WAF
Prefix waf, 77 actions · Domain Security, Identity & Compliance
8 AWS managed policies. 0 have reviewed guidance; the rest have authoritative permission data pending editorial review.
User access (5)
- AWSFMAdminFullAccessAdmin
- AWSFMAdminReadOnlyAccessReader
- AWSFMMemberReadOnlyAccessReader
- AWSWAFConsoleReadOnlyAccessAnalyst
- AWSWAFReadOnlyAccessReader
Operator and limited (2)
- AWSWAFConsoleFullAccessOperator
- AWSWAFFullAccessOperator
Service roles (1)
Also grants WAF actions (20)
- AdministratorAccess
- AIDevOpsAgentActionsPolicy
- AWS_ConfigRole
- AWSAuditManagerServiceRolePolicy
- AWSCODAPermissionsBoundary
- AWSConfigServiceRolePolicy
- AWSMcpServiceActionsFullAccess
- AWSPartnerLedSupportReadOnlyAccess
- AWSResourceExplorerServiceRolePolicy
- AWSSupportServiceRolePolicy
- CloudFrontFullAccess
- CloudFrontReadOnlyAccess
- FMSServiceRolePolicy
- NetworkSecurityDirectorServiceLinkedRolePolicy
- PowerUserAccess
- ReadOnlyAccess
- ResourceGroupsTaggingAPITagUntagSupportedResources
- SecurityAudit
- SupportUser
- ViewOnlyAccess
createbytematchset creategeomatchset createipset createratebasedrule createregexmatchset createregexpatternset createrule createrulegroup createsizeconstraintset createsqlinjectionmatchset createwebacl createwebaclmigrationstack createxssmatchset deletebytematchset deletegeomatchset deleteipset deleteloggingconfiguration deletepermissionpolicy deleteratebasedrule deleteregexmatchset deleteregexpatternset deleterule deleterulegroup deletesizeconstraintset deletesqlinjectionmatchset deletewebacl deletexssmatchset getbytematchset getchangetoken getchangetokenstatus getgeomatchset getipset getloggingconfiguration getpermissionpolicy getratebasedrule getratebasedrulemanagedkeys getregexmatchset getregexpatternset getrule getrulegroup getsampledrequests getsizeconstraintset getsqlinjectionmatchset getwebacl getxssmatchset listactivatedrulesinrulegroup listbytematchsets listgeomatchsets listipsets listloggingconfigurations listratebasedrules listregexmatchsets listregexpatternsets listrulegroups listrules listsizeconstraintsets listsqlinjectionmatchsets listsubscribedrulegroups listtagsforresource listwebacls listxssmatchsets putloggingconfiguration putpermissionpolicy tagresource untagresource updatebytematchset updategeomatchset updateipset updateratebasedrule updateregexmatchset updateregexpatternset updaterule updaterulegroup updatesizeconstraintset updatesqlinjectionmatchset updatewebacl updatexssmatchset
Actions (77)
| Action | Access level | Policies granting without limits | Policies granting with resource or condition limits |
|---|---|---|---|
| waf:CreateByteMatchSet | Write | 6 | 3 |
| waf:CreateGeoMatchSet | Write | 6 | 3 |
| waf:CreateIPSet | Write | 6 | 3 |
| waf:CreateRateBasedRule | Write | 6 | 3 |
| waf:CreateRegexMatchSet | Write | 6 | 3 |
| waf:CreateRegexPatternSet | Write | 6 | 3 |
| waf:CreateRule | Write | 6 | 3 |
| waf:CreateRuleGroup | Write | 6 | 3 |
| waf:CreateSizeConstraintSet | Write | 6 | 3 |
