Authorizes the DDoS Response Team (DRT), using the specified role, to access your AWS account to assist with DDoS attack mitigation during potential attacks. This enables the DRT to inspect your AWS WAF configuration and create or update AWS WAF rules and web ACLs.
You can associate only one RoleArn with your subscription. If you
submit an associate_drt_role request for
an account that already has an associated role, the new RoleArn will
replace the existing RoleArn.
Prior to making the associate_drt_role
request, you must attach the AWSShieldDRTAccessPolicy managed policy to
the role you will specify in the request. For more information see
Attaching and Detaching IAM Policies. The role must also trust the
service principal drt.shield.amazonaws.com. For more information, see
IAM JSON Policy Elements: Principal.
The DRT will have access only to your AWS WAF and Shield resources. By submitting this request, you authorize the DRT to inspect your AWS WAF and Shield configuration and create and update AWS WAF rules and web ACLs on your behalf. The DRT takes these actions only if explicitly authorized by you.
You must have the iam:PassRole permission to make an
associate_drt_role request. For more
information, see Granting a User Permissions to Pass a Role to an AWS Service.
To use the services of the DRT and make an
associate_drt_role request, you must be
subscribed to the Business Support plan or the
Enterprise Support plan.
shield_associate_drt_role(RoleArn)An empty list.
[required] The Amazon Resource Name (ARN) of the role the DRT will use to access your AWS account.
Prior to making the associate_drt_role
request, you must attach the AWSShieldDRTAccessPolicy managed policy to
this role. For more information see Attaching and Detaching IAM
Policies.
svc$associate_drt_role(
RoleArn = "string"
)