Authorizes the DDoS Response Team (DRT), using the specified role, to access your AWS account to assist with DDoS attack mitigation during potential attacks. This enables the DRT to inspect your AWS WAF configuration and create or update AWS WAF rules and web ACLs.
You can associate only one RoleArn with your subscription. If you
submit an AssociateDRTRole request for an account that already has an
associated role, the new RoleArn will replace the existing RoleArn.
Prior to making the AssociateDRTRole request, you must attach the
AWSShieldDRTAccessPolicy managed policy to the role you will specify in
the request. For more information see Attaching and Detaching IAM
Policies. The role must also trust the service principal
drt.shield.amazonaws.com. For more information, see IAM JSON Policy Elements: Principal.
The DRT will have access only to your AWS WAF and Shield resources. By submitting this request, you authorize the DRT to inspect your AWS WAF and Shield configuration and create and update AWS WAF rules and web ACLs on your behalf. The DRT takes these actions only if explicitly authorized by you.
You must have the iam:PassRole permission to make an
AssociateDRTRole request. For more information, see Granting a User Permissions to Pass a Role to an AWS Service.
To use the services of the DRT and make an AssociateDRTRole request,
you must be subscribed to the Business Support plan or the
Enterprise Support plan.
shield_associate_drt_role(RoleArn)[required] The Amazon Resource Name (ARN) of the role the DRT will use to access your AWS account.
Prior to making the AssociateDRTRole request, you must attach the
AWSShieldDRTAccessPolicy managed policy to this role. For more
information see Attaching and Detaching IAM Policies.
svc$associate_drt_role( RoleArn = "string" )