AWS managed policies for AWS WAF
This section explains how to use AWS managed policies for AWS WAF.
An AWS managed policy is a standalone policy that is created and administered by AWS. AWS managed policies are designed to provide permissions for many common use cases so that you can start assigning permissions to users, groups, and roles.
Keep in mind that AWS managed policies might not grant least-privilege permissions for your specific use cases because they're available for all AWS customers to use. We recommend that you reduce permissions further by defining customer managed policies that are specific to your use cases.
You cannot change the permissions defined in AWS managed policies. If AWS updates the permissions defined in an AWS managed policy, the update affects all principal identities (users, groups, and roles) that the policy is attached to. AWS is most likely to update an AWS managed policy when a new AWS service is launched or new API operations become available for existing services.
For more information, see AWS managed policies in the IAM User Guide.
AWS managed policy: AWSWAFReadOnlyAccess
This policy grants read-only permissions that allow users to access AWS WAF resources and resources for integrated services, such as Amazon CloudFront, Amazon API Gateway, Application Load Balancer, AWS AppSync, Amazon Cognito, AWS App Runner, and AWS Verified Access. You can attach this policy to your IAM identities. AWS WAF also attaches this policy to a service role that allows AWS WAF to perform actions on your behalf.
For details about this policy, see AWSWAFReadOnlyAccess
AWS managed policy: AWSWAFFullAccess
This policy grants full access to AWS WAF resources and resources for integrated services, such as Amazon CloudFront, Amazon API Gateway, Application Load Balancer, AWS AppSync, Amazon Cognito, AWS App Runner, and AWS Verified Access. You can attach this policy to your IAM identities. AWS WAF also attaches this policy to a service role that allows AWS WAF to perform actions on your behalf.
For details about this policy, see AWSWAFFullAccess
AWS managed policy: AWSWAFConsoleReadOnlyAccess
This policy grants read-only permissions to the AWS WAF console, which includes resources for AWS WAF and for integrated services, such as Amazon CloudFront, Amazon API Gateway, Application Load Balancer, AWS AppSync, Amazon Cognito, AWS App Runner, and AWS Verified Access. You can attach this policy to your IAM identities. AWS WAF also attaches this policy to aiam/home#/policies/arn:aws:iam::aws:policy/AWSWAFConsoleFullAccess$serviceLevelSummary service role that allows AWS WAF to perform actions on your behalf.
For details about this policy, see AWSWAFConsoleReadOnlyAccess
AWS managed policy: AWSWAFConsoleFullAccess
This policy grants full access to the AWS WAF console, which includes resources for AWS WAF and for integrated services, such as Amazon CloudFront, Amazon API Gateway, Application Load Balancer, AWS AppSync, Amazon Cognito, AWS App Runner, and AWS Verified Access. You can attach this policy to your IAM identities. AWS WAF also attaches this policy to a service role that allows AWS WAF to perform actions on your behalf.
For details about this policy, see AWSWAFConsoleFullAccess
AWS managed policy: WAFV2LoggingServiceRolePolicy
This policy allows AWS WAF to write logs to Amazon Data Firehose. This policy is used only if you enable logging in AWS WAF.
This policy is attached to the service-linked role AWSServiceRoleForWAFV2Logging
For details about this policy, see WAFV2LoggingServiceRolePolicy
AWS WAF updates to AWS managed policies
View details about updates to AWS managed policies for AWS WAF since this service began tracking these changes. For automatic alerts about changes to this page, subscribe to the RSS feed on the AWS WAF document history page at Document history.
| Policy | Description of change | Date |
|---|---|---|
This policy allows AWS WAF to write logs to Amazon Data Firehose. It's used only if you enable logging. Details in IAM console: WAFV2LoggingServiceRolePolicy |
Added Statement IDs (Sids) to the permissions settings in the service-linked role that this policy is attached to. |
2024-06-03 |
This service-linked role provides permissions policies that allow AWS WAF to write logs to Amazon Data Firehose. Details in IAM console: AWSServiceRoleForWAFV2Logging |
Added Statement IDs (Sids) to the permissions settings. |
2024-06-03 |
|
AWS WAF additions to change tracking |
AWS WAF started tracking changes for the managed policy |
2024-06-03 |
This policy allows AWS WAF to manage AWS resources on your behalf in AWS WAF and in integrated services. Details in IAM console: AWSWAFFullAccess |
Expanded permissions to add AWS Verified Access instances to the resource types that you can protect with AWS WAF. |
2023-06-17 |
This policy allows AWS WAF to manage AWS resources on your behalf in AWS WAF and in integrated services. Details in IAM console: AWSWAFReadOnlyAccess |
Expanded permissions to add AWS Verified Access instances to the resource types that you can protect with AWS WAF. |
2023-06-17 |
|
This policy allows AWS WAF to manage AWS console resources and other AWS resources on your behalf in AWS WAF and in integrated services. Details in IAM console: AWSWAFConsoleFullAccess |
Expanded permissions to add AWS Verified Access instances to the resource types that you can protect with AWS WAF. |
2023-06-17 |
|
This policy allows AWS WAF to manage AWS console resources and other AWS resources on your behalf in AWS WAF and in integrated services. Details in IAM console: AWSWAFConsoleReadOnlyAccess |
