本文為英文版的機器翻譯版本，如內容有任何歧義或不一致之處，概以英文版為準。
# AWSWAFConsoleFullAccess
**描述**：透過 提供 AWS WAF 的完整存取權 AWS 管理主控台。請注意，此政策也授予列出和更新 Amazon CloudFront 分佈的許可、檢視彈性負載平衡器 on AWS Elastic Load Balancing 的許可、檢視 Amazon API Gateway REST APIs許可、列出和檢視 Amazon CloudWatch 指標的許可，以及檢視帳戶內啟用區域的許可。
`AWSWAFConsoleFullAccess` 是 [AWS 受管政策](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies)。
## 使用此政策
您可以將 `AWSWAFConsoleFullAccess` 連接至使用者、群組與角色。
## 政策詳細資訊
+ **類型**： AWS 受管政策
+ **建立時間**：2020 年 4 月 6 日 18：38 UTC
+ **編輯時間：**2026 年 4 月 8 日 22：12 UTC
+ **ARN**: `arn:aws:iam::aws:policy/AWSWAFConsoleFullAccess`
## 政策版本
**政策版本：** v21 （預設）
政策的預設版本是定義政策許可的版本。當具有 政策的使用者或角色提出存取 AWS 資源的請求時， 會 AWS 檢查政策的預設版本，以決定是否允許請求。
## JSON 政策文件
```
{
"Version" : "2012-10-17",
"Statement" : [
{
"Sid" : "AllowUseOfAWSWAFClassic",
"Effect" : "Allow",
"Action" : [
"waf:*",
"waf-regional:*"
],
"Resource" : [
"arn:aws:waf::*:bytematchset/*",
"arn:aws:waf::*:ipset/*",
"arn:aws:waf::*:ratebasedrule/*",
"arn:aws:waf::*:rule/*",
"arn:aws:waf::*:sizeconstraintset/*",
"arn:aws:waf::*:sqlinjectionset/*",
"arn:aws:waf::*:webacl/*",
"arn:aws:waf::*:xssmatchset/*",
"arn:aws:waf::*:regexmatch/*",
"arn:aws:waf::*:regexpatternset/*",
"arn:aws:waf::*:geomatchset/*",
"arn:aws:waf::*:rulegroup/*",
"arn:aws:waf:*:*:changetoken/*",
"arn:aws:waf-regional:*:*:bytematchset/*",
"arn:aws:waf-regional:*:*:ipset/*",
"arn:aws:waf-regional:*:*:ratebasedrule/*",
"arn:aws:waf-regional:*:*:rule/*",
"arn:aws:waf-regional:*:*:sizeconstraintset/*",
"arn:aws:waf-regional:*:*:sqlinjectionset/*",
"arn:aws:waf-regional:*:*:webacl/*",
"arn:aws:waf-regional:*:*:xssmatchset/*",
"arn:aws:waf-regional:*:*:regexmatch/*",
"arn:aws:waf-regional:*:*:regexpatternset/*",
"arn:aws:waf-regional:*:*:geomatchset/*",
"arn:aws:waf-regional:*:*:rulegroup/*",
"arn:aws:waf-regional:*:*:changetoken/*"
]
},
{
"Sid" : "AllowWAFClassicGetWebACLForResource",
"Effect" : "Allow",
"Action" : [
"waf-regional:GetWebACLForResource"
],
"Resource" : "arn:aws:waf-regional:*:*:*/*"
},
{
"Sid" : "AllowUseOfAWSWAF",
"Effect" : "Allow",
"Action" : [
"wafv2:*"
],
"Resource" : [
"arn:aws:wafv2:*:*:*/webacl/*/*",
"arn:aws:wafv2:*:*:*/ipset/*/*",
"arn:aws:wafv2:*:*:*/managedruleset/*/*",
"arn:aws:wafv2:*:*:*/rulegroup/*/*",
"arn:aws:wafv2:*:*:*/regexpatternset/*/*"
]
},
{
"Sid" : "AllowDisassociateWebACL",
"Effect" : "Allow",
"Action" : [
"wafv2:DisassociateWebACL"
],
"Resource" : "*"
},
{
"Sid" : "AllowS3ListAllMyBuckets",
"Effect" : "Allow",
"Action" : [
"s3:ListAllMyBuckets"
],
"Resource" : "*"
},
{
"Sid" : "AllowEC2DescribeRegions",
"Effect" : "Allow",
"Action" : [
"ec2:DescribeRegions"
],
"Resource" : "*"
},
{
"Sid" : "AllowListActionsForCloudWatch",
"Effect" : "Allow",
"Action" : [
"cloudwatch:GetMetricData",
"cloudwatch:GetMetricStatistics",
"cloudwatch:ListMetrics"
],
"Resource" : "*"
},
{
"Sid" : "AllowActionsForCloudFront",
"Effect" : "Allow",
"Action" : [
"cloudfront:GetDistributionConfig",
"cloudfront:GetDistribution",
"cloudfront:UpdateDistribution",
