Operations Actions Resource types Condition keys

Actions, resources, and condition keys for AWS WAF

AWS WAF (service prefix: waf) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

API operations defined by AWS WAF

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Access level
CreateByteMatchSet	waf:CreateByteMatchSet	Write
CreateGeoMatchSet	waf:CreateGeoMatchSet	Write
CreateIPSet	waf:CreateIPSet	Write
CreateRateBasedRule	waf:CreateRateBasedRule	Write
CreateRateBasedRule	waf:TagResource	Tagging, Write
CreateRegexMatchSet	waf:CreateRegexMatchSet	Write
CreateRegexPatternSet	waf:CreateRegexPatternSet	Write
CreateRule	waf:CreateRule	Write
CreateRule	waf:TagResource	Tagging, Write
CreateRuleGroup	waf:CreateRuleGroup	Write
CreateRuleGroup	waf:TagResource	Tagging, Write
CreateSizeConstraintSet	waf:CreateSizeConstraintSet	Write
CreateSqlInjectionMatchSet	waf:CreateSqlInjectionMatchSet	Write
CreateWebACL	waf:CreateWebACL	Permissions management, Write
CreateWebACL	waf:TagResource	Tagging, Write
CreateWebACLMigrationStack	waf:CreateWebACLMigrationStack	Write
CreateXssMatchSet	waf:CreateXssMatchSet	Write
DeleteByteMatchSet	waf:DeleteByteMatchSet	Write
DeleteGeoMatchSet	waf:DeleteGeoMatchSet	Write
DeleteIPSet	waf:DeleteIPSet	Write
DeleteLoggingConfiguration	waf:DeleteLoggingConfiguration	Write
DeletePermissionPolicy	waf:DeletePermissionPolicy	Permissions management, Write
DeleteRateBasedRule	waf:DeleteRateBasedRule	Write
DeleteRegexMatchSet	waf:DeleteRegexMatchSet	Write
DeleteRegexPatternSet	waf:DeleteRegexPatternSet	Write
DeleteRule	waf:DeleteRule	Write
DeleteRuleGroup	waf:DeleteRuleGroup	Write
DeleteSizeConstraintSet	waf:DeleteSizeConstraintSet	Write
DeleteSqlInjectionMatchSet	waf:DeleteSqlInjectionMatchSet	Write
DeleteWebACL	waf:DeleteWebACL	Permissions management, Write
DeleteXssMatchSet	waf:DeleteXssMatchSet	Write
GetByteMatchSet	waf:GetByteMatchSet	Read
GetChangeToken	waf:GetChangeToken	Read
GetChangeTokenStatus	waf:GetChangeTokenStatus	Read
GetGeoMatchSet	waf:GetGeoMatchSet	Read
GetIPSet	waf:GetIPSet	Read
GetLoggingConfiguration	waf:GetLoggingConfiguration	Read
GetPermissionPolicy	waf:GetPermissionPolicy	Read
GetRateBasedRule	waf:GetRateBasedRule	Read
GetRateBasedRuleManagedKeys	waf:GetRateBasedRuleManagedKeys	Read
GetRegexMatchSet	waf:GetRegexMatchSet	Read
GetRegexPatternSet	waf:GetRegexPatternSet	Read
GetRule	waf:GetRule	Read
GetRuleGroup	waf:GetRuleGroup	Read
GetSampledRequests	waf:GetSampledRequests	Read
GetSizeConstraintSet	waf:GetSizeConstraintSet	Read
GetSqlInjectionMatchSet	waf:GetSqlInjectionMatchSet	Read
GetWebACL	waf:GetWebACL	Read
GetXssMatchSet	waf:GetXssMatchSet	Read
ListActivatedRulesInRuleGroup	waf:ListActivatedRulesInRuleGroup	List
ListByteMatchSets	waf:ListByteMatchSets	List
ListGeoMatchSets	waf:ListGeoMatchSets	List
ListIPSets	waf:ListIPSets	List
ListLoggingConfigurations	waf:ListLoggingConfigurations	List
ListRateBasedRules	waf:ListRateBasedRules	List
ListRegexMatchSets	waf:ListRegexMatchSets	List
ListRegexPatternSets	waf:ListRegexPatternSets	List
ListRuleGroups	waf:ListRuleGroups	List
ListRules	waf:ListRules	List
ListSizeConstraintSets	waf:ListSizeConstraintSets	List
ListSqlInjectionMatchSets	waf:ListSqlInjectionMatchSets	List
ListSubscribedRuleGroups	waf:ListSubscribedRuleGroups	List
ListTagsForResource	waf:ListTagsForResource	Read
ListWebACLs	waf:ListWebACLs	List
ListXssMatchSets	waf:ListXssMatchSets	List
PutLoggingConfiguration	waf:PutLoggingConfiguration	Write
PutPermissionPolicy	waf:PutPermissionPolicy	Permissions management, Write
TagResource	waf:TagResource	Tagging, Write
UntagResource	waf:UntagResource	Tagging, Write
UpdateByteMatchSet	waf:UpdateByteMatchSet	Write
UpdateGeoMatchSet	waf:UpdateGeoMatchSet	Write
UpdateIPSet	waf:UpdateIPSet	Write
UpdateRateBasedRule	waf:UpdateRateBasedRule	Write
UpdateRegexMatchSet	waf:UpdateRegexMatchSet	Write
UpdateRegexPatternSet	waf:UpdateRegexPatternSet	Write
UpdateRule	waf:UpdateRule	Write
UpdateRuleGroup	waf:UpdateRuleGroup	Write
UpdateSizeConstraintSet	waf:UpdateSizeConstraintSet	Write
UpdateSqlInjectionMatchSet	waf:UpdateSqlInjectionMatchSet	Write
UpdateWebACL	waf:UpdateWebACL	Permissions management, Write
UpdateXssMatchSet	waf:UpdateXssMatchSet	Write

Actions defined by AWS WAF

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
CreateByteMatchSet	Grants permission to create a ByteMatchSet	bytematchset*		Write
CreateGeoMatchSet	Grants permission to create a GeoMatchSet	geomatchset*		Write
CreateIPSet	Grants permission to create an IPSet	ipset*		Write
CreateRateBasedRule	Grants permission to create a RateBasedRule for limiting the volume of requests from a single IP address	ratebasedrule*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateRegexMatchSet