Amazon managed policies for Amazon WAF
This section explains how to use Amazon managed policies for Amazon WAF.
An Amazon managed policy is a standalone policy that is created and administered by Amazon. Amazon managed policies are designed to provide permissions for many common use cases so that you can start assigning permissions to users, groups, and roles.
Keep in mind that Amazon managed policies might not grant least-privilege permissions for your specific use cases because they're available for all Amazon customers to use. We recommend that you reduce permissions further by defining customer managed policies that are specific to your use cases.
You cannot change the permissions defined in Amazon managed policies. If Amazon updates the permissions defined in an Amazon managed policy, the update affects all principal identities (users, groups, and roles) that the policy is attached to. Amazon is most likely to update an Amazon managed policy when a new Amazon Web Services service is launched or new API operations become available for existing services.
For more information, see Amazon managed policies in the IAM User Guide.
Amazon managed policy: AWSWAFReadOnlyAccess
This policy grants read-only permissions that allow users to access Amazon WAF resources and resources for integrated services, such as Amazon CloudFront, Amazon API Gateway, Application Load Balancer, Amazon AppSync, Amazon Cognito, Amazon App Runner, and Amazon Verified Access. You can attach this policy to your IAM identities. Amazon WAF also attaches this policy to a service role that allows Amazon WAF to perform actions on your behalf.
For details about this policy, see AWSWAFReadOnlyAccess
Amazon managed policy: AWSWAFFullAccess
This policy grants full access to Amazon WAF resources and resources for integrated services, such as Amazon CloudFront, Amazon API Gateway, Application Load Balancer, Amazon AppSync, Amazon Cognito, Amazon App Runner, and Amazon Verified Access. You can attach this policy to your IAM identities. Amazon WAF also attaches this policy to a service role that allows Amazon WAF to perform actions on your behalf.
For details about this policy, see AWSWAFFullAccess
Amazon managed policy: AWSWAFConsoleReadOnlyAccess
This policy grants read-only permissions to the Amazon WAF console, which includes resources for Amazon WAF and for integrated services, such as Amazon CloudFront, Amazon API Gateway, Application Load Balancer, Amazon AppSync, Amazon Cognito, Amazon App Runner, and Amazon Verified Access. You can attach this policy to your IAM identities. Amazon WAF also attaches this policy to aiam/home#/policies/arn:aws:iam::aws:policy/AWSWAFConsoleFullAccess$serviceLevelSummary service role that allows Amazon WAF to perform actions on your behalf.
For details about this policy, see AWSWAFConsoleReadOnlyAccess
Amazon managed policy: AWSWAFConsoleFullAccess
This policy grants full access to the Amazon WAF console, which includes resources for Amazon WAF and for integrated services, such as Amazon CloudFront, Amazon API Gateway, Application Load Balancer, Amazon AppSync, Amazon Cognito, Amazon App Runner, and Amazon Verified Access. You can attach this policy to your IAM identities. Amazon WAF also attaches this policy to a service role that allows Amazon WAF to perform actions on your behalf.
For details about this policy, see AWSWAFConsoleFullAccess
Amazon managed policy: WAFV2LoggingServiceRolePolicy
This policy allows Amazon WAF to write logs to Amazon Data Firehose. This policy is used only if you enable logging in Amazon WAF.
This policy is attached to the service-linked role AWSServiceRoleForWAFV2Logging
For details about this policy, see WAFV2LoggingServiceRolePolicy
Amazon WAF updates to Amazon managed policies
View details about updates to Amazon managed policies for Amazon WAF since this service began tracking these changes. For automatic alerts about changes to this page, subscribe to the RSS feed on the Amazon WAF document history page at Document history.
| Policy | Description of change | Date |
|---|---|---|
This policy allows Amazon WAF to write logs to Amazon Data Firehose. It's used only if you enable logging. Details in IAM console: WAFV2LoggingServiceRolePolicy |
Added Statement IDs (Sids) to the permissions settings in the service-linked role that this policy is attached to. |
2024-06-03 |
This service-linked role provides permissions policies that allow Amazon WAF to write logs to Amazon Data Firehose. Details in IAM console: AWSServiceRoleForWAFV2Logging |
Added Statement IDs (Sids) to the permissions settings. |
2024-06-03 |
|
Amazon WAF additions to change tracking |
Amazon WAF started tracking changes for the managed policy |
2024-06-03 |
This policy allows Amazon WAF to manage Amazon resources on your behalf in Amazon WAF and in integrated services. Details in IAM console: AWSWAFFullAccess |
Expanded permissions to add Amazon Verified Access instances to the resource types that you can protect with Amazon WAF. |
2023-06-17 |
This policy allows Amazon WAF to manage Amazon resources on your behalf in Amazon WAF and in integrated services. Details in IAM console: AWSWAFReadOnlyAccess |
Expanded permissions to add Amazon Verified Access instances to the resource types that you can protect with Amazon WAF. |
2023-06-17 |
|
This policy allows Amazon WAF to manage Amazon console resources and other Amazon resources on your behalf in Amazon WAF and in integrated services. Details in IAM console: AWSWAFConsoleFullAccess |
Expanded permissions to add Amazon Verified Access instances to the resource types that you can protect with Amazon WAF. |
2023-06-17 |
|
This policy allows Amazon WAF to manage Amazon console resources and other Amazon resources on your behalf in Amazon WAF and in integrated services. Details in IAM console: AWSWAFConsoleReadOnlyAccess |
