AWSWAFConsoleFullAccess
Last Modified
Jul 1, 2026
July 1, 2026 at 05:04 AM UTC
Version
v22
Total Versions
14
Created
Jul 1, 2026
Actions
84
Risk
MediumThe same capabilities in a scoped form, resource policy writes, reads across all data, or full access to a whole service. Read from this policy document alone: trust policies, boundaries and SCPs in your account still decide what actually succeeds. How this is assessed
- Medium
Can rewrite resource policies and sharing
Grants 5 permissions management actions across 3 services (appsync, waf-regional, waf) on any resource, enough to share resources outside the account.
appsync:setwebaclwaf-regional:deletepermissionpolicywaf-regional:putpermissionpolicywaf:deletepermissionpolicywaf:putpermissionpolicyUse with caution: Turn on IAM Access Analyzer external access findings, and keep account-level guards like S3 Block Public Access enabled.
- Medium
Full access to 2 services on every resource
Uses waf:*, waf-regional:* with Resource "*" and no condition, so every action AWS adds to those services later is granted too.
waf:*waf-regional:*Use with caution: The grant grows every time the service does. For long-lived access, prefer a policy that lists the actions you actually need.
Policy Document
View on GitHub{
"PolicyVersion": {
"Document": {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowUseOfAWSWAFClassic",
"Effect": "Allow",
"Action": [
"waf:*",
"waf-regional:*"
],
"Resource": [
"arn:aws:waf::*:bytematchset/*",
"arn:aws:waf::*:ipset/*",
"arn:aws:waf::*:ratebasedrule/*",
"arn:aws:waf::*:rule/*",
"arn:aws:waf::*:sizeconstraintset/*",
"arn:aws:waf::*:sqlinjectionset/*",
"arn:aws:waf::*:webacl/*",
"arn:aws:waf::*:xssmatchset/*",
"arn:aws:waf::*:regexmatch/*",
"arn:aws:waf::*:regexpatternset/*",
"arn:aws:waf::*:geomatchset/*",
"arn:aws:waf::*:rulegroup/*",
"arn:aws:waf:*:*:changetoken/*",
"arn:aws:waf-regional:*:*:bytematchset/*",
"arn:aws:waf-regional:*:*:ipset/*",
"arn:aws:waf-regional:*:*:ratebasedrule/*",
"arn:aws:waf-regional:*:*:rule/*",
"arn:aws:waf-regional:*:*:sizeconstraintset/*",
"arn:aws:waf-regional:*:*:sqlinjectionset/*",
"arn:aws:waf-regional:*:*:webacl/*",
"arn:aws:waf-regional:*:*:xssmatchset/*",
"arn:aws:waf-regional:*:*:regexmatch/*",
"arn:aws:waf-regional:*:*:regexpatternset/*",
"arn:aws:waf-regional:*:*:geomatchset/*",
"arn:aws:waf-regional:*:*:rulegroup/*",
"arn:aws:waf-regional:*:*:changetoken/*"
]
},
{
"Sid": "AllowWAFClassicGetWebACLForResource",
"Effect": "Allow",
"Action": [
"waf-regional:GetWebACLForResource"
],
"Resource": "arn:aws:waf-regional:*:*:*/*"
},
{
"Sid": "AllowUseOfAWSWAF",
"Effect": "Allow",
"Action": [
"wafv2:*"
],
"Resource": [
"arn:aws:wafv2:*:*:*/webacl/*/*",
"arn:aws:wafv2:*:*:*/ipset/*/*",
"arn:aws:wafv2:*:*:*/managedruleset/*/*",
"arn:aws:wafv2:*:*:*/rulegroup/*/*",
"arn:aws:wafv2:*:*:*/regexpatternset/*/*"
]
},
{
"Sid": "AllowDisassociateWebACL",
"Effect": "Allow",
"Action": [
"wafv2:DisassociateWebACL"
],
"Resource": "*"
},
{
"Sid": "AllowS3ListAllMyBuckets",
"Effect": "Allow",
"Action": [
"s3:ListAllMyBuckets"
],
"Resource": "*"
},
{
"Sid": "AllowEC2DescribeRegions",
"Effect": "Allow",
"Action": [
"ec2:DescribeRegions"
],
"Resource": "*"
},
{
"Sid": "AllowListActionsForCloudWatch",
"Effect": "Allow",
"Action": [
"cloudwatch:GetMetricData",
"cloudwatch:GetMetricStatistics",
"cloudwatch:ListMetrics"
],
"Resource": "*"
},
{
"Sid": "AllowActionsForCloudFront",
"Effect": "Allow",
"Action": [
"cloudfront:GetDistributionConfig",
"cloudfront:GetDistribution",
"cloudfront:UpdateDistribution",
"cloudfront:AssociateDistributionWebACL",
"cloudfront:DisassociateDistributionWebACL"
],
"Resource": "arn:aws:cloudfront::*:distribution/*"
},
{
"Sid": "AllowListActionsForCloudFront",
"Effect": "Allow",
"Action": [
"cloudfront:ListDistributions",
"cloudfront:ListDistributionsByWebACLId"
