AWS managed policies for AWS WAF
An AWS managed policy is a standalone policy that is created and administered by AWS. AWS managed policies are designed to provide permissions for many common use cases so that you can start assigning permissions to users, groups, and roles.
Keep in mind that AWS managed policies might not grant least-privilege permissions for your specific use cases because they're available for all AWS customers to use. We recommend that you reduce permissions further by defining customer managed policies that are specific to your use cases.
You cannot change the permissions defined in AWS managed policies. If AWS updates the permissions defined in an AWS managed policy, the update affects all principal identities (users, groups, and roles) that the policy is attached to. AWS is most likely to update an AWS managed policy when a new AWS service is launched or new API operations become available for existing services.
For more information, see AWS managed policies in the IAM User Guide.
AWS managed policy: AWSWAFReadOnlyAccess
This policy grants read-only permissions that allow users to access AWS WAF resources and resources for integrated services, such as Amazon CloudFront, Amazon API Gateway, Application Load Balancer, AWS AppSync, Amazon Cognito, AWS App Runner, and AWS Verified Access. You can attach this policy to your IAM identities. AWS WAF also attaches this policy to a service role that allows AWS WAF to perform actions on your behalf.
For details about this policy, see AWSWAFReadOnlyAccess
AWS managed policy: AWSWAFFullAccess
This policy grants full access to AWS WAF resources and resources for integrated services, such as Amazon CloudFront, Amazon API Gateway, Application Load Balancer, AWS AppSync, Amazon Cognito, AWS App Runner, and AWS Verified Access. You can attach this policy to your IAM identities. AWS WAF also attaches this policy to a service role that allows AWS WAF to perform actions on your behalf.
For details about this policy, see AWSWAFFullAccess
AWS managed policy: AWSWAFConsoleReadOnlyAccess
This policy grants read-only permissions to the AWS WAF console, which includes resources for AWS WAF and for integrated services, such as Amazon CloudFront, Amazon API Gateway, Application Load Balancer, AWS AppSync, Amazon Cognito, AWS App Runner, and AWS Verified Access. You can attach this policy to your IAM identities. AWS WAF also attaches this policy to a service role that allows AWS WAF to perform actions on your behalf.
For details about this policy, see AWSWAFConsoleReadOnlyAccess
AWS managed policy: AWSWAFConsoleFullAccess
This policy grants full access to the AWS WAF console, which includes resources for AWS WAF and for integrated services, such as Amazon CloudFront, Amazon API Gateway, Application Load Balancer, AWS AppSync, Amazon Cognito, AWS App Runner, and AWS Verified Access. You can attach this policy to your IAM identities. AWS WAF also attaches this policy to a service role that allows AWS WAF to perform actions on your behalf.
For details about this policy, see AWSWAFConsoleFullAccess
AWS WAF updates to AWS managed policies
View details about updates to AWS managed policies for AWS WAF since this service began tracking these changes. For automatic alerts about changes to this page, subscribe to the RSS feed on the AWS WAF document history page at Document history.
| Policy | Description of change | Date |
|---|---|---|
This policy allows AWS WAF to manage AWS resources on your behalf in AWS WAF and in integrated services. Details in IAM console: AWSWAFFullAccess |
Expanded permissions to add AWS Verified Access instances to the resource types that you can protect with AWS WAF. |
2023-06-17 |
This policy allows AWS WAF to manage AWS resources on your behalf in AWS WAF and in integrated services. Details in IAM console: AWSWAFReadOnlyAccess |
Expanded permissions to add AWS Verified Access instances to the resource types that you can protect with AWS WAF. |
2023-06-17 |
|
This policy allows AWS WAF to manage AWS console resources and other AWS resources on your behalf in AWS WAF and in integrated services. Details in IAM console: AWSWAFConsoleFullAccess |
Expanded permissions to add AWS Verified Access instances to the resource types that you can protect with AWS WAF. |
2023-06-17 |
|
This policy allows AWS WAF to manage AWS console resources and other AWS resources on your behalf in AWS WAF and in integrated services. Details in IAM console: AWSWAFConsoleReadOnlyAccess |
Expanded permissions to add AWS Verified Access instances to the resource types that you can protect with AWS WAF. |
2023-06-17 |
This policy allows AWS WAF to manage AWS resources on your behalf in AWS WAF and in integrated services. Details in IAM console: AWSWAFFullAccess |
Expanded permissions to correct the access settings for AWS App Runner services. |
2023-06-06 |
This policy allows AWS WAF to manage AWS resources on your behalf in AWS WAF and in integrated services. Details in IAM console: AWSWAFReadOnlyAccess |
