permissions needed for waf logging

https://docs.aws.amazon.com/waf/latest/developerguide/logging-s3.html#logging-s3-permissions
schubergphilis · Jan 17, 2024 · bf5a3bc · bf5a3bc
1 parent 8a60113
commit bf5a3bc
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/files/organizations/allowed_regions.json.tpl b/files/organizations/allowed_regions.json.tpl
@@ -52,6 +52,8 @@
                 "kms:*",
                 "license-manager:ListReceivedLicenses",
                 "lightsail:Get*",
+                "logs:CreateLogDelivery",
+                "logs:DeleteLogDelivery",
                 "mobileanalytics:*",
                 "networkmanager:*",
                 "notifications-contacts:*",
@@ -70,6 +72,7 @@
                 "s3:DescribeMultiRegionAccessPointOperation",
                 "s3:GetAccountPublicAccessBlock",
                 "s3:GetBucketLocation",
+                "s3:GetBucketPolicy",
                 "s3:GetBucketPolicyStatus",
                 "s3:GetBucketPublicAccessBlock",
                 "s3:GetMultiRegionAccessPoint",
@@ -81,6 +84,7 @@
                 "s3:ListMultiRegionAccessPoints",
                 "s3:ListStorageLensConfigurations",
                 "s3:PutAccountPublicAccessBlock",
+                "s3:PutBucketPolicy",
                 "s3:PutMultiRegionAccessPointPolicy",
                 "savingsplans:*",
                 "shield:*",