AWS AmazonCloudFront documentation change
Summary
Added permissions for AWS Pricing Plan Manager and AWS WAF (e.g., `waf:CreateWebACLs`) to IAM policies
Security assessment
The changes document new IAM permissions for managing WAF web ACLs and pricing plan subscriptions. While WAF is a security feature, there is no evidence of a resolved vulnerability. The update expands policy documentation but does not address a specific security incident.
Diff
diff --git a/AmazonCloudFront/latest/DeveloperGuide/security-iam-awsmanpol.md b/AmazonCloudFront/latest/DeveloperGuide/security-iam-awsmanpol.md index 50fa53e38..efe395f7a 100644 --- a//AmazonCloudFront/latest/DeveloperGuide/security-iam-awsmanpol.md +++ b//AmazonCloudFront/latest/DeveloperGuide/security-iam-awsmanpol.md @@ -67,0 +68,4 @@ This policy includes the following permissions. + * `pricingplanmanager:GetSubscription` – Allows principals read-only access to get details about pricing plan subscriptions. + + * `pricingplanmanager:ListSubscriptions` – Allows principals read-only access to list pricing plan subscriptions. + @@ -98,0 +103,2 @@ This policy includes the following permissions. + * `waf:CreateWebACLs` – Allows principals to create a web ACL in AWS WAF. + @@ -114,0 +121,16 @@ This policy includes the following permissions. + * `pricingplanmanager:AssociateResourcesToSubscription` \- Allows principals to associate resources to a subscription. This enables the resources to be covered by the subscription's pricing plan. + + * `pricingplanmanager:CancelSubscription` \- Allows principals to cancel an existing subscription. + + * `pricingplanmanager:CancelSubscriptionChange` \- Allows principals to cancel a pending change to an existing subscription, such as a plan upgrade, before the change is applied. + + * `pricingplanmanager:CreateSubscription` \- Allows principals to create a subscription to a pricing plan. + + * `pricingplanmanager:DisassociateResourcesFromSubscription` \- Allows principals to remove the association between resources and an existing subscription. + + * `pricingplanmanager:UpdateSubscription` \- Allows principals to modify an existing subscription, such as changing the pricing plan. + + * `pricingplanmanager:GetSubscription` – Allows principals read-only access to get details about pricing plan subscriptions. + + * `pricingplanmanager:ListSubscriptions` – Allows principals read-only access to list pricing plan subscriptions. + @@ -153,0 +176,2 @@ Change | Description | Date +CloudFrontFullAccess – Update to existing policy | CloudFront added a new permission to create an AWS WAF ACL resource, and added create, update, delete, and read permissions to AWS Pricing Plan Manager. | November 18, 2025 +CloudFrontReadOnlyAccess – Update to existing policy | CloudFront added new permissions for read-only access to AWS Pricing Plan Manager. | November 18, 2025