PutPermissionPolicy

Source: src/AWS/WAFv2/PutPermissionPolicy.ts

Runtime binding for wafv2:PutPermissionPolicy — attach an IAM policy that shares the bound RuleGroup with other accounts (e.g. a SaaS granting tenant accounts the right to reference the group from their web ACLs); the rule group ARN is injected automatically. A malformed policy fails with the typed WAFInvalidPermissionPolicyException.

Provide WAFv2.PutPermissionPolicyHttp on the hosting Lambda Function to satisfy the requirement.

Sharing Rule Groups

// init — grants wafv2:PutPermissionPolicy on the rule group
const putPermissionPolicy = yield* AWS.WAFv2.PutPermissionPolicy(group);

// runtime
yield* putPermissionPolicy({
  Policy: JSON.stringify({
    Version: "2012-10-17",
    Statement: [
      {
        Effect: "Allow",
        Principal: { AWS: "arn:aws:iam::123456789012:root" },
        Action: ["wafv2:CreateWebACL", "wafv2:UpdateWebACL"],
        Resource: group.ruleGroupArn,
      },
    ],
  }),
});