| waf:CreateSqlInjectionMatchSet | Write | 6 | 3 |
| waf:CreateWebACL | Permissions management | 6 | 4 |
| waf:CreateWebACLMigrationStack | Write | 6 | 3 |
| waf:CreateXssMatchSet | Write | 6 | 3 |
| waf:DeleteByteMatchSet | Write | 6 | 3 |
| waf:DeleteGeoMatchSet | Write | 6 | 3 |
| waf:DeleteIPSet | Write | 6 | 3 |
| waf:DeleteLoggingConfiguration | Write | 6 | 3 |
| waf:DeletePermissionPolicy | Permissions management | 6 | 4 |
| waf:DeleteRateBasedRule | Write | 6 | 3 |
| waf:DeleteRegexMatchSet | Write | 6 | 3 |
| waf:DeleteRegexPatternSet | Write | 6 | 3 |
| waf:DeleteRule | Write | 6 | 3 |
| waf:DeleteRuleGroup | Write | 6 | 3 |
| waf:DeleteSizeConstraintSet | Write | 6 | 3 |
| waf:DeleteSqlInjectionMatchSet | Write | 6 | 3 |
| waf:DeleteWebACL | Permissions management | 6 | 4 |
| waf:DeleteXssMatchSet | Write | 6 | 3 |
| waf:GetByteMatchSet | Read | 12 | 5 |
| waf:GetChangeToken | Read | 10 | 6 |
| waf:GetChangeTokenStatus | Read | 12 | 5 |
| waf:GetGeoMatchSet | Read | 12 | 5 |
| waf:GetIPSet | Read | 12 | 5 |
| waf:GetLoggingConfiguration | Read | 15 | 5 |
| waf:GetPermissionPolicy | Read | 10 | 6 |
| waf:GetRateBasedRule | Read | 12 | 5 |
| waf:GetRateBasedRuleManagedKeys | Read | 10 | 5 |
| waf:GetRegexMatchSet | Read | 12 | 5 |
| waf:GetRegexPatternSet | Read | 12 | 5 |
| waf:GetRule | Read | 13 | 5 |
| waf:GetRuleGroup | Read | 13 | 6 |
| waf:GetSampledRequests | Read | 12 | 5 |
| waf:GetSizeConstraintSet | Read | 12 | 5 |
| waf:GetSqlInjectionMatchSet | Read | 12 | 5 |
| waf:GetWebACL | Read | 18 | 7 |
| waf:GetXssMatchSet | Read | 12 | 5 |
| waf:ListActivatedRulesInRuleGroup | List | 14 | 5 |
| waf:ListByteMatchSets | List | 13 | 5 |
| waf:ListGeoMatchSets | List | 13 | 5 |
| waf:ListIPSets | List | 13 | 5 |
| waf:ListLoggingConfigurations | List | 13 | 5 |
| waf:ListRateBasedRules | List | 13 | 5 |
| waf:ListRegexMatchSets | List | 13 | 5 |
| waf:ListRegexPatternSets | List | 13 | 5 |
| waf:ListRuleGroups | List | 14 | 5 |
| waf:ListRules | List | 14 | 5 |
| waf:ListSizeConstraintSets | List | 13 | 5 |
| waf:ListSqlInjectionMatchSets | List | 13 | 5 |
| waf:ListSubscribedRuleGroups | List | 11 | 6 |
| waf:ListTagsForResource | Read | 12 | 6 |
| waf:ListWebACLs | List | 17 | 6 |
| waf:ListXssMatchSets | List | 13 | 5 |
| waf:PutLoggingConfiguration | Write | 6 | 3 |
| waf:PutPermissionPolicy | Permissions management | 6 | 4 |
| waf:TagResource | Tagging | 7 | 3 |
| waf:UntagResource | Tagging | 7 | 3 |
| waf:UpdateByteMatchSet | Write | 6 | 3 |
| waf:UpdateGeoMatchSet | Write | 6 | 3 |
| waf:UpdateIPSet | Write | 6 | 3 |
| waf:UpdateRateBasedRule | Write | 6 | 3 |
| waf:UpdateRegexMatchSet | Write | 6 | 3 |
| waf:UpdateRegexPatternSet | Write | 6 | 3 |
| waf:UpdateRule | Write | 6 | 3 |
| waf:UpdateRuleGroup | Write | 6 | 3 |
| waf:UpdateSizeConstraintSet | Write | 6 | 3 |
| waf:UpdateSqlInjectionMatchSet | Write | 6 | 3 |
| waf:UpdateWebACL | Permissions management | 6 | 4 |
| waf:UpdateXssMatchSet | Write | 6 | 3 |