],
"Resource": "*"
},
{
"Sid": "AllowActionsForCloudFrontTenant",
"Effect": "Allow",
"Action": [
"cloudfront:GetDistributionTenant",
"cloudfront:AssociateDistributionTenantWebACL",
"cloudfront:DisassociateDistributionTenantWebACL"
],
"Resource": "arn:aws:cloudfront::*:distribution-tenant/*"
},
{
"Sid": "AllowListActionsForCloudFrontTenant",
"Effect": "Allow",
"Action": [
"cloudfront:ListDistributionTenants",
"cloudfront:ListDistributionTenantsByCustomization"
],
"Resource": "*"
},
{
"Sid": "AllowActionsForALB",
"Effect": "Allow",
"Action": [
"elasticloadbalancing:SetWebAcl",
"elasticloadbalancing:CreateWebACLAssociation",
"elasticloadbalancing:DeleteWebACLAssociation",
"elasticloadbalancing:GetLoadBalancerWebACL"
],
"Resource": "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*"
},
{
"Sid": "AllowListActionsForALB",
"Effect": "Allow",
"Action": [
"elasticloadbalancing:DescribeLoadBalancers",
"elasticloadbalancing:DescribeWebACLAssociation"
],
"Resource": "*"
},
{
"Sid": "AllowActionsForAPIGateway",
"Effect": "Allow",
"Action": [
"apigateway:SetWebACL"
],
"Resource": "arn:aws:apigateway:*::/restapis/*/stages/*"
},
{
"Sid": "AllowListActionsForAPIGateway",
"Effect": "Allow",
"Action": [
"apigateway:GET"
],
"Resource": "arn:aws:apigateway:*::/*"
},
{
"Sid": "AllowActionsForAppSync",
"Effect": "Allow",
"Action": [
"appsync:SetWebACL",
"appsync:AssociateWebACL",
"appsync:DisassociateWebACL",
"appsync:GetWebACLForResource"
],
"Resource": "arn:aws:appsync:*:*:apis/*"
},
{
"Sid": "AllowListActionsForAppSync",
"Effect": "Allow",
"Action": [
"appsync:ListGraphqlApis",
"appsync:ListApis",
"appsync:ListResourcesForWebACL"
],
"Resource": "*"
},
{
"Sid": "AllowActionsForCognito",
"Effect": "Allow",
"Action": [
"cognito-idp:AssociateWebACL",
"cognito-idp:DisassociateWebACL",
"cognito-idp:GetWebACLForResource"
],
"Resource": "arn:aws:cognito-idp:*:*:userpool/*"
},
{
"Sid": "AllowListActionsForCognito",
"Effect": "Allow",
"Action": [
"cognito-idp:ListUserPools",
"cognito-idp:ListResourcesForWebACL"
],
"Resource": "*"
},
{
"Sid": "AllowActionsForAppRunner",
"Effect": "Allow",
"Action": [
"apprunner:AssociateWebAcl",
"apprunner:DisassociateWebAcl",
"apprunner:DescribeWebAclForService"
],
"Resource": "arn:aws:apprunner:*:*:service/*/*"
},
{
"Sid": "AllowListActionsForAppRunner",
"Effect": "Allow",
"Action": [
"apprunner:ListServices",
"apprunner:ListAssociatedServicesForWebAcl"
],
"Resource": "*"
},
{
"Sid": "AllowActionsForAVA",
"Effect": "Allow",
"Action": [
"ec2:AssociateVerifiedAccessInstanceWebAcl",
"ec2:DisassociateVerifiedAccessInstanceWebAcl",
"ec2:GetVerifiedAccessInstanceWebAcl"
],
"Resource": "arn:aws:ec2:*:*:verified-access-instance/*"
},
{
"Sid": "AllowListActionsForAVA",
"Effect": "Allow",
"Action": [
"ec2:DescribeVerifiedAccessInstances",
"ec2:DescribeVerifiedAccessInstanceWebAclAssociations"
],
"Resource": "*"
},
{
"Sid": "AllowActionsForAmplify",
"Effect": "Allow",
"Action": [
"amplify:AssociateWebACL",
"amplify:DisassociateWebACL",
"amplify:GetWebACLForResource"
],
"Resource": "arn:aws:amplify:*:*:apps/*"
},
{
"Sid": "AllowListActionsForAmplify",
"Effect": "Allow",
"Action": [
"amplify:ListApps",
"amplify:ListResourcesForWebACL"
],
"Resource": "*"
},
{
"Sid": "AllowLogQueryActions",
"Effect": "Allow",
"Action": [
"logs:StartQuery",
"logs:DescribeQueryDefinitions",
"logs:GetQueryResults"
],
"Resource": "arn:aws:logs:*:*:log-group:aws-waf-logs-*"
},
{
"Sid": "AllowLogGroupDescribeActions",
"Effect": "Allow",
"Action": [
"logs:DescribeResourcePolicies",
"logs:DescribeLogGroups"
],
"Resource": "*"
},
{
"Sid": "AllowLogDeliverySubscription",
"Effect": "Allow",
"Action": [
"logs:CreateLogDelivery",
"logs:DeleteLogDelivery"
],
"Resource": "*"
},
{
"Sid": "GrantLogDeliveryPermissionForS3Bucket",
"Effect": "Allow",
"Action": [
