Introducing a new console experience for Amazon WAF
You can now use the updated experience to access Amazon WAF functionality anywhere in the console. For more details, see Working with the updated console experience.
Identity-based policy examples for Amazon Shield network security director
Note
When you start using Amazon Shield network security director, we automatically create a service-linked role that satisfies all the minimum permissions requirements. Creating and managing your own identity-based policies is optional.
To provide appropriate access to network security director, you can create identity-based policies that grant the necessary permissions for administrative and read-only access.
For more information about creating and managing IAM policies, see Managed policies and inline policies in the IAM User Guide.
These permissions allow Amazon Shield network security director to perform comprehensive security analysis and provide accurate network security recommendations. The example policies provided in this guide are designed for common use cases. You can use these policies as a starting point and modify them as needed to meet your specific requirements.
Example policies in this guide
Policy best practices
Identity-based policies determine whether someone can create, access, or delete network security director resources in your account. These actions can incur costs for your Amazon Web Services account. When you create or edit identity-based policies, follow these guidelines and recommendations:
-
Get started with Amazon managed policies and move toward least-privilege permissions – To get started granting permissions to your users and workloads, use the Amazon managed policies that grant permissions for many common use cases. They are available in your Amazon Web Services account. We recommend that you reduce permissions further by defining Amazon customer managed policies that are specific to your use cases. For more information, see Amazon managed policies or Amazon managed policies for job functions in the IAM User Guide.
-
Apply least-privilege permissions – When you set permissions with IAM policies, grant only the permissions required to perform a task. You do this by defining the actions that can be taken on specific resources under specific conditions, also known as least-privilege permissions. For more information about using IAM to apply permissions, see Policies and permissions in IAM in the IAM User Guide.
-
Use conditions in IAM policies to further restrict access – You can add a condition to your policies to limit access to actions and resources. For example, you can write a policy condition to specify that all requests must be sent using SSL. You can also use conditions to grant access to service actions if they are used through a specific Amazon Web Services service, such as Amazon CloudFormation. For more information, see IAM JSON policy elements: Condition in the IAM User Guide.
-
Use IAM Access Analyzer to validate your IAM policies to ensure secure and functional permissions – IAM Access Analyzer validates new and existing policies so that the policies adhere to the IAM policy language (JSON) and IAM best practices. IAM Access Analyzer provides more than 100 policy checks and actionable recommendations to help you author secure and functional policies. For more information, see Validate policies with IAM Access Analyzer in the IAM User Guide.
-
Require multi-factor authentication (MFA) – If you have a scenario that requires IAM users or a root user in your Amazon Web Services account, turn on MFA for additional security. To require MFA when API operations are called, add MFA conditions to your policies. For more information, see Secure API access with MFA in the IAM User Guide.
For more information about best practices in IAM, see Security best practices in IAM in the IAM User Guide.
Updates to identity-based policies
As updates and features are added to network security director, you may need to update your identity-based policies to include additional permissions. Monitor this guide for information about new permissions that may be required.
Unlike Amazon managed policies, customer managed policies are not automatically updated. You are responsible for maintaining and updating these policies as needed.
For more information, see Adding permissions to a user in the IAM User Guide.
Administrative access identity-based policy
Create an identity-based policy with the following example to provide full administrative access to network security director operations and the ability to create the required service-linked role.
Policy name: NetworkSecurityDirectorAdminPolicy
Policy description: Allows full administrative access to Amazon Shield network security director operations and also provides access to create or delete the service linked role for Network Security Director.
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "network-secusrity-director:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/network-security-director.amazonaws.com/AWSServiceRoleForNetworkSecurityDirector" } ] }
Read-only access identity-based policy
Create an identity-based policy with the following policy example to provide read-only access to network security director operations.
Policy name: NetworkSecurityDirectorReadOnlyPolicy
Policy description: Allows read-only access to Amazon Shield network security director.
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "network-security-director:Get*", "network-security-director:List*" ], "Resource": "*" } ] }