Operations Actions Resource types Condition keys

Actions, resources, and condition keys for AWS WAF

AWS WAF (service prefix: waf) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

API operations defined by AWS WAF

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Access level
CreateByteMatchSet	waf:CreateByteMatchSet	Write
CreateGeoMatchSet	waf:CreateGeoMatchSet	Write
CreateIPSet	waf:CreateIPSet	Write
CreateRateBasedRule	waf:CreateRateBasedRule	Write
CreateRateBasedRule	waf:TagResource	Tagging, Write
CreateRegexMatchSet	waf:CreateRegexMatchSet	Write
CreateRegexPatternSet	waf:CreateRegexPatternSet	Write
CreateRule	waf:CreateRule	Write
CreateRule	waf:TagResource	Tagging, Write
CreateRuleGroup	waf:CreateRuleGroup	Write
CreateRuleGroup	waf:TagResource	Tagging, Write
CreateSizeConstraintSet	waf:CreateSizeConstraintSet	Write
CreateSqlInjectionMatchSet	waf:CreateSqlInjectionMatchSet	Write
CreateWebACL	waf:CreateWebACL	Permissions management, Write
CreateWebACL	waf:TagResource	Tagging, Write
CreateWebACLMigrationStack	waf:CreateWebACLMigrationStack	Write
CreateXssMatchSet	waf:CreateXssMatchSet	Write
DeleteByteMatchSet	waf:DeleteByteMatchSet	Write
DeleteGeoMatchSet	waf:DeleteGeoMatchSet	Write
DeleteIPSet	waf:DeleteIPSet	Write
DeleteLoggingConfiguration	waf:DeleteLoggingConfiguration	Write
DeletePermissionPolicy	waf:DeletePermissionPolicy	Permissions management, Write
DeleteRateBasedRule	waf:DeleteRateBasedRule	Write
DeleteRegexMatchSet	waf:DeleteRegexMatchSet	Write
DeleteRegexPatternSet	waf:DeleteRegexPatternSet	Write
DeleteRule	waf:DeleteRule	Write
DeleteRuleGroup	waf:DeleteRuleGroup	Write
DeleteSizeConstraintSet	waf:DeleteSizeConstraintSet	Write
DeleteSqlInjectionMatchSet	waf:DeleteSqlInjectionMatchSet	Write
DeleteWebACL	waf:DeleteWebACL	Permissions management, Write
DeleteXssMatchSet	waf:DeleteXssMatchSet	Write
GetByteMatchSet	waf:GetByteMatchSet	Read
GetChangeToken	waf:GetChangeToken	Read
GetChangeTokenStatus	waf:GetChangeTokenStatus	Read
GetGeoMatchSet	waf:GetGeoMatchSet	Read
GetIPSet	waf:GetIPSet	Read
GetLoggingConfiguration	waf:GetLoggingConfiguration	Read
GetPermissionPolicy	waf:GetPermissionPolicy	Read
GetRateBasedRule	waf:GetRateBasedRule	Read
GetRateBasedRuleManagedKeys	waf:GetRateBasedRuleManagedKeys	Read
GetRegexMatchSet	waf:GetRegexMatchSet	Read
GetRegexPatternSet	waf:GetRegexPatternSet	Read
GetRule	waf:GetRule	Read
GetRuleGroup	waf:GetRuleGroup	Read
GetSampledRequests	waf:GetSampledRequests	Read
GetSizeConstraintSet	waf:GetSizeConstraintSet	Read
GetSqlInjectionMatchSet	waf:GetSqlInjectionMatchSet	Read
GetWebACL	waf:GetWebACL	Read
GetXssMatchSet	waf:GetXssMatchSet	Read
ListActivatedRulesInRuleGroup	waf:ListActivatedRulesInRuleGroup	List
ListByteMatchSets	waf:ListByteMatchSets	List
ListGeoMatchSets	waf:ListGeoMatchSets	List
ListIPSets	waf:ListIPSets	List
ListLoggingConfigurations	waf:ListLoggingConfigurations	List
ListRateBasedRules	waf:ListRateBasedRules	List
ListRegexMatchSets	waf:ListRegexMatchSets	List
ListRegexPatternSets	waf:ListRegexPatternSets	List
ListRuleGroups	waf:ListRuleGroups	List
ListRules	waf:ListRules	List
ListSizeConstraintSets	waf:ListSizeConstraintSets	List
ListSqlInjectionMatchSets	waf:ListSqlInjectionMatchSets	List
ListSubscribedRuleGroups	waf:ListSubscribedRuleGroups	List
ListTagsForResource	waf:ListTagsForResource	Read
ListWebACLs	waf:ListWebACLs	List
ListXssMatchSets	waf:ListXssMatchSets	List
PutLoggingConfiguration	waf:PutLoggingConfiguration	Write
PutPermissionPolicy	waf:PutPermissionPolicy	Permissions management, Write
TagResource	waf:TagResource	Tagging, Write
UntagResource	waf:UntagResource	Tagging, Write
UpdateByteMatchSet	waf:UpdateByteMatchSet	Write
UpdateGeoMatchSet	waf:UpdateGeoMatchSet	Write
UpdateIPSet	waf:UpdateIPSet	Write
UpdateRateBasedRule	waf:UpdateRateBasedRule	Write
UpdateRegexMatchSet	waf:UpdateRegexMatchSet	Write
UpdateRegexPatternSet	waf:UpdateRegexPatternSet	Write
UpdateRule	waf:UpdateRule	Write
UpdateRuleGroup	waf:UpdateRuleGroup	Write
UpdateSizeConstraintSet	waf:UpdateSizeConstraintSet	Write
UpdateSqlInjectionMatchSet	waf:UpdateSqlInjectionMatchSet	Write
UpdateWebACL	waf:UpdateWebACL	Permissions management, Write
UpdateXssMatchSet	waf:UpdateXssMatchSet	Write

