Merge pull request #213 from tremble/wafv2/tagging

Add WAFv2 tagging permissions
mattclay · Jun 3, 2022 · fa953b7 · fa953b7
2 parents e7a7f45 + bd424fc
commit fa953b7
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/aws/policy/application-security.yaml b/aws/policy/application-security.yaml
@@ -34,7 +34,6 @@ Statement:
       - wafv2:DeleteFirewallManagerRuleGroups
       - wafv2:DisassociateFirewallManager
       - wafv2:UpdateIPSet
-      - wafv2:TagResource
     Resource:
       - 'arn:aws:wafv2:{{ aws_region }}:{{ aws_account_id }}:*'
 
@@ -110,6 +109,9 @@ Statement:
       - waf:UpdateSqlInjectionMatchSet
       - waf:UpdateWebACL
       - waf:UpdateXssMatchSet
+      - wafv2:ListTagsForResource
+      - wafv2:TagResource
+      - wafv2:UntagResource
     Resource: "*"
     Condition:
       StringEquals: