Product logo
DocsBlogPricing

Permissions for @turbot/aws-waf

Taking a look at permissions and associated grant levels for each permission for WAF:

PermissionGrant LevelHelp
waf:CreateByteMatchSetAdminAdmin can create the matchset part of a web request for AWS WAF to inspect
waf:CreateGeoMatchSetAdmin
waf:CreateIPSetAdmin
waf:CreateRateBasedRuleAdmin
waf:CreateRegexMatchSetAdmin
waf:CreateRegexPatternSetAdmin
waf:CreateRuleAdminAdmin can create a rule which contains the condition objects to block or allow access.
waf:CreateRuleGroupAdminAdmin can create a rule group which is a collection of predefined rules that can be added to a web ACL.
waf:CreateSizeConstraintSetAdmin
waf:CreateSqlInjectionMatchSetAdmin
waf:CreateWebACLAdminAdmin can create a WebACL that contains the Rules that identify the CloudFront web requests that should be allowed or blocked or counted.
waf:CreateWebACLMigrationStackAdmin
waf:CreateXssMatchSetAdmin
waf:DeleteByteMatchSetAdmin
waf:DeleteGeoMatchSetAdmin
waf:DeleteIPSetAdmin
waf:DeleteLoggingConfigurationAdmin
waf:DeletePermissionPolicyAdminAdmin can permanently delete an IAM policy from the specified RuleGroup.
waf:DeleteRateBasedRuleAdmin
waf:DeleteRegexMatchSetAdmin
waf:DeleteRegexPatternSetAdmin
waf:DeleteRuleAdmin
waf:DeleteRuleGroupAdminAdmin can delete a RuleGroup.
waf:DeleteSizeConstraintSetAdmin
waf:DeleteSqlInjectionMatchSetAdmin
waf:DeleteWebACLAdminAdmin can delete a WebACL.
waf:DeleteXssMatchSetAdmin
waf:GetByteMatchSetMetadata
waf:GetChangeTokenMetadata
waf:GetChangeTokenStatusMetadata
waf:GetGeoMatchSetMetadata
waf:GetIPSetReadOnly
waf:GetLoggingConfigurationMetadata
waf:GetPermissionPolicyReadOnly
waf:GetRateBasedRuleReadOnly
waf:GetRateBasedRuleManagedKeysReadOnly
waf:GetRegexMatchSetMetadata
waf:GetRegexPatternSetMetadata
waf:GetRuleMetadata
waf:GetRuleGroupMetadata
waf:GetSampledRequestsMetadata
waf:GetSizeConstraintSetMetadata
waf:GetSqlInjectionMatchSetMetadata
waf:GetWebACLReadOnly
waf:GetXssMatchSetMetadata
waf:ListActivatedRulesInRuleGroupMetadata
waf:ListByteMatchSetsMetadata
waf:ListGeoMatchSetsMetadata
waf:ListIPSetsMetadata
waf:ListLoggingConfigurationsMetadata
waf:ListRateBasedRulesMetadata
waf:ListRegexMatchSetsMetadata
waf:ListRegexPatternSetsMetadata
waf:ListRuleGroupsMetadata
waf:ListRulesMetadata
waf:ListSizeConstraintSetsMetadata
waf:ListSqlInjectionMatchSetsMetadata
waf:ListSubscribedRuleGroupsMetadata
waf:ListTagsForResourceMetadata
waf:ListWebACLsMetadata
waf:ListXssMatchSetsMetadata
waf:PutLoggingConfigurationAdmin
waf:PutPermissionPolicyAdminAdmin can attache a IAM policy to the specified resource.
waf:TagResourceOperator
waf:UntagResourceOperator
waf:UpdateByteMatchSetAdmin
waf:UpdateGeoMatchSetAdmin
waf:UpdateIPSetAdmin
waf:UpdateRateBasedRuleAdmin
waf:UpdateRegexMatchSetAdmin
waf:UpdateRegexPatternSetAdmin
waf:UpdateRuleAdmin
waf:UpdateRuleGroupAdminAdmin can insert or delete an ActivatedRule objects in a RuleGroup.
waf:UpdateSizeConstraintSetAdmin
waf:UpdateSqlInjectionMatchSetAdmin
waf:UpdateWebACLAdminAdmin can insert or delete ActivatedRule objects in a WebACL.
waf:UpdateXssMatchSetAdmin
wafv2:AssociateWebACLAdmin
wafv2:CheckCapacityMetadata
wafv2:CreateIPSetAdmin
wafv2:CreateRegexPatternSetAdmin
wafv2:CreateRuleGroupAdmin
wafv2:CreateWebACLAdmin
wafv2:DeleteFirewallManagerRuleGroupsAdmin
wafv2:DeleteIPSetAdmin
wafv2:DeleteLoggingConfigurationAdmin
wafv2:DeletePermissionPolicyAdmin
wafv2:DeleteRegexPatternSetAdmin
wafv2:DeleteRuleGroupAdmin
wafv2:DeleteWebACLAdmin
wafv2:DescribeManagedRuleGroupMetadata
wafv2:DisassociateFirewallManagerAdmin
wafv2:DisassociateWebACLAdmin
wafv2:GetIPSetMetadata
wafv2:GetLoggingConfigurationMetadata
wafv2:GetManagedRuleSetMetadata
wafv2:GetPermissionPolicyMetadata
wafv2:GetRateBasedStatementManagedKeysMetadata
wafv2:GetRegexPatternSetMetadata
wafv2:GetRuleGroupMetadata
wafv2:GetSampledRequestsMetadata
wafv2:GetWebACLMetadata
wafv2:GetWebACLForResourceMetadata
wafv2:ListAvailableManagedRuleGroupsMetadata
wafv2:ListIPSetsMetadata
wafv2:ListLoggingConfigurationsMetadata
wafv2:ListManagedRuleSetsMetadata
wafv2:ListRegexPatternSetsMetadata
wafv2:ListResourcesForWebACLMetadata
wafv2:ListRuleGroupsAdmin
wafv2:ListTagsForResourceMetadata
wafv2:ListWebACLsMetadata
wafv2:PutFirewallManagerRuleGroupsAdmin
wafv2:PutLoggingConfigurationAdmin
wafv2:PutManagedRuleSetVersionsAdmin
wafv2:PutPermissionPolicyAdmin
wafv2:TagResourceOperator
wafv2:UntagResourceOperator
wafv2:UpdateIPSetAdmin
wafv2:UpdateManagedRuleSetVersionExpiryDateAdmin
wafv2:UpdateRegexPatternSetAdmin
wafv2:UpdateRuleGroupAdmin
wafv2:UpdateWebACLAdmin