Actions defined by AWS WAF

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
CreateByteMatchSet	Grants permission to create a ByteMatchSet	bytematchset*		Write
CreateGeoMatchSet	Grants permission to create a GeoMatchSet	geomatchset*		Write
CreateIPSet	Grants permission to create an IPSet	ipset*		Write
CreateRateBasedRule	Grants permission to create a RateBasedRule for limiting the volume of requests from a single IP address	ratebasedrule*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateRegexMatchSet	Grants permission to create a RegexMatchSet	regexmatchset*		Write
CreateRegexPatternSet	Grants permission to create a RegexPatternSet	regexpatternset*		Write
CreateRule	Grants permission to create a Rule for filtering web requests	rule*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateRuleGroup	Grants permission to create a RuleGroup, which is a collection of predefined rules that you can use in a WebACL	rulegroup*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateSizeConstraintSet	Grants permission to create a SizeConstraintSet	sizeconstraintset*		Write
CreateSqlInjectionMatchSet	Grants permission to create an SqlInjectionMatchSet	sqlinjectionmatchset*		Write
CreateWebACL	Grants permission to create a WebACL, which contains rules for filtering web requests	webacl*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Permissions management, Write
CreateWebACLMigrationStack	Grants permission to create a CloudFormation web ACL template in an S3 bucket for the purposes of migrating the web ACL from AWS WAF Classic to AWS WAF v2	webacl*	aws:ResourceTag/${TagKey}	Write
CreateXssMatchSet	Grants permission to create an XssMatchSet, which you use to detect requests that contain cross-site scripting attacks	xssmatchset*		Write
DeleteByteMatchSet	Grants permission to delete a ByteMatchSet	bytematchset*		Write
DeleteGeoMatchSet	Grants permission to delete a GeoMatchSet	geomatchset*		Write
DeleteIPSet	Grants permission to delete an IPSet	ipset*		Write
DeleteLoggingConfiguration	Grants permission to delete the LoggingConfiguration from a web ACL	webacl*	aws:ResourceTag/${TagKey}	Write
DeletePermissionPolicy	Grants permission to delete an IAM policy from a rule group	rulegroup*	aws:ResourceTag/${TagKey}	Permissions management, Write
DeleteRateBasedRule	Grants permission to delete a RateBasedRule	ratebasedrule*	aws:ResourceTag/${TagKey}	Write
DeleteRegexMatchSet	Grants permission to delete a RegexMatchSet	regexmatchset*		Write
DeleteRegexPatternSet	Grants permission to delete a RegexPatternSet	regexpatternset*		Write
DeleteRule	Grants permission to delete a Rule	rule*	aws:ResourceTag/${TagKey}	Write
DeleteRuleGroup	Grants permission to delete a RuleGroup	rulegroup*	aws:ResourceTag/${TagKey}	Write
DeleteSizeConstraintSet	Grants permission to delete a SizeConstraintSet	sizeconstraintset*		Write
DeleteSqlInjectionMatchSet	Grants permission to delete an SqlInjectionMatchSet	sqlinjectionmatchset*		Write
DeleteWebACL	Grants permission to delete a WebACL	webacl*	aws:ResourceTag/${TagKey}	Permissions management, Write
DeleteXssMatchSet	Grants permission to delete an XssMatchSet	xssmatchset*		Write
GetByteMatchSet	Grants permission to retrieve a ByteMatchSet	bytematchset*		Read
GetChangeToken	Grants permission to retrieve a change token to use in create, update, and delete requests			Read
GetChangeTokenStatus	Grants permission to retrieve the status of a change token			Read
GetGeoMatchSet	Grants permission to retrieve a GeoMatchSet	geomatchset*		Read
GetIPSet	Grants permission to retrieve an IPSet	ipset*		Read
GetLoggingConfiguration	Grants permission to retrieve a LoggingConfiguration for a web ACL	webacl*	aws:ResourceTag/${TagKey}	Read
GetPermissionPolicy	Grants permission to retrieve an IAM policy for a rule group	rulegroup*	aws:ResourceTag/${TagKey}	Read
GetRateBasedRule	Grants permission to retrieve a RateBasedRule	ratebasedrule*	aws:ResourceTag/${TagKey}	Read
GetRateBasedRuleManagedKeys	Grants permission to retrieve the array of IP addresses that are currently being blocked by a RateBasedRule	ratebasedrule*	aws:ResourceTag/${TagKey}	Read
GetRegexMatchSet	Grants permission to retrieve a RegexMatchSet	regexmatchset*		Read
GetRegexPatternSet	Grants permission to retrieve a RegexPatternSet	regexpatternset*		Read
GetRule	Grants permission to retrieve a Rule	rule*	aws:ResourceTag/${TagKey}	Read
GetRuleGroup	Grants permission to retrieve a RuleGroup	rulegroup*	aws:ResourceTag/${TagKey}	Read
