AWS waf documentation change
Summary
Added permissions for CloudFront pricing plans and Route 53/CloudFront access to AWSWAFConsoleFullAccess and AWSWAFConsoleReadOnlyAccess policies
Security assessment
The change adds new IAM permissions for pricing plan management and resource viewing but doesn't address vulnerabilities or weaknesses. It's a feature expansion for CloudFront integration without security implications.
Diff
diff --git a/waf/latest/developerguide/security-iam-awsmanpol.md b/waf/latest/developerguide/security-iam-awsmanpol.md index f96768120..d41c213c5 100644 --- a//waf/latest/developerguide/security-iam-awsmanpol.md +++ b//waf/latest/developerguide/security-iam-awsmanpol.md @@ -58,0 +59,21 @@ Policy | Description of change | Date +`AWSWAFConsoleFullAccess` This policy allows AWS WAF to manage AWS console resources and other AWS resources on your behalf in AWS WAF and in integrated services. Details in IAM console: [AWSWAFConsoleFullAccess](https://console.aws.amazon.com/iam/home#/policies/arn:aws:iam::aws:policy/AWSWAFConsoleFullAccess$serviceLevelSummary). | Added the following permissions for CloudFront pricing plans. For more detail, see [Using AWS WAF with CloudFront Flat-Rate Pricing Plans](./waf-cf-pricing-plans.html) + + * `pricingplanmanager:GetSubscription` – Grants permission to get pricing plan subscription information associated with your AWS account + * `pricingplanmanager:ListSubscriptions` – Grants permission to list the pricing plan subscriptions associated with your AWS account + * `pricingplanmanager:UpdateSubscription` – Grants permission to update the pricing plan subscriptions associated with your AWS account + * `pricingplanmanager:CancelSubscription` – Grants permission to cancel the pricing plan subscriptions associated with your AWS account + * `pricingplanmanager:CancelSubscriptionChange` – Grants permission to cancel pricing plan subscription changes associated with your AWS account + * `route53:ListHostedZones` – Grants permission to list the Route 53 hosted zones associated with your AWS account + * `route53:GetHostedZone` – Grants permission to view details about Route 53 hosted zones associated with your AWS account + * `cloudfront:GetDistribution` – Grants permission to view details about CloudFront distributions associated with your AWS account + +| 2025-11-18 +`AWSWAFConsoleReadOnlyAccess` This policy allows AWS WAF to manage AWS console resources and other AWS resources on your behalf in AWS WAF and in integrated services. Details in IAM console: [AWSWAFConsoleReadOnlyAccess](https://console.aws.amazon.com/iam/home#/policies/arn:aws:iam::aws:policy/AWSWAFConsoleReadOnlyAccess$serviceLevelSummary). | Added the following permissions for CloudFront pricing plans. For more detail, see [Using AWS WAF with CloudFront Flat-Rate Pricing Plans](./waf-cf-pricing-plans.html) + + * `pricingplanmanager:GetSubscription` – Grants permission to get pricing plan subscription information associated with your AWS account + * `pricingplanmanager:ListSubscriptions` – Grants permission to list the pricing plan subscriptions associated with your AWS account + * `route53:ListHostedZones` – Grants permission to list the Route 53 hosted zones associated with your AWS account + * `route53:GetHostedZone` – Grants permission to view details about Route 53 hosted zones associated with your AWS account + * `cloudfront:GetDistribution` – Grants permission to view details about CloudFront distributions associated with your AWS account + +| 2025-11-18