Policy: AWSWAFReadOnlyAccess ARN: arn:aws:iam::aws:policy/AWSWAFReadOnlyAccess Allowed Actions Actions Services apprunner:DescribeWebAclForService apprunner apprunner:ListAssociatedServicesForWebAcl apprunner apprunner:ListServices apprunner cognito-idp:GetWebACLForResource cognito-idp cognito-idp:ListResourcesForWebACL cognito-idp ec2:DescribeVerifiedAccessInstanceWebAclAssociations ec2 ec2:GetVerifiedAccessInstanceWebAcl ec2 waf:Get* waf waf:List* waf waf-regional:Get* waf-regional waf-regional:List* waf-regional wafv2:CheckCapacity wafv2 wafv2:Describe* wafv2 wafv2:Get* wafv2 wafv2:List* wafv2