GetSampledRequests	Grants permission to retrieve detailed information about a sample set of web requests	webacl	aws:ResourceTag/${TagKey}	Read
GetSizeConstraintSet	Grants permission to retrieve a SizeConstraintSet	sizeconstraintset*		Read
GetSqlInjectionMatchSet	Grants permission to retrieve an SqlInjectionMatchSet	sqlinjectionmatchset*		Read
GetWebACL	Grants permission to retrieve a WebACL	webacl*	aws:ResourceTag/${TagKey}	Read
GetXssMatchSet	Grants permission to retrieve an XssMatchSet	xssmatchset*		Read
ListActivatedRulesInRuleGroup	Grants permission to retrieve an array of ActivatedRule objects			List
ListByteMatchSets	Grants permission to retrieve an array of ByteMatchSetSummary objects			List
ListGeoMatchSets	Grants permission to retrieve an array of GeoMatchSetSummary objects			List
ListIPSets	Grants permission to retrieve an array of IPSetSummary objects			List
ListLoggingConfigurations	Grants permission to retrieve an array of LoggingConfiguration objects			List
ListRateBasedRules	Grants permission to retrieve an array of RuleSummary objects			List
ListRegexMatchSets	Grants permission to retrieve an array of RegexMatchSetSummary objects			List
ListRegexPatternSets	Grants permission to retrieve an array of RegexPatternSetSummary objects			List
ListRuleGroups	Grants permission to retrieve an array of RuleGroup objects			List
ListRules	Grants permission to retrieve an array of RuleSummary objects			List
ListSizeConstraintSets	Grants permission to retrieve an array of SizeConstraintSetSummary objects			List
ListSqlInjectionMatchSets	Grants permission to retrieve an array of SqlInjectionMatchSet objects			List
ListSubscribedRuleGroups	Grants permission to retrieve an array of RuleGroup objects that you are subscribed to			List
ListTagsForResource	Grants permission to retrieve the tags for a resource	ratebasedrule	aws:ResourceTag/${TagKey}	Read
		rule	aws:ResourceTag/${TagKey}
		rulegroup	aws:ResourceTag/${TagKey}
		webacl	aws:ResourceTag/${TagKey}
ListWebACLs	Grants permission to retrieve an array of WebACLSummary objects			List
ListXssMatchSets	Grants permission to retrieve an array of XssMatchSet objects			List
PutLoggingConfiguration	Grants permission to associate a LoggingConfiguration with a specified web ACL	webacl*	aws:ResourceTag/${TagKey}	Write
PutPermissionPolicy	Grants permission to attach an IAM policy to a rule group, to share the rule group between accounts	rulegroup*	aws:ResourceTag/${TagKey}	Permissions management, Write
TagResource	Grants permission to add a Tag to a resource	ratebasedrule	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		rule	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		rulegroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		webacl	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
UntagResource	Grants permission to remove a Tag from a resource	ratebasedrule	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		rule	aws:ResourceTag/${TagKey} aws:TagKeys
		rulegroup	aws:ResourceTag/${TagKey} aws:TagKeys
		webacl	aws:ResourceTag/${TagKey} aws:TagKeys
UpdateByteMatchSet	Grants permission to insert or delete ByteMatchTuple objects in a ByteMatchSet	bytematchset*		Write
UpdateGeoMatchSet	Grants permission to insert or delete GeoMatchConstraint objects in a GeoMatchSet	geomatchset*		Write
UpdateIPSet	Grants permission to insert or delete IPSetDescriptor objects in an IPSet	ipset*		Write
UpdateRateBasedRule	Grants permission to modify a rate based rule	ratebasedrule*	aws:ResourceTag/${TagKey}	Write
UpdateRegexMatchSet	Grants permission to insert or delete RegexMatchTuple objects in a RegexMatchSet	regexmatchset*		Write
UpdateRegexPatternSet	Grants permission to insert or delete RegexPatternStrings in a RegexPatternSet	regexpatternset*		Write
UpdateRule	Grants permission to modify a Rule	rule*	aws:ResourceTag/${TagKey}	Write
UpdateRuleGroup	Grants permission to insert or delete ActivatedRule objects in a RuleGroup	rulegroup*	aws:ResourceTag/${TagKey}	Write
UpdateSizeConstraintSet	Grants permission to insert or delete SizeConstraint objects in a SizeConstraintSet	sizeconstraintset*		Write
UpdateSqlInjectionMatchSet	Grants permission to insert or delete SqlInjectionMatchTuple objects in an SqlInjectionMatchSet	sqlinjectionmatchset*		Write
UpdateWebACL	Grants permission to insert or delete ActivatedRule objects in a WebACL	webacl*	aws:ResourceTag/${TagKey}	Permissions management, Write
UpdateXssMatchSet	Grants permission to insert or delete XssMatchTuple objects in an XssMatchSet	xssmatchset*		Write