Expanded permissions to add AWS Verified Access instances to the resource types that you can protect with AWS WAF. |
2023-06-17 |
This policy allows AWS WAF to manage AWS resources on your behalf in AWS WAF and in integrated services. Details in IAM console: AWSWAFFullAccess |
Expanded permissions to correct the access settings for AWS App Runner services. |
2023-06-06 |
This policy allows AWS WAF to manage AWS resources on your behalf in AWS WAF and in integrated services. Details in IAM console: AWSWAFReadOnlyAccess |
Expanded permissions to correct the access settings for AWS App Runner services. |
2023-06-06 |
|
This policy allows AWS WAF to manage AWS console resources and other AWS resources on your behalf in AWS WAF and in integrated services. Details in IAM console: AWSWAFConsoleFullAccess |
Expanded permissions to correct the access settings for AWS App Runner services. |
2023-06-06 |
|
This policy allows AWS WAF to manage AWS console resources and other AWS resources on your behalf in AWS WAF and in integrated services. Details in IAM console: AWSWAFConsoleReadOnlyAccess |
Expanded permissions to correct the access settings for AWS App Runner services. |
2023-06-06 |
This policy allows AWS WAF to manage AWS resources on your behalf in AWS WAF and in integrated services. Details in IAM console: AWSWAFFullAccess |
Expanded permissions to add AWS App Runner services to the resource types that you can protect with AWS WAF. |
2023-03-30 |
This policy allows AWS WAF to manage AWS resources on your behalf in AWS WAF and in integrated services. Details in IAM console: AWSWAFReadOnlyAccess |
Expanded permissions to add AWS App Runner services to the resource types that you can protect with AWS WAF. |
2023-03-30 |
|
This policy allows AWS WAF to manage AWS console resources and other AWS resources on your behalf in AWS WAF and in integrated services. Details in IAM console: AWSWAFConsoleFullAccess |
Expanded permissions to add AWS App Runner services to the resource types that you can protect with AWS WAF. |
2023-03-30 |
|
This policy allows AWS WAF to manage AWS console resources and other AWS resources on your behalf in AWS WAF and in integrated services. Details in IAM console: AWSWAFConsoleReadOnlyAccess |
Expanded permissions to add AWS App Runner services to the resource types that you can protect with AWS WAF. |
2023-03-30 |
This policy allows AWS WAF to manage AWS resources on your behalf in AWS WAF and in integrated services. Details in IAM console: AWSWAFFullAccess |
Expanded permissions to add Amazon Cognito user pools to the resource types that you can protect with AWS WAF. |
2022-08-25 |
This policy allows AWS WAF to manage AWS resources on your behalf in AWS WAF and in integrated services. Details in IAM console: AWSWAFReadOnlyAccess |
Expanded permissions to add Amazon Cognito user pools to the resource types that you can protect with AWS WAF. |
2022-08-25 |
|
This policy allows AWS WAF to manage AWS console resources and other AWS resources on your behalf in AWS WAF and in integrated services. Details in IAM console: AWSWAFConsoleFullAccess |
Expanded permissions to add Amazon Cognito user pools to the resource types that you can protect with AWS WAF. |
2022-08-25 |
|
This policy allows AWS WAF to manage AWS console resources and other AWS resources on your behalf in AWS WAF and in integrated services. Details in IAM console: AWSWAFConsoleReadOnlyAccess |
Expanded permissions to add Amazon Cognito user pools to the resource types that you can protect with AWS WAF. |
2022-08-25 |
This policy allows AWS WAF to manage AWS resources on your behalf in AWS WAF and in integrated services. Details in IAM console: AWSWAFFullAccess |
Corrected the permissions settings for log delivery for Amazon Simple Storage Service (Amazon S3) and Amazon CloudWatch Logs. This change resolves access denied errors that were occurring during logging configuration. For information about logging your web ACL traffic, see Logging AWS WAF web ACL traffic. |
2022-01-11 |
|
This policy allows AWS WAF to manage AWS console resources and other AWS resources on your behalf in AWS WAF and in integrated services. Details in IAM console: AWSWAFConsoleFullAccess |
Corrected the permissions settings for log delivery for Amazon Simple Storage Service (Amazon S3) and Amazon CloudWatch Logs. This change resolves access errors that were occurring during logging configuration. For information about logging your web ACL traffic, see Logging AWS WAF web ACL traffic. |
2022-01-11 |
|
This policy allows AWS WAF to manage AWS resources on your behalf in AWS WAF and in integrated services. Details in IAM console: AWSWAFFullAccess |
Added new permissions for expanded logging options. This change gives AWS WAF access to the additional logging destinations Amazon Simple Storage Service (Amazon S3) and Amazon CloudWatch Logs. For information about logging your web ACL traffic, see Logging AWS WAF web ACL traffic. |
2021-11-15 |
|
This policy allows AWS WAF to manage AWS console resources and other AWS resources on your behalf in AWS WAF and in integrated services. Details in IAM console: AWSWAFConsoleFullAccess |
Added new permissions for expanded logging options. This change gives AWS WAF access to the additional logging destinations Amazon Simple Storage Service (Amazon S3) and Amazon CloudWatch Logs. For information about logging your web ACL traffic, see Logging AWS WAF web ACL traffic. |
2021-11-15 |
|
AWS WAF started tracking changes |
AWS WAF started tracking changes for its AWS managed policies. |
2021-3-01 |
