AWS waf documentation change

Service: waf · 2026-05-04 · Documentation low

File: waf/latest/developerguide/security_iam_service-with-iam.md

Summary

Updated IAM permissions documentation for web ACL operations (Associate, Disassociate, Get, List) with Application Load Balancer and AWS AppSync. Added new service-specific actions and split permissions into multiple statements for granular control.

Security assessment

Changes introduce new IAM actions (e.g., elasticloadbalancing:CreateWebACLAssociation, appsync:AssociateWebACL) and update permission requirements for WAF operations. This provides more granular security control but doesn't fix any vulnerability. The documentation now separates old and new permission models.

Diff

diff --git a/waf/latest/developerguide/security_iam_service-with-iam.md b/waf/latest/developerguide/security_iam_service-with-iam.md
index 9ceff7e8f..4f53ae1c5 100644
--- a//waf/latest/developerguide/security_iam_service-with-iam.md
+++ b//waf/latest/developerguide/security_iam_service-with-iam.md
@@ -16,0 +17,4 @@ This section explains how to use the features of IAM with AWS WAF.
+###### Note
+
+Introducing new actions in IAM policies that give you more granular control when invoking web ACL Association related operations for Application Load Balancer and AWS AppSync. See Actions that require additional permissions settings.
+
@@ -135,0 +140,2 @@ Requires permission to call API Gateway `SetWebACL` on the REST API resource typ
+**Old Permission Setting**
+
@@ -159,0 +166,28 @@ Requires permission to call `elasticloadbalancing:SetWebACL` action on the Appli
+Show moreShow less
+
+**New Permission Setting**
+
+Requires permission to call `elasticloadbalancing:CreateWebACLAssociation` action on the Application Load Balancer resource type and to call AWS WAF `AssociateWebACL` on a protection pack (web ACL).
+    
+    
+    {
+       "Sid": "AssociateWebACL1",
+       "Effect": "Allow",
+       "Action": [
+          "wafv2:AssociateWebACL"
+       ],
+       "Resource": [
+          "arn:aws:wafv2:region:account-id:regional/webacl/*/*"
+       ]
+    },
+    {
+       "Sid": "AssociateWebACL2",
+       "Effect": "Allow",
+       "Action": [
+          "elasticloadbalancing:CreateWebACLAssociation"
+       ],
+       "Resource": [
+             "arn:aws:elasticloadbalancing:*:account-id:loadbalancer/app/*/*"
+       ]
+    }
+
@@ -161,0 +196,2 @@ Requires permission to call `elasticloadbalancing:SetWebACL` action on the Appli
+**Old Permission Setting**
+
@@ -185,0 +222,28 @@ Requires permission to call AWS AppSync `SetWebACL` on the GraphQL API resource
+Show moreShow less
+
+**New Permission Setting**
+
+Requires permission to call `appsync:AssociateWebACL` action on the GraphQL API resource type and to call AWS WAF `AssociateWebACL` on a protection pack (web ACL).
+    
+    
+    {
+        "Sid": "AssociateWebACL1",
+        "Effect": "Allow",
+        "Action": [
+            "wafv2:AssociateWebACL"
+        ],
+        "Resource": [
+            "arn:aws:wafv2:region:account-id:regional/webacl/*/*"
+        ]
+    },
+    {
+        "Sid": "AssociateWebACL2",
+        "Effect": "Allow",
+        "Action": [
+            "appsync:AssociateWebACL"
+        ],
+        "Resource": [
+            "arn:aws:appsync:*:account-id:apis/*"
+        ]
+    }
+
@@ -287,0 +352,2 @@ Requires permission to call API Gateway `SetWebACL` on the REST API resource typ
+**Old Permission Setting**
+
@@ -301,0 +368,25 @@ Requires permission to call the `elasticloadbalancing:SetWebACL` action on the A
+Show moreShow less
+
