Ready to level-up your engineering skills? Join a Pulumi Workshop. Register Now

FirewallRule

Define Firewall rules using filter expressions for more control over how traffic is matched to the rule. A filter expression permits selecting traffic by multiple criteria allowing greater freedom in rule creation.

Filter expressions needs to be created first before using Firewall Rule. See Filter.

Example Usage

using Pulumi;
using Cloudflare = Pulumi.Cloudflare;

class MyStack : Stack
{
    public MyStack()
    {
        var wordpressFilter = new Cloudflare.Filter("wordpressFilter", new Cloudflare.FilterArgs
        {
            ZoneId = "d41d8cd98f00b204e9800998ecf8427e",
            Description = "Wordpress break-in attempts that are outside of the office",
            Expression = "(http.request.uri.path ~ \".*wp-login.php\" or http.request.uri.path ~ \".*xmlrpc.php\") and ip.src ne 192.0.2.1",
        });
        var wordpressFirewallRule = new Cloudflare.FirewallRule("wordpressFirewallRule", new Cloudflare.FirewallRuleArgs
        {
            ZoneId = "d41d8cd98f00b204e9800998ecf8427e",
            Description = "Block wordpress break-in attempts",
            FilterId = wordpressFilter.Id,
            Action = "block",
        });
    }

}
package main

import (
    "github.com/pulumi/pulumi-cloudflare/sdk/v2/go/cloudflare"
    "github.com/pulumi/pulumi/sdk/v2/go/pulumi"
)

func main() {
    pulumi.Run(func(ctx *pulumi.Context) error {
        wordpressFilter, err := cloudflare.NewFilter(ctx, "wordpressFilter", &cloudflare.FilterArgs{
            ZoneId:      pulumi.String("d41d8cd98f00b204e9800998ecf8427e"),
            Description: pulumi.String("Wordpress break-in attempts that are outside of the office"),
            Expression:  pulumi.String("(http.request.uri.path ~ \".*wp-login.php\" or http.request.uri.path ~ \".*xmlrpc.php\") and ip.src ne 192.0.2.1"),
        })
        if err != nil {
            return err
        }
        _, err = cloudflare.NewFirewallRule(ctx, "wordpressFirewallRule", &cloudflare.FirewallRuleArgs{
            ZoneId:      pulumi.String("d41d8cd98f00b204e9800998ecf8427e"),
            Description: pulumi.String("Block wordpress break-in attempts"),
            FilterId:    wordpressFilter.ID(),
            Action:      pulumi.String("block"),
        })
        if err != nil {
            return err
        }
        return nil
    })
}
import pulumi
import pulumi_cloudflare as cloudflare

wordpress_filter = cloudflare.Filter("wordpressFilter",
    zone_id="d41d8cd98f00b204e9800998ecf8427e",
    description="Wordpress break-in attempts that are outside of the office",
    expression="(http.request.uri.path ~ \".*wp-login.php\" or http.request.uri.path ~ \".*xmlrpc.php\") and ip.src ne 192.0.2.1")
wordpress_firewall_rule = cloudflare.FirewallRule("wordpressFirewallRule",
    zone_id="d41d8cd98f00b204e9800998ecf8427e",
    description="Block wordpress break-in attempts",
    filter_id=wordpress_filter.id,
    action="block")
import * as pulumi from "@pulumi/pulumi";
import * as cloudflare from "@pulumi/cloudflare";

const wordpressFilter = new cloudflare.Filter("wordpressFilter", {
    zoneId: "d41d8cd98f00b204e9800998ecf8427e",
    description: "Wordpress break-in attempts that are outside of the office",
    expression: "(http.request.uri.path ~ \".*wp-login.php\" or http.request.uri.path ~ \".*xmlrpc.php\") and ip.src ne 192.0.2.1",
});
const wordpressFirewallRule = new cloudflare.FirewallRule("wordpressFirewallRule", {
    zoneId: "d41d8cd98f00b204e9800998ecf8427e",
    description: "Block wordpress break-in attempts",
    filterId: wordpressFilter.id,
    action: "block",
});

