AWS waf documentation change

Service: waf · 2025-07-10 · Documentation medium

File: waf/latest/developerguide/shd-security_iam_id-based-policy-examples.md

Summary

Added documentation for console-only DDoS attack monitoring APIs and example IAM policies for accessing Shield threat data

Security assessment

The change introduces documentation for security monitoring capabilities (DDoS attack analysis and global threat data) and provides explicit IAM policy examples for security-related permissions. While it enhances security documentation, there's no indication of addressing a specific existing security vulnerability.

Diff

diff --git a/waf/latest/developerguide/shd-security_iam_id-based-policy-examples.md b/waf/latest/developerguide/shd-security_iam_id-based-policy-examples.md
index a53f74a06..a241dd600 100644
--- a//waf/latest/developerguide/shd-security_iam_id-based-policy-examples.md
+++ b//waf/latest/developerguide/shd-security_iam_id-based-policy-examples.md
@@ -62,0 +63,40 @@ Users who can access and use the AWS console can also access the AWS Shield cons
+### Console-only APIs
+
+You can access the following Distributed Denial of Service (DDoS) attack information in the console. Specify the following API permissions in an IAM policy to allow or deny specific actions.
+
+Action | Description  
+---|---  
+`DescribeAttackContributors` |  Grants permission to get detailed information about the contributors to a specific DDoS attack.  
+`ListMitigations` |  Grants permission to retrieve a list of mitigation actions that have been applied during DDoS attacks.  
+`GetGlobalThreatData` |  Grants permission to retrieve global threat intelligence data and trends from AWS Shield's threat monitoring systems.  
+  
+This example shows how you might create a policy that allows you to see DDoS attack information in the console.
+    
+    
+    {
+        "Version": "2012-10-17",
+        "Statement": [
+            {
+                "Effect": "Allow",
+                "Action": [
+                    "shield:DescribeAttackContributors"
+                ],
+                "Resource": "*"
+            },
+            {
+                "Effect": "Allow",
+                "Action": [
+                    "shield:ListMitigations"
+                ],
+                "Resource": "*"
+            },
+            {
+                "Effect": "Allow",
+                "Action": [
+                    "shield:GetGlobalThreatData"
+                ],
+                "Resource": "*"
+            }
+        ]
+    } 
+