shield:AssociateDRTLogBucket is a Write access-level action in the shield service. Grants permission to authorize the DDoS Response team to access the specified Amazon S3 bucket containing your flow logs
This action does not support resource-level permissions; use "Resource": "*" in your policy.
No condition keys are documented for this action.
To use shield:AssociateDRTLogBucket you may also need to grant:
A minimal policy that allows shield:AssociateDRTLogBucket. Replace "Resource": "*" with a specific ARN to follow least privilege.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowShieldAssociateDRTLogBucket",
"Effect": "Allow",
"Action": "shield:AssociateDRTLogBucket",
"Resource": "*"
}
]
}