Create a FirewallRule Resource

new FirewallRule(name: string, args: FirewallRuleArgs, opts?: CustomResourceOptions);
def FirewallRule(resource_name: str, opts: Optional[ResourceOptions] = None, action: Optional[str] = None, description: Optional[str] = None, filter_id: Optional[str] = None, paused: Optional[bool] = None, priority: Optional[int] = None, products: Optional[Sequence[str]] = None, zone_id: Optional[str] = None)
func NewFirewallRule(ctx *Context, name string, args FirewallRuleArgs, opts ...ResourceOption) (*FirewallRule, error)
public FirewallRule(string name, FirewallRuleArgs args, CustomResourceOptions? opts = null)
name string
The unique name of the resource.
args FirewallRuleArgs
The arguments to resource properties.
opts CustomResourceOptions
Bag of options to control resource's behavior.
resource_name str
The unique name of the resource.
opts ResourceOptions
A bag of options that control this resource's behavior.
ctx Context
Context object for the current deployment.
name string
The unique name of the resource.
args FirewallRuleArgs
The arguments to resource properties.
opts ResourceOption
Bag of options to control resource's behavior.
name string
The unique name of the resource.
args FirewallRuleArgs
The arguments to resource properties.
opts CustomResourceOptions
Bag of options to control resource's behavior.

FirewallRule Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Programming Model docs.

Inputs

The FirewallRule resource accepts the following input properties:

Action string

The action to apply to a matched request. Allowed values: “block”, “challenge”, “allow”, “js_challenge”, “bypass”. Enterprise plan also allows “log”.

FilterId string
ZoneId string

The DNS zone to which the Filter should be added.

Description string

A description of the rule to help identify it.

Paused bool

Whether this filter based firewall rule is currently paused. Boolean value.

Priority int

The priority of the rule to allow control of processing order. A lower number indicates high priority. If not provided, any rules with a priority will be sequenced before those without.

Products List<string>

List of products to bypass for a request when the bypass action is used. Allowed values: “zoneLockdown”, “uaBlock”, “bic”, “hot”, “securityLevel”, “rateLimit”, “waf”.

Action string

The action to apply to a matched request. Allowed values: “block”, “challenge”, “allow”, “js_challenge”, “bypass”. Enterprise plan also allows “log”.

FilterId string
ZoneId string

The DNS zone to which the Filter should be added.

Description string

A description of the rule to help identify it.

Paused bool

Whether this filter based firewall rule is currently paused. Boolean value.

Priority int

The priority of the rule to allow control of processing order. A lower number indicates high priority. If not provided, any rules with a priority will be sequenced before those without.

Products []string

List of products to bypass for a request when the bypass action is used. Allowed values: “zoneLockdown”, “uaBlock”, “bic”, “hot”, “securityLevel”, “rateLimit”, “waf”.

action string

The action to apply to a matched request. Allowed values: “block”, “challenge”, “allow”, “js_challenge”, “bypass”. Enterprise plan also allows “log”.

filterId string
zoneId string

The DNS zone to which the Filter should be added.

description string

A description of the rule to help identify it.

paused boolean

Whether this filter based firewall rule is currently paused. Boolean value.

priority number

The priority of the rule to allow control of processing order. A lower number indicates high priority. If not provided, any rules with a priority will be sequenced before those without.

products string[]

List of products to bypass for a request when the bypass action is used. Allowed values: “zoneLockdown”, “uaBlock”, “bic”, “hot”, “securityLevel”, “rateLimit”, “waf”.

action str

The action to apply to a matched request. Allowed values: “block”, “challenge”, “allow”, “js_challenge”, “bypass”. Enterprise plan also allows “log”.

filter_id str
zone_id str

The DNS zone to which the Filter should be added.

description str

A description of the rule to help identify it.

paused bool

Whether this filter based firewall rule is currently paused. Boolean value.

priority int

The priority of the rule to allow control of processing order. A lower number indicates high priority. If not provided, any rules with a priority will be sequenced before those without.

products Sequence[str]

List of products to bypass for a request when the bypass action is used. Allowed values: “zoneLockdown”, “uaBlock”, “bic”, “hot”, “securityLevel”, “rateLimit”, “waf”.

Outputs

All input properties are implicitly available as output properties. Additionally, the FirewallRule resource produces the following output properties:

Id string
The provider-assigned unique ID for this managed resource.
Id string
The provider-assigned unique ID for this managed resource.
id string
The provider-assigned unique ID for this managed resource.
id str
The provider-assigned unique ID for this managed resource.