+**New Permission Setting**
+
+Requires permission to call the `elasticloadbalancing:DeleteWebACLAssociation` action on the Application Load Balancer resource type. Also requires permission to call AWS WAF `DisassociateWebACL`.
+    
+    
+    {
+          "Sid": "DisassociateWebACL",
+          "Effect": "Allow",
+          "Action": "wafv2:DisassociateWebACL",
+          "Resource": "*" 
+        },
+        {
+          "Sid": "DisassociateWebACL2",
+          "Effect": "Allow",
+          "Action": [
+             "elasticloadbalancing:DeleteWebACLAssociation"
+          ],
+          "Resource": [
+            "arn:aws:elasticloadbalancing:*:account-id:loadbalancer/app/*/*"
+          ]
+       }   
+    }
+
@@ -303,0 +395,2 @@ Requires permission to call the `elasticloadbalancing:SetWebACL` action on the A
+**Old Permission Setting**
+
@@ -317,0 +411,24 @@ Requires permission to call AWS AppSync `SetWebACL` on the GraphQL API resource
+Show moreShow less
+
+**New Permission Setting**
+
+Requires permission to call the `appsync:DisassociateWebACL` action on the GraphQL API resource type. Also requires permission to call AWS WAF `DisassociateWebACL`.
+    
+    
+    {
+        "Sid": "DisassociateWebACL1",
+        "Effect": "Allow",
+        "Action": "wafv2:DisassociateWebACL",
+        "Resource": "*"
+    },
+    {
+        "Sid": "DisassociateWebACL2",
+        "Effect": "Allow",
+        "Action": [
+            "appsync:DisassociateWebACL"
+        ],
+        "Resource": [
+            "arn:aws:appsync:*:account-id:apis/*"
+        ]
+    }
+
@@ -394 +511,68 @@ For Amazon CloudFront distributions, instead of this action, use the CloudFront
-###### Amazon API Gateway REST API, Application Load Balancer, and AWS AppSync GraphQL API
+###### Amazon API Gateway REST API
+
+Require permission to call AWS WAF `GetWebACLForResource` and `GetWebACL` for a protection pack (web ACL). 
+    
+    
+    {
+        "Sid": "GetWebACLForResource",
+        "Effect": "Allow",
+        "Action": [
+            "wafv2:GetWebACLForResource",
+            "wafv2:GetWebACL"
+        ],
+        "Resource": [
+            "arn:aws:wafv2:region:account-id:regional/webacl/*/*"
+        ]
+    }
+
+###### Application Load Balancer
+
+**Old Permission Setting**
+
+Require permission to call AWS WAF `GetWebACLForResource` and `GetWebACL` for a protection pack (web ACL). 
+    
+    
+    {
+        "Sid": "GetWebACLForResource",
+        "Effect": "Allow",
+        "Action": [
+            "wafv2:GetWebACLForResource",
+            "wafv2:GetWebACL"
+        ],
+        "Resource": [
+            "arn:aws:wafv2:region:account-id:regional/webacl/*/*"
+        ]
+    }
+
+Show moreShow less
+
+**New Permission Setting**
+
+Require permission to call AWS WAF `GetWebACLForResource` and `GetWebACL` for a protection pack (web ACL). Also require permission to call `elasticloadbalancing:GetLoadBalancerWebACL`.
+    
+    
+    {
+        "Sid": "GetWebACLForResource1",
+        "Effect": "Allow",
+        "Action": [
+            "wafv2:GetWebACLForResource",
+            "wafv2:GetWebACL"
+        ],
+        "Resource": [
+            "arn:aws:wafv2:region:account-id:regional/webacl/*/*"
+        ]
+    },
+    {
+       "Sid": "GetWebACLForResource2",
+        "Effect": "Allow",
+        "Action": [
+            "elasticloadbalancing:GetLoadBalancerWebACL"
+        ],
+        "Resource": [
+            "arn:aws:elasticloadbalancing:*:account-id:loadbalancer/app/*/*"
+        ]
+    }
+
+###### AWS AppSync GraphQL API
+
+**Old Permission Setting**