"s3:PutBucketPolicy",
"s3:GetBucketPolicy"
],
"Resource": [
"arn:aws:s3:::aws-waf-logs-*"
]
},
{
"Sid": "GrantLogDeliveryPermissionForCloudWatchLogGroup",
"Effect": "Allow",
"Action": [
"logs:PutResourcePolicy"
],
"Resource": "*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"wafv2.amazonaws.com"
]
}
}
},
{
"Sid": "AllowListActionForFirehoseStream",
"Effect": "Allow",
"Action": [
"firehose:ListDeliveryStreams"
],
"Resource": "*"
},
{
"Sid": "AllowActionsForPricing",
"Effect": "Allow",
"Action": [
"pricing:ListPriceLists",
"pricing:GetPriceListFileUrl"
],
"Resource": "*"
},
{
"Sid": "AllowMarketplaceViewSubscriptions",
"Effect": "Allow",
"Action": [
"aws-marketplace:ViewSubscriptions"
],
"Resource": "*"
},
{
"Sid": "AllowActionsForPricingPlanManager",
"Effect": "Allow",
"Action": [
"pricingplanmanager:GetSubscription",
"pricingplanmanager:UpdateSubscription",
"pricingplanmanager:CancelSubscription",
"pricingplanmanager:CancelSubscriptionChange"
],
"Resource": "arn:aws:pricingplanmanager::*:subscription:*"
},
{
"Sid": "AllowListActionsForRoute53",
"Effect": "Allow",
"Action": [
"route53:ListHostedZones",
"route53:GetHostedZone"
],
"Resource": "*"
},
{
"Sid": "AllowListActionsForPricingPlanManager",
"Effect": "Allow",
"Action": "pricingplanmanager:ListSubscriptions",
"Resource": "*"
},
{
"Sid": "AllowActionsForAgentCoreGateway",
"Effect": "Allow",
"Action": [
"bedrock-agentcore:GatewayAssociateWebACL",
"bedrock-agentcore:GatewayDisassociateWebACL",
"bedrock-agentcore:GatewayGetWebACLForResource",
"bedrock-agentcore:GetGateway"
],
"Resource": "arn:aws:bedrock-agentcore:*:*:gateway/*"
},
{
"Sid": "AllowListActionsForAgentCoreGateway",
"Effect": "Allow",
"Action": [
"bedrock-agentcore:GatewayListResourcesForWebACL",
"bedrock-agentcore:ListGateways"
],
"Resource": "*"
}
]
},
"VersionId": "v22",
"IsDefaultVersion": true,
"CreateDate": "2026-07-01T04:12:13+00:00"
}
}Version History (19 recorded)
Raw history6 actions added
8 actions added
AWSWAFConsoleFullAccess - Policy Version v20
No recorded action delta - this version predates the change index. View the raw diff.
Mar 12, 2026
8fd23a2AWSWAFConsoleFullAccess - Policy Version v20
No recorded action delta - this version predates the change index. View the raw diff.
Feb 12, 2026
e600c99AWSWAFConsoleFullAccess - Policy Version v16
No recorded action delta - this version predates the change index. View the raw diff.
Feb 12, 2026
cd04683AWSWAFConsoleFullAccess - Policy Version v12
No recorded action delta - this version predates the change index. View the raw diff.
Nov 19, 2025
d34b914AWSWAFConsoleFullAccess - Policy Version v11
No recorded action delta - this version predates the change index. View the raw diff.
Nov 19, 2025
a18a2cdAWSWAFConsoleFullAccess - Policy Version v10
No recorded action delta - this version predates the change index. View the raw diff.
Nov 3, 2025
0e4f55eUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
May 5, 2025
5321a10Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Sep 18, 2024
aafbae9Update detected
No recorded action delta - this version predates the change index. View the raw diff.
May 13, 2024
1b36617Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Jun 5, 2023
77d23fbUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
May 31, 2023
93397beUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Mar 30, 2023
a9dc51dUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Aug 25, 2022
47d1c33Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Jan 11, 2022
51aac97Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Nov 15, 2021
ab50e8bUpdate detected
No recorded action delta - this version predates the change index. View the raw diff.
Oct 2, 2020
09890f9Update detected
No recorded action delta - this version predates the change index. View the raw diff.
Apr 6, 2020
54b5324