Authorizes the DDoS Response team (DRT), using the specified role, to access your AWS account to assist with DDoS attack mitigation during potential attacks. This enables the DRT to inspect your AWS WAF configuration and create or update AWS WAF rules and web ACLs.
shield_associate_drt_role(RoleArn)[required] The Amazon Resource Name (ARN) of the role the DRT will use to access your AWS account.
Prior to making the AssociateDRTRole request, you must attach the
AWSShieldDRTAccessPolicy
managed policy to this role. For more information see Attaching and
Detaching IAM Policies.
svc$associate_drt_role( RoleArn = "string" )
You can associate only one RoleArn with your subscription. If you
submit an AssociateDRTRole request for an account that already has an
associated role, the new RoleArn will replace the existing RoleArn.
Prior to making the AssociateDRTRole request, you must attach the
AWSShieldDRTAccessPolicy
managed policy to the role you will specify in the request. For more
information see Attaching and Detaching IAM Policies. The role must also
trust the service principal drt.shield.amazonaws.com. For more
information, see IAM JSON Policy Elements: Principal.
The DRT will have access only to your AWS WAF and Shield resources. By submitting this request, you authorize the DRT to inspect your AWS WAF and Shield configuration and create and update AWS WAF rules and web ACLs on your behalf. The DRT takes these actions only if explicitly authorized by you.
You must have the iam:PassRole permission to make an
AssociateDRTRole request. For more information, see Granting a User Permissions to Pass a Role to an AWS Service.
To use the services of the DRT and make an AssociateDRTRole request,
you must be subscribed to the Business Support plan or the
Enterprise Support plan.