"cloudfront:AssociateDistributionWebACL",
"cloudfront:DisassociateDistributionWebACL"
],
"Resource" : "arn:aws:cloudfront::*:distribution/*"
},
{
"Sid" : "AllowListActionsForCloudFront",
"Effect" : "Allow",
"Action" : [
"cloudfront:ListDistributions",
"cloudfront:ListDistributionsByWebACLId"
],
"Resource" : "*"
},
{
"Sid" : "AllowActionsForCloudFrontTenant",
"Effect" : "Allow",
"Action" : [
"cloudfront:GetDistributionTenant",
"cloudfront:AssociateDistributionTenantWebACL",
"cloudfront:DisassociateDistributionTenantWebACL"
],
"Resource" : "arn:aws:cloudfront::*:distribution-tenant/*"
},
{
"Sid" : "AllowListActionsForCloudFrontTenant",
"Effect" : "Allow",
"Action" : [
"cloudfront:ListDistributionTenants",
"cloudfront:ListDistributionTenantsByCustomization"
],
"Resource" : "*"
},
{
"Sid" : "AllowActionsForALB",
"Effect" : "Allow",
"Action" : [
"elasticloadbalancing:SetWebAcl",
"elasticloadbalancing:CreateWebACLAssociation",
"elasticloadbalancing:DeleteWebACLAssociation",
"elasticloadbalancing:GetLoadBalancerWebACL"
],
"Resource" : "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*"
},
{
"Sid" : "AllowListActionsForALB",
"Effect" : "Allow",
"Action" : [
"elasticloadbalancing:DescribeLoadBalancers",
"elasticloadbalancing:DescribeWebACLAssociation"
],
"Resource" : "*"
},
{
"Sid" : "AllowActionsForAPIGateway",
"Effect" : "Allow",
"Action" : [
"apigateway:SetWebACL"
],
"Resource" : "arn:aws:apigateway:*::/restapis/*/stages/*"
},
{
"Sid" : "AllowListActionsForAPIGateway",
"Effect" : "Allow",
"Action" : [
"apigateway:GET"
],
"Resource" : "arn:aws:apigateway:*::/*"
},
{
"Sid" : "AllowActionsForAppSync",
"Effect" : "Allow",
"Action" : [
"appsync:SetWebACL",
"appsync:AssociateWebACL",
"appsync:DisassociateWebACL",
"appsync:GetWebACLForResource"
],
"Resource" : "arn:aws:appsync:*:*:apis/*"
},
{
"Sid" : "AllowListActionsForAppSync",
"Effect" : "Allow",
"Action" : [
"appsync:ListGraphqlApis",
"appsync:ListApis",
"appsync:ListResourcesForWebACL"
],
"Resource" : "*"
},
{
"Sid" : "AllowActionsForCognito",
"Effect" : "Allow",
"Action" : [
"cognito-idp:AssociateWebACL",
"cognito-idp:DisassociateWebACL",
"cognito-idp:GetWebACLForResource"
],
"Resource" : "arn:aws:cognito-idp:*:*:userpool/*"
},
{
"Sid" : "AllowListActionsForCognito",
"Effect" : "Allow",
"Action" : [
"cognito-idp:ListUserPools",
"cognito-idp:ListResourcesForWebACL"
],
"Resource" : "*"
},
{
"Sid" : "AllowActionsForAppRunner",
"Effect" : "Allow",
"Action" : [
"apprunner:AssociateWebAcl",
"apprunner:DisassociateWebAcl",
"apprunner:DescribeWebAclForService"
],
"Resource" : "arn:aws:apprunner:*:*:service/*/*"
},
{
"Sid" : "AllowListActionsForAppRunner",
"Effect" : "Allow",
"Action" : [
"apprunner:ListServices",
"apprunner:ListAssociatedServicesForWebAcl"
],
"Resource" : "*"
},
{
"Sid" : "AllowActionsForAVA",
"Effect" : "Allow",
"Action" : [
"ec2:AssociateVerifiedAccessInstanceWebAcl",
"ec2:DisassociateVerifiedAccessInstanceWebAcl",
"ec2:GetVerifiedAccessInstanceWebAcl"
],
"Resource" : "arn:aws:ec2:*:*:verified-access-instance/*"
