Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for AWS WAF V2

AWS WAF V2 (service prefix: wafv2) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

API operations defined by AWS WAF V2

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Access level
AssociateWebACL	wafv2:AssociateWebACL	Write
	apigateway:SetWebACL	Permissions management, Write
	appsync:AssociateWebACL	Write
	appsync:SetWebACL	Permissions management, Write
	elasticloadbalancing:CreateWebACLAssociation	Write
	elasticloadbalancing:SetWebAcl	Write
CheckCapacity	wafv2:CheckCapacity	Read
CreateAPIKey	wafv2:CreateAPIKey	Write
CreateIPSet	wafv2:CreateIPSet	Write
CreateIPSet	wafv2:TagResource	Tagging, Write
CreateRegexPatternSet	wafv2:CreateRegexPatternSet	Write
CreateRegexPatternSet	wafv2:TagResource	Tagging, Write
CreateRuleGroup	wafv2:CreateRuleGroup	Write
CreateRuleGroup	wafv2:TagResource	Tagging, Write
CreateWebACL	wafv2:CreateWebACL	Write
CreateWebACL	wafv2:TagResource	Tagging, Write
DeleteAPIKey	wafv2:DeleteAPIKey	Write
DeleteFirewallManagerRuleGroups	wafv2:DeleteFirewallManagerRuleGroups	Write
DeleteIPSet	wafv2:DeleteIPSet	Write
DeleteLoggingConfiguration	wafv2:DeleteLoggingConfiguration	Write
DeletePermissionPolicy	wafv2:DeletePermissionPolicy	Permissions management, Write
DeleteRegexPatternSet	wafv2:DeleteRegexPatternSet	Write
DeleteRuleGroup	wafv2:DeleteRuleGroup	Write
DeleteWebACL	wafv2:DeleteWebACL	Write
DescribeAllManagedProducts	wafv2:DescribeAllManagedProducts	Read
DescribeManagedProductsByVendor	wafv2:DescribeManagedProductsByVendor	Read
DescribeManagedRuleGroup	wafv2:DescribeManagedRuleGroup	Read
DisassociateWebACL	wafv2:DisassociateWebACL	Write
	apigateway:SetWebACL	Permissions management, Write
	appsync:DisassociateWebACL	Write
	appsync:SetWebACL	Permissions management, Write
	elasticloadbalancing:DeleteWebACLAssociation	Write
	elasticloadbalancing:SetWebAcl	Write
GenerateMobileSdkReleaseUrl	wafv2:GenerateMobileSdkReleaseUrl	Read
GetDecryptedAPIKey	wafv2:GetDecryptedAPIKey	Read
GetIPSet	wafv2:GetIPSet	Read
GetLoggingConfiguration	wafv2:GetLoggingConfiguration	Read
GetManagedRuleSet	wafv2:GetManagedRuleSet	Read
GetMobileSdkRelease	wafv2:GetMobileSdkRelease	Read
GetPermissionPolicy	wafv2:GetPermissionPolicy	Read
GetRateBasedStatementManagedKeys	wafv2:GetRateBasedStatementManagedKeys	Read
GetRegexPatternSet	wafv2:GetRegexPatternSet	Read
GetRevenueStatistics	wafv2:GetRevenueStatistics	Read
GetRevenueStatisticsSummary	wafv2:GetRevenueStatisticsSummary	Read
GetRevenueStatisticsTimeSeries