForAmplify",
      "Effect": "Allow",
      "Action": [
        "amplify:GetWebACLForResource"
      ],
      "Resource": "arn:aws:amplify:*:*:apps/*"
    },
    {
      "Sid": "AllowListActionsForAmplify",
      "Effect": "Allow",
      "Action": [
        "amplify:ListResourcesForWebACL"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AllowGetActionsForAppSync",
      "Effect": "Allow",
      "Action": [
        "appsync:GetWebACLForResource"
      ],
      "Resource": "arn:aws:appsync:*:*:apis/*"
    },
    {
      "Sid": "AllowListActionsForAppSync",
      "Effect": "Allow",
      "Action": [
        "appsync:ListResourcesForWebACL"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AllowGetActionsForELB",
      "Effect": "Allow",
      "Action": [
        "elasticloadbalancing:GetLoadBalancerWebACL"
      ],
      "Resource": "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*"
    },
    {
      "Sid": "AllowListActionsForELB",
      "Effect": "Allow",
      "Action": [
        "elasticloadbalancing:DescribeWebACLAssociation"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AllowReadActionsForAgentCoreGateway",
      "Effect": "Allow",
      "Action": [
        "bedrock-agentcore:GatewayGetWebACLForResource"
      ],
      "Resource": "arn:aws:bedrock-agentcore:*:*:gateway/*"
    },
    {
      "Sid": "AllowListActionsForAgentCoreGateway",
      "Effect": "Allow",
      "Action": [
        "bedrock-agentcore:GatewayListResourcesForWebACL"
      ],
      "Resource": "*"
    }
  ]
}

Version history

Current version v13, edited by AWS on 2026-07-01. Version history is recorded from 2026-11-11. Earlier versions are in the IAM console under Policy versions.

Attach snippets

aws iam attach-role-policy --role-name ROLE_NAME --policy-arn arn:aws:iam::aws:policy/AWSWAFReadOnlyAccess
aws iam attach-user-policy --user-name USER_NAME --policy-arn arn:aws:iam::aws:policy/AWSWAFReadOnlyAccess
aws iam attach-group-policy --group-name GROUP_NAME --policy-arn arn:aws:iam::aws:policy/AWSWAFReadOnlyAccess

Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: {}  # replace with your trust policy
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AWSWAFReadOnlyAccess

resource "aws_iam_role_policy_attachment" "awswafreadonlyaccess" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/AWSWAFReadOnlyAccess"
}

role.addManagedPolicy(
  iam.ManagedPolicy.fromAwsManagedPolicyName("AWSWAFReadOnlyAccess"),
);

Sources

Pending editorial review. No editorial sources are listed yet.

• Official AWS reference for AWSWAFReadOnlyAccess
• Report a data issue