Resource types defined by AWS WAF

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
bytematchset	arn:${Partition}:waf::${Account}:bytematchset/${Id}
geomatchset	arn:${Partition}:waf::${Account}:geomatchset/${Id}
ipset	arn:${Partition}:waf::${Account}:ipset/${Id}
ratebasedrule	arn:${Partition}:waf::${Account}:ratebasedrule/${Id}	aws:ResourceTag/${TagKey}
regexmatchset	arn:${Partition}:waf::${Account}:regexmatch/${Id}
regexpatternset	arn:${Partition}:waf::${Account}:regexpatternset/${Id}
rule	arn:${Partition}:waf::${Account}:rule/${Id}	aws:ResourceTag/${TagKey}
rulegroup	arn:${Partition}:waf::${Account}:rulegroup/${Id}	aws:ResourceTag/${TagKey}
sizeconstraintset	arn:${Partition}:waf::${Account}:sizeconstraintset/${Id}
sqlinjectionmatchset	arn:${Partition}:waf::${Account}:sqlinjectionset/${Id}
webacl	arn:${Partition}:waf::${Account}:webacl/${Id}	aws:ResourceTag/${TagKey}
xssmatchset	arn:${Partition}:waf::${Account}:xssmatchset/${Id}

Condition keys for AWS WAF

AWS WAF defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters actions based on the allowed set of values for each of the tags	String
aws:ResourceTag/${TagKey}	Filters actions based on tag-value associated with the resource	String
aws:TagKeys	Filters actions based on the presence of mandatory tags in the request	ArrayOfString

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

AWS Verified Access (verified-access)

AWS WAF Regional (waf-regional)