WAF V2
Prefix wafv2, 64 actions · Domain Security, Identity & Compliance
9 AWS managed policies. 0 have reviewed guidance; the rest have authoritative permission data pending editorial review. 4 are service-linked role policies, shown with permission data only.
User access (2)
- AWSWAFConsoleReadOnlyAccessAnalyst
- AWSWAFReadOnlyAccessReader
Operator and limited (2)
- AWSWAFConsoleFullAccessOperator
- AWSWAFFullAccessOperator
Service roles (1)
Service-linked roles (4)
- AWSShieldServiceRolePolicyOperator
- FMSServiceRolePolicyOperator
- NetworkSecurityManagerServiceRolePolicyOperator
- SecurityLakeServiceLinkedRoleOperator
Also grants WAF V2 actions (30)
- AdministratorAccess
- AIDevOpsAgentAccessPolicy
- AIDevOpsAgentActionsPolicy
- AIOpsAssistantPolicy
- AmazonECSInfrastructureRoleForGatewayHostSharedALB
- AmazonEKSLoadBalancingPolicy
- AssuranceServiceRolePolicy
- AWS_ConfigRole
- AWSAuditManagerServiceRolePolicy
- AWSCODAPermissionsBoundary
- AWSConfigServiceRolePolicy
- AWSContinuumCollectorServiceRolePolicy
- AWSFMAdminFullAccess
- AWSFMAdminReadOnlyAccess
- AWSMcpServiceActionsFullAccess
- AWSObservabilityAdminTelemetryEnablementServiceRolePolicy
- AWSPartnerLedSupportReadOnlyAccess
- AWSResilienceHubV2AssessmentExecutionPolicy
- AWSResourceExplorerServiceRolePolicy
- AWSSupportServiceRolePolicy
- AWSWellArchitectedAgentResourceScanningServiceRolePolicy
- CloudFrontFullAccess
- CloudFrontReadOnlyAccess
- NetworkSecurityDirectorServiceLinkedRolePolicy
- PowerUserAccess
- ReadOnlyAccess
- ResourceGroupsTaggingAPITagUntagSupportedResources
- SecurityAudit
- ViewOnlyAccess
- WellArchitectedAgentResourceScanning
associatewebacl checkcapacity createapikey createipset createregexpatternset createrulegroup createwebacl deleteapikey deletefirewallmanagerrulegroups deleteipset deleteloggingconfiguration deletepermissionpolicy deleteregexpatternset deleterulegroup deletewebacl describeallmanagedproducts describemanagedproductsbyvendor describemanagedrulegroup describetopcontributorsbyevent disassociatefirewallmanager disassociatewebacl generatemobilesdkreleaseurl getdecryptedapikey getipset getloggingconfiguration getmanagedruleset getmobilesdkrelease getpermissionpolicy getratebasedstatementmanagedkeys getregexpatternset getrevenuestatistics getrevenuestatisticssummary getrevenuestatisticstimeseries getrulegroup getsampledrequests gettoppathstatisticsbytraffic getwebacl getwebaclforresource listapikeys listavailablemanagedrulegroupversions listavailablemanagedrulegroups listipsets listloggingconfigurations listmanagedrulesets listmobilesdkreleases listregexpatternsets listresourcesforwebacl listrulegroups listsettlementrecords listtagsforresource listwebacls putfirewallmanagerrulegroups putloggingconfiguration putmanagedrulesetversions putpermissionpolicy tagresource untagresource updateipset updatemanagedrulesetversionexpirydate updateregexpatternset updaterulegroup updatewebacl validatenetworksecuritymanagerruleconfiguration validatenetworksecuritymanagerwebaclconfiguration
Actions (64)
| Action | Access level | Policies granting without limits | Policies granting with resource or condition limits |