Look up an Existing FirewallRule Resource

Get an existing FirewallRule resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: FirewallRuleState, opts?: CustomResourceOptions): FirewallRule
@staticmethod
def get(resource_name: str, id: str, opts: Optional[ResourceOptions] = None, action: Optional[str] = None, description: Optional[str] = None, filter_id: Optional[str] = None, paused: Optional[bool] = None, priority: Optional[int] = None, products: Optional[Sequence[str]] = None, zone_id: Optional[str] = None) -> FirewallRule
func GetFirewallRule(ctx *Context, name string, id IDInput, state *FirewallRuleState, opts ...ResourceOption) (*FirewallRule, error)
public static FirewallRule Get(string name, Input<string> id, FirewallRuleState? state, CustomResourceOptions? opts = null)
name
The unique name of the resulting resource.
id
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
resource_name
The unique name of the resulting resource.
id
The unique provider ID of the resource to lookup.
name
The unique name of the resulting resource.
id
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
name
The unique name of the resulting resource.
id
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.

The following state arguments are supported:

Action string

The action to apply to a matched request. Allowed values: “block”, “challenge”, “allow”, “js_challenge”, “bypass”. Enterprise plan also allows “log”.

Description string

A description of the rule to help identify it.

FilterId string
Paused bool

Whether this filter based firewall rule is currently paused. Boolean value.

Priority int

The priority of the rule to allow control of processing order. A lower number indicates high priority. If not provided, any rules with a priority will be sequenced before those without.

Products List<string>

List of products to bypass for a request when the bypass action is used. Allowed values: “zoneLockdown”, “uaBlock”, “bic”, “hot”, “securityLevel”, “rateLimit”, “waf”.

ZoneId string

The DNS zone to which the Filter should be added.

Action string

The action to apply to a matched request. Allowed values: “block”, “challenge”, “allow”, “js_challenge”, “bypass”. Enterprise plan also allows “log”.

Description string

A description of the rule to help identify it.

FilterId string
Paused bool

Whether this filter based firewall rule is currently paused. Boolean value.

Priority int

The priority of the rule to allow control of processing order. A lower number indicates high priority. If not provided, any rules with a priority will be sequenced before those without.

Products []string

List of products to bypass for a request when the bypass action is used. Allowed values: “zoneLockdown”, “uaBlock”, “bic”, “hot”, “securityLevel”, “rateLimit”, “waf”.

ZoneId string

The DNS zone to which the Filter should be added.

action string

The action to apply to a matched request. Allowed values: “block”, “challenge”, “allow”, “js_challenge”, “bypass”. Enterprise plan also allows “log”.

description string

A description of the rule to help identify it.

filterId string
paused boolean

Whether this filter based firewall rule is currently paused. Boolean value.

priority number

The priority of the rule to allow control of processing order. A lower number indicates high priority. If not provided, any rules with a priority will be sequenced before those without.

products string[]

List of products to bypass for a request when the bypass action is used. Allowed values: “zoneLockdown”, “uaBlock”, “bic”, “hot”, “securityLevel”, “rateLimit”, “waf”.

zoneId string

The DNS zone to which the Filter should be added.

action str

The action to apply to a matched request. Allowed values: “block”, “challenge”, “allow”, “js_challenge”, “bypass”. Enterprise plan also allows “log”.

description str

A description of the rule to help identify it.

filter_id str
paused bool

Whether this filter based firewall rule is currently paused. Boolean value.

priority int

The priority of the rule to allow control of processing order. A lower number indicates high priority. If not provided, any rules with a priority will be sequenced before those without.

products Sequence[str]

List of products to bypass for a request when the bypass action is used. Allowed values: “zoneLockdown”, “uaBlock”, “bic”, “hot”, “securityLevel”, “rateLimit”, “waf”.

zone_id str

The DNS zone to which the Filter should be added.

Import

Firewall Rule can be imported using a composite ID formed of zone ID and rule ID, e.g.

 $ pulumi import cloudflare:index/firewallRule:FirewallRule default d41d8cd98f00b204e9800998ecf8427e/9e107d9d372bb6826bd81d3542a419d6

where* d41d8cd98f00b204e9800998ecf8427e - zone ID * 9e107d9d372bb6826bd81d3542a419d6 - rule ID as returned by API

Package Details

Repository
https://github.com/pulumi/pulumi-cloudflare
License
Apache-2.0
Notes
This Pulumi package is based on the cloudflare Terraform Provider.