Create a role that allows to whitelist an ipset

whitelist-role.yaml

AWSTemplateFormatVersion: '2010-09-09'
Parameters:
  AccountId:
    Type: String
    Description: The AWS Account ID that can assume this role.
  RoleName:
    Type: String
    Description: The policy name that allows add or remove ips from ipsets

Resources:
  WhitelistRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Ref RoleName
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              AWS: !Ref AccountId # Allow the specified account to assume this role
            Action: "sts:AssumeRole"
      Policies:
        - PolicyName: IPSetManagement
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: "Allow"
                Action:
                  # WAFv2 Permissions (IP Set management)
                  - "wafv2:UpdateIPSet"
                  - "wafv2:CreateIPSet"
                  - "wafv2:DeleteIPSet"
                  - "wafv2:GetIPSet"
                  - "wafv2:ListIPSets"

                  # WAFv1 Permissions (IP Set management)
                  - "waf:UpdateIPSet"
                  - "waf:CreateIPSet"
                  - "waf:DeleteIPSet"
                  - "waf:GetIPSet"
                  - "waf:ListIPSets"
                Resource: "*"

Outputs:
  RoleArn:
    Description: "ARN of the Whitelist Role"
    Value: !GetAtt WhitelistRole.Arn