|---|---|---|---|
| wafv2:AssociateWebACL | Write | 5 | 7 |
| wafv2:CheckCapacity | Read | 11 | 5 |
| wafv2:CreateAPIKey | Write | 5 | 3 |
| wafv2:CreateIPSet | Write | 5 | 3 |
| wafv2:CreateRegexPatternSet | Write | 5 | 3 |
| wafv2:CreateRuleGroup | Write | 5 | 3 |
| wafv2:CreateWebACL | Write | 6 | 5 |
| wafv2:DeleteAPIKey | Write | 5 | 3 |
| wafv2:DeleteFirewallManagerRuleGroups | Write | 5 | 5 |
| wafv2:DeleteIPSet | Write | 5 | 3 |
| wafv2:DeleteLoggingConfiguration | Write | 5 | 6 |
| wafv2:DeletePermissionPolicy | Permissions management | 5 | 5 |
| wafv2:DeleteRegexPatternSet | Write | 5 | 3 |
| wafv2:DeleteRuleGroup | Write | 5 | 3 |
| wafv2:DeleteWebACL | Write | 5 | 5 |
| wafv2:DescribeAllManagedProducts | Read | 6 | 5 |
| wafv2:DescribeManagedProductsByVendor | Read | 6 | 5 |
| wafv2:DescribeManagedRuleGroup | Read | 8 | 6 |
| wafv2:DescribeTopContributorsByEvent | Read | 6 | 5 |
| wafv2:DisassociateFirewallManager | Write | 5 | 5 |
| wafv2:DisassociateWebACL | Write | 7 | 5 |
| wafv2:GenerateMobileSdkReleaseUrl | Read | 5 | 3 |
| wafv2:GetDecryptedAPIKey | Read | 8 | 5 |
| wafv2:GetIPSet | Read | 13 | 7 |
| wafv2:GetLoggingConfiguration | Read | 16 | 9 |
| wafv2:GetManagedRuleSet | Read | 8 | 5 |
| wafv2:GetMobileSdkRelease | Read | 8 | 5 |
| wafv2:GetPermissionPolicy | Read | 10 | 7 |
| wafv2:GetRateBasedStatementManagedKeys | Read | 10 | 5 |
| wafv2:GetRegexPatternSet | Read | 13 | 7 |
| wafv2:GetRevenueStatistics | Read | 8 | 5 |
| wafv2:GetRevenueStatisticsSummary | Read | 8 | 5 |
| wafv2:GetRevenueStatisticsTimeSeries | Read | 8 | 5 |
| wafv2:GetRuleGroup | Read | 15 | 8 |
| wafv2:GetSampledRequests | Read | 11 | 5 |
| wafv2:GetTopPathStatisticsByTraffic | Read | 8 | 5 |
| wafv2:GetWebACL | Read | 18 | 11 |
| wafv2:GetWebACLForResource | Read | 15 | 8 |
| wafv2:ListAPIKeys | List | 11 | 5 |
| wafv2:ListAvailableManagedRuleGroupVersions | List | 13 | 5 |
| wafv2:ListAvailableManagedRuleGroups | List | 16 | 6 |
| wafv2:ListIPSets | List | 15 | 7 |
| wafv2:ListLoggingConfigurations | List | 18 | 9 |
| wafv2:ListManagedRuleSets | List | 11 | 5 |
| wafv2:ListMobileSdkReleases | List | 11 | 5 |
| wafv2:ListRegexPatternSets | List | 15 | 7 |
| wafv2:ListResourcesForWebACL | List | 15 | 9 |
| wafv2:ListRuleGroups | List | 19 | 8 |
| wafv2:ListSettlementRecords | List | 11 | 5 |
| wafv2:ListTagsForResource | Read | 17 | 9 |
| wafv2:ListWebACLs | List | 22 | 7 |
| wafv2:PutFirewallManagerRuleGroups | Write | 5 | 5 |
| wafv2:PutLoggingConfiguration | Write | 6 | 7 |
| wafv2:PutManagedRuleSetVersions | Write | 5 | 3 |
| wafv2:PutPermissionPolicy | Permissions management | 5 | 5 |
| wafv2:TagResource | Tagging | 6 | 5 |
| wafv2:UntagResource | Tagging | 6 | 5 |
| wafv2:UpdateIPSet | Write | 5 | 3 |
| wafv2:UpdateManagedRuleSetVersionExpiryDate | Write | 5 | 3 |
| wafv2:UpdateRegexPatternSet | Write | 5 | 3 |
| wafv2:UpdateRuleGroup | Write | 5 | 3 |
| wafv2:UpdateWebACL | Write | 6 | 5 |
| wafv2:ValidateNetworkSecurityManagerRuleConfiguration | Read | 5 | 4 |
| wafv2:ValidateNetworkSecurityManagerWebACLConfiguration | Read | 5 | 4 |