},
{
"Sid" : "AllowListActionsForAVA",
"Effect" : "Allow",
"Action" : [
"ec2:DescribeVerifiedAccessInstances",
"ec2:DescribeVerifiedAccessInstanceWebAclAssociations"
],
"Resource" : "*"
},
{
"Sid" : "AllowActionsForAmplify",
"Effect" : "Allow",
"Action" : [
"amplify:AssociateWebACL",
"amplify:DisassociateWebACL",
"amplify:GetWebACLForResource"
],
"Resource" : "arn:aws:amplify:*:*:apps/*"
},
{
"Sid" : "AllowListActionsForAmplify",
"Effect" : "Allow",
"Action" : [
"amplify:ListApps",
"amplify:ListResourcesForWebACL"
],
"Resource" : "*"
},
{
"Sid" : "AllowLogQueryActions",
"Effect" : "Allow",
"Action" : [
"logs:StartQuery",
"logs:DescribeQueryDefinitions",
"logs:GetQueryResults"
],
"Resource" : "arn:aws:logs:*:*:log-group:aws-waf-logs-*"
},
{
"Sid" : "AllowLogGroupDescribeActions",
"Effect" : "Allow",
"Action" : [
"logs:DescribeResourcePolicies",
"logs:DescribeLogGroups"
],
"Resource" : "*"
},
{
"Sid" : "AllowLogDeliverySubscription",
"Effect" : "Allow",
"Action" : [
"logs:CreateLogDelivery",
"logs:DeleteLogDelivery"
],
"Resource" : "*"
},
{
"Sid" : "GrantLogDeliveryPermissionForS3Bucket",
"Effect" : "Allow",
"Action" : [
"s3:PutBucketPolicy",
"s3:GetBucketPolicy"
],
"Resource" : [
"arn:aws:s3:::aws-waf-logs-*"
]
},
{
"Sid" : "GrantLogDeliveryPermissionForCloudWatchLogGroup",
"Effect" : "Allow",
"Action" : [
"logs:PutResourcePolicy"
],
"Resource" : "*",
"Condition" : {
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"wafv2.amazonaws.com"
]
}
}
},
{
"Sid" : "AllowListActionForFirehoseStream",
"Effect" : "Allow",
"Action" : [
"firehose:ListDeliveryStreams"
],
"Resource" : "*"
},
{
"Sid" : "AllowActionsForPricing",
"Effect" : "Allow",
"Action" : [
"pricing:ListPriceLists",
"pricing:GetPriceListFileUrl"
],
"Resource" : "*"
},
{
"Sid" : "AllowMarketplaceViewSubscriptions",
"Effect" : "Allow",
"Action" : [
"aws-marketplace:ViewSubscriptions"
],
"Resource" : "*"
},
{
"Sid" : "AllowActionsForPricingPlanManager",
"Effect" : "Allow",
"Action" : [
"pricingplanmanager:GetSubscription",
"pricingplanmanager:UpdateSubscription",
"pricingplanmanager:CancelSubscription",
"pricingplanmanager:CancelSubscriptionChange"
],
"Resource" : "arn:aws:pricingplanmanager::*:subscription:*"
},
{
"Sid" : "AllowListActionsForRoute53",
"Effect" : "Allow",
"Action" : [
"route53:ListHostedZones",
"route53:GetHostedZone"
],
"Resource" : "*"
},
{
"Sid" : "AllowListActionsForPricingPlanManager",
"Effect" : "Allow",
"Action" : "pricingplanmanager:ListSubscriptions",
"Resource" : "*"
}
]
}
```
## 進一步了解
+ [在 IAM Identity Center 中使用 AWS 受管政策建立許可集](https://docs.aws.amazon.com/singlesignon/latest/userguide/howtocreatepermissionset.html)
+ [新增和移除 IAM 身分許可](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html)
+ [了解 IAM 政策的版本控制](https://docs.aws.amazon.com//IAM/latest/UserGuide/access_policies_managed-versioning.html)
+ [開始使用 AWS 受管政策，並朝最低權限的許可邁進](https://docs.aws.amazon.com//IAM/latest/UserGuide/best-practices.html#bp-use-aws-defined-policies)