Expanded permissions to add Amazon Verified Access instances to the resource types that you can protect with Amazon WAF. |
2023-06-17 |
This policy allows Amazon WAF to manage Amazon resources on your behalf in Amazon WAF and in integrated services. Details in IAM console: AWSWAFFullAccess |
Expanded permissions to correct the access settings for Amazon App Runner services. |
2023-06-06 |
This policy allows Amazon WAF to manage Amazon resources on your behalf in Amazon WAF and in integrated services. Details in IAM console: AWSWAFReadOnlyAccess |
Expanded permissions to correct the access settings for Amazon App Runner services. |
2023-06-06 |
|
This policy allows Amazon WAF to manage Amazon console resources and other Amazon resources on your behalf in Amazon WAF and in integrated services. Details in IAM console: AWSWAFConsoleFullAccess |
Expanded permissions to correct the access settings for Amazon App Runner services. |
2023-06-06 |
|
This policy allows Amazon WAF to manage Amazon console resources and other Amazon resources on your behalf in Amazon WAF and in integrated services. Details in IAM console: AWSWAFConsoleReadOnlyAccess |
Expanded permissions to correct the access settings for Amazon App Runner services. |
2023-06-06 |
This policy allows Amazon WAF to manage Amazon resources on your behalf in Amazon WAF and in integrated services. Details in IAM console: AWSWAFFullAccess |
Expanded permissions to add Amazon App Runner services to the resource types that you can protect with Amazon WAF. |
2023-03-30 |
This policy allows Amazon WAF to manage Amazon resources on your behalf in Amazon WAF and in integrated services. Details in IAM console: AWSWAFReadOnlyAccess |
Expanded permissions to add Amazon App Runner services to the resource types that you can protect with Amazon WAF. |
2023-03-30 |
|
This policy allows Amazon WAF to manage Amazon console resources and other Amazon resources on your behalf in Amazon WAF and in integrated services. Details in IAM console: AWSWAFConsoleFullAccess |
Expanded permissions to add Amazon App Runner services to the resource types that you can protect with Amazon WAF. |
2023-03-30 |
|
This policy allows Amazon WAF to manage Amazon console resources and other Amazon resources on your behalf in Amazon WAF and in integrated services. Details in IAM console: AWSWAFConsoleReadOnlyAccess |
Expanded permissions to add Amazon App Runner services to the resource types that you can protect with Amazon WAF. |
2023-03-30 |
This policy allows Amazon WAF to manage Amazon resources on your behalf in Amazon WAF and in integrated services. Details in IAM console: AWSWAFFullAccess |
Expanded permissions to add Amazon Cognito user pools to the resource types that you can protect with Amazon WAF. |
2022-08-25 |
This policy allows Amazon WAF to manage Amazon resources on your behalf in Amazon WAF and in integrated services. Details in IAM console: AWSWAFReadOnlyAccess |
Expanded permissions to add Amazon Cognito user pools to the resource types that you can protect with Amazon WAF. |
2022-08-25 |
|
This policy allows Amazon WAF to manage Amazon console resources and other Amazon resources on your behalf in Amazon WAF and in integrated services. Details in IAM console: AWSWAFConsoleFullAccess |
Expanded permissions to add Amazon Cognito user pools to the resource types that you can protect with Amazon WAF. |
2022-08-25 |
|
This policy allows Amazon WAF to manage Amazon console resources and other Amazon resources on your behalf in Amazon WAF and in integrated services. Details in IAM console: AWSWAFConsoleReadOnlyAccess |
Expanded permissions to add Amazon Cognito user pools to the resource types that you can protect with Amazon WAF. |
2022-08-25 |
This policy allows Amazon WAF to manage Amazon resources on your behalf in Amazon WAF and in integrated services. Details in IAM console: AWSWAFFullAccess |
Corrected the permissions settings for log delivery for Amazon Simple Storage Service (Amazon S3) and Amazon CloudWatch Logs. This change resolves access denied errors that were occurring during logging configuration. For information about logging your web ACL traffic, see Logging Amazon WAF web ACL traffic. |
2022-01-11 |
|
This policy allows Amazon WAF to manage Amazon console resources and other Amazon resources on your behalf in Amazon WAF and in integrated services. Details in IAM console: AWSWAFConsoleFullAccess |
Corrected the permissions settings for log delivery for Amazon Simple Storage Service (Amazon S3) and Amazon CloudWatch Logs. This change resolves access errors that were occurring during logging configuration. For information about logging your web ACL traffic, see Logging Amazon WAF web ACL traffic. |
2022-01-11 |
|
This policy allows Amazon WAF to manage Amazon resources on your behalf in Amazon WAF and in integrated services. Details in IAM console: AWSWAFFullAccess |
Added new permissions for expanded logging options. This change gives Amazon WAF access to the additional logging destinations Amazon Simple Storage Service (Amazon S3) and Amazon CloudWatch Logs. For information about logging your web ACL traffic, see Logging Amazon WAF web ACL traffic. |
2021-11-15 |
|
This policy allows Amazon WAF to manage Amazon console resources and other Amazon resources on your behalf in Amazon WAF and in integrated services. Details in IAM console: AWSWAFConsoleFullAccess |
Added new permissions for expanded logging options. This change gives Amazon WAF access to the additional logging destinations Amazon Simple Storage Service (Amazon S3) and Amazon CloudWatch Logs. For information about logging your web ACL traffic, see Logging Amazon WAF web ACL traffic. |
2021-11-15 |
|
Amazon WAF started tracking changes |
Amazon WAF started tracking changes for its Amazon managed policies. |
2021-3-01 |