Expanded permissions to correct the access settings for AWS App Runner services. |
2023-06-06 |
|
This policy allows AWS WAF to manage AWS console resources and other AWS resources on your behalf in AWS WAF and in integrated services. Details in IAM console: AWSWAFConsoleFullAccess |
Expanded permissions to correct the access settings for AWS App Runner services. |
2023-06-06 |
|
This policy allows AWS WAF to manage AWS console resources and other AWS resources on your behalf in AWS WAF and in integrated services. Details in IAM console: AWSWAFConsoleReadOnlyAccess |
Expanded permissions to correct the access settings for AWS App Runner services. |
2023-06-06 |
This policy allows AWS WAF to manage AWS resources on your behalf in AWS WAF and in integrated services. Details in IAM console: AWSWAFFullAccess |
Expanded permissions to add AWS App Runner services to the resource types that you can protect with AWS WAF. |
2023-03-30 |
This policy allows AWS WAF to manage AWS resources on your behalf in AWS WAF and in integrated services. Details in IAM console: AWSWAFReadOnlyAccess |
Expanded permissions to add AWS App Runner services to the resource types that you can protect with AWS WAF. |
2023-03-30 |
|
This policy allows AWS WAF to manage AWS console resources and other AWS resources on your behalf in AWS WAF and in integrated services. Details in IAM console: AWSWAFConsoleFullAccess |
Expanded permissions to add AWS App Runner services to the resource types that you can protect with AWS WAF. |
2023-03-30 |
|
This policy allows AWS WAF to manage AWS console resources and other AWS resources on your behalf in AWS WAF and in integrated services. Details in IAM console: AWSWAFConsoleReadOnlyAccess |
Expanded permissions to add AWS App Runner services to the resource types that you can protect with AWS WAF. |
2023-03-30 |
This policy allows AWS WAF to manage AWS resources on your behalf in AWS WAF and in integrated services. Details in IAM console: AWSWAFFullAccess |
Expanded permissions to add Amazon Cognito user pools to the resource types that you can protect with AWS WAF. |
2022-08-25 |
This policy allows AWS WAF to manage AWS resources on your behalf in AWS WAF and in integrated services. Details in IAM console: AWSWAFReadOnlyAccess |
Expanded permissions to add Amazon Cognito user pools to the resource types that you can protect with AWS WAF. |
2022-08-25 |
|
This policy allows AWS WAF to manage AWS console resources and other AWS resources on your behalf in AWS WAF and in integrated services. Details in IAM console: AWSWAFConsoleFullAccess |
Expanded permissions to add Amazon Cognito user pools to the resource types that you can protect with AWS WAF. |
2022-08-25 |
|
This policy allows AWS WAF to manage AWS console resources and other AWS resources on your behalf in AWS WAF and in integrated services. Details in IAM console: AWSWAFConsoleReadOnlyAccess |
Expanded permissions to add Amazon Cognito user pools to the resource types that you can protect with AWS WAF. |
2022-08-25 |
This policy allows AWS WAF to manage AWS resources on your behalf in AWS WAF and in integrated services. Details in IAM console: AWSWAFFullAccess |
Corrected the permissions settings for log delivery for Amazon Simple Storage Service (Amazon S3) and Amazon CloudWatch Logs. This change resolves access denied errors that were occurring during logging configuration. For information about logging your web ACL traffic, see Logging AWS WAF web ACL traffic. |
2022-01-11 |
|
This policy allows AWS WAF to manage AWS console resources and other AWS resources on your behalf in AWS WAF and in integrated services. Details in IAM console: AWSWAFConsoleFullAccess |
Corrected the permissions settings for log delivery for Amazon Simple Storage Service (Amazon S3) and Amazon CloudWatch Logs. This change resolves access errors that were occurring during logging configuration. For information about logging your web ACL traffic, see Logging AWS WAF web ACL traffic. |
2022-01-11 |
|
This policy allows AWS WAF to manage AWS resources on your behalf in AWS WAF and in integrated services. Details in IAM console: AWSWAFFullAccess |
Added new permissions for expanded logging options. This change gives AWS WAF access to the additional logging destinations Amazon Simple Storage Service (Amazon S3) and Amazon CloudWatch Logs. For information about logging your web ACL traffic, see Logging AWS WAF web ACL traffic. |
2021-11-15 |
|
This policy allows AWS WAF to manage AWS console resources and other AWS resources on your behalf in AWS WAF and in integrated services. Details in IAM console: AWSWAFConsoleFullAccess |
Added new permissions for expanded logging options. This change gives AWS WAF access to the additional logging destinations Amazon Simple Storage Service (Amazon S3) and Amazon CloudWatch Logs. For information about logging your web ACL traffic, see Logging AWS WAF web ACL traffic. |
2021-11-15 |
|
AWS WAF started tracking changes |
AWS WAF started tracking changes for its AWS managed policies. |
2021-3-01 |
