Docs
PackagesWe recommend using Azure Native.
Azure Classic v5.72.0 published on Monday, Apr 15, 2024 by Pulumi
azure.cdn.FrontdoorFirewallPolicy
Explore with Pulumi AI
Manages a Front Door (standard/premium) Firewall Policy instance.
Example Usage
import * as pulumi from "@pulumi/pulumi";
import * as azure from "@pulumi/azure";
const example = new azure.core.ResourceGroup("example", {
name: "example-cdn-frontdoor",
location: "West Europe",
});
const exampleFrontdoorProfile = new azure.cdn.FrontdoorProfile("example", {
name: "example-profile",
resourceGroupName: example.name,
skuName: "Premium_AzureFrontDoor",
});
const exampleFrontdoorFirewallPolicy = new azure.cdn.FrontdoorFirewallPolicy("example", {
name: "examplecdnfdwafpolicy",
resourceGroupName: example.name,
skuName: exampleFrontdoorProfile.skuName,
enabled: true,
mode: "Prevention",
redirectUrl: "https://www.contoso.com",
customBlockResponseStatusCode: 403,
customBlockResponseBody: "PGh0bWw+CjxoZWFkZXI+PHRpdGxlPkhlbGxvPC90aXRsZT48L2hlYWRlcj4KPGJvZHk+CkhlbGxvIHdvcmxkCjwvYm9keT4KPC9odG1sPg==",
customRules: [
{
name: "Rule1",
enabled: true,
priority: 1,
rateLimitDurationInMinutes: 1,
rateLimitThreshold: 10,
type: "MatchRule",
action: "Block",
matchConditions: [{
matchVariable: "RemoteAddr",
operator: "IPMatch",
negationCondition: false,
matchValues: [
"10.0.1.0/24",
"10.0.0.0/24",
],
}],
},
{
name: "Rule2",
enabled: true,
priority: 2,
rateLimitDurationInMinutes: 1,
rateLimitThreshold: 10,
type: "MatchRule",
action: "Block",
matchConditions: [
{
matchVariable: "RemoteAddr",
operator: "IPMatch",
negationCondition: false,
matchValues: ["192.168.1.0/24"],
},
{
matchVariable: "RequestHeader",
selector: "UserAgent",
operator: "Contains",
negationCondition: false,
matchValues: ["windows"],
transforms: [
"Lowercase",
"Trim",
],
},
],
},
],
managedRules: [
{
type: "DefaultRuleSet",
version: "1.0",
exclusions: [{
matchVariable: "QueryStringArgNames",
operator: "Equals",
selector: "not_suspicious",
}],
overrides: [
{
ruleGroupName: "PHP",
rules: [{
ruleId: "933100",
enabled: false,
action: "Block",
}],
},
{
ruleGroupName: "SQLI",
exclusions: [{
matchVariable: "QueryStringArgNames",
operator: "Equals",
selector: "really_not_suspicious",
}],
rules: [{
ruleId: "942200",
action: "Block",
exclusions: [{
matchVariable: "QueryStringArgNames",
operator: "Equals",
selector: "innocent",
}],
}],
},
],
},
{
type: "Microsoft_BotManagerRuleSet",
version: "1.0",
action: "Log",
},
],
});
import pulumi
import pulumi_azure as azure
example = azure.core.ResourceGroup("example",
name="example-cdn-frontdoor",
location="West Europe")
example_frontdoor_profile = azure.cdn.FrontdoorProfile("example",
name="example-profile",
resource_group_name=example.name,
sku_name="Premium_AzureFrontDoor")
example_frontdoor_firewall_policy = azure.cdn.FrontdoorFirewallPolicy("example",
name="examplecdnfdwafpolicy",
resource_group_name=example.name,
sku_name=example_frontdoor_profile.sku_name,
enabled=True,
mode="Prevention",
redirect_url="https://www.contoso.com",
custom_block_response_status_code=403,
custom_block_response_body="PGh0bWw+CjxoZWFkZXI+PHRpdGxlPkhlbGxvPC90aXRsZT48L2hlYWRlcj4KPGJvZHk+CkhlbGxvIHdvcmxkCjwvYm9keT4KPC9odG1sPg==",
custom_rules=[
azure.cdn.FrontdoorFirewallPolicyCustomRuleArgs(
name="Rule1",
enabled=True,
priority=1,
rate_limit_duration_in_minutes=1,
rate_limit_threshold=10,
type="MatchRule",
action="Block",
match_conditions=[azure.cdn.FrontdoorFirewallPolicyCustomRuleMatchConditionArgs(
match_variable="RemoteAddr",
operator="IPMatch",
negation_condition=False,
match_values=[
"10.0.1.0/24",
"10.0.0.0/24",
],
)],
),
azure.cdn.FrontdoorFirewallPolicyCustomRuleArgs(
name="Rule2",
enabled=True,
priority=2,
rate_limit_duration_in_minutes=1,
rate_limit_threshold=10,
type="MatchRule",
action="Block",
match_conditions=[
azure.cdn.FrontdoorFirewallPolicyCustomRuleMatchConditionArgs(
match_variable="RemoteAddr",
operator="IPMatch",
negation_condition=False,
match_values=["192.168.1.0/24"],
),
azure.cdn.FrontdoorFirewallPolicyCustomRuleMatchConditionArgs(
match_variable="RequestHeader",
selector="UserAgent",
operator="Contains",
negation_condition=False,
match_values=["windows"],
transforms=[
"Lowercase",
"Trim",
],
),
],
),
],
managed_rules=[
azure.cdn.FrontdoorFirewallPolicyManagedRuleArgs(
type="DefaultRuleSet",
version="1.0",
exclusions=[azure.cdn.FrontdoorFirewallPolicyManagedRuleExclusionArgs(
match_variable="QueryStringArgNames",
operator="Equals",
selector="not_suspicious",
)],
overrides=[
azure.cdn.FrontdoorFirewallPolicyManagedRuleOverrideArgs(
rule_group_name="PHP",
rules=[azure.cdn.FrontdoorFirewallPolicyManagedRuleOverrideRuleArgs(
rule_id="933100",
enabled=False,
action="Block",
)],
),
azure.cdn.FrontdoorFirewallPolicyManagedRuleOverrideArgs(
rule_group_name="SQLI",
exclusions=[azure.cdn.FrontdoorFirewallPolicyManagedRuleOverrideExclusionArgs(
match_variable="QueryStringArgNames",
operator="Equals",
selector="really_not_suspicious",
)],
rules=[azure.cdn.FrontdoorFirewallPolicyManagedRuleOverrideRuleArgs(
rule_id="942200",
action="Block",
exclusions=[azure.cdn.FrontdoorFirewallPolicyManagedRuleOverrideRuleExclusionArgs(
match_variable="QueryStringArgNames",
operator="Equals",
selector="innocent",
)],
)],
),
],
),
azure.cdn.FrontdoorFirewallPolicyManagedRuleArgs(
type="Microsoft_BotManagerRuleSet",
version="1.0",
action="Log",
),
])
package main
import (
"github.com/pulumi/pulumi-azure/sdk/v5/go/azure/cdn"
"github.com/pulumi/pulumi-azure/sdk/v5/go/azure/core"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
example, err := core.NewResourceGroup(ctx, "example", &core.ResourceGroupArgs{
Name: pulumi.String("example-cdn-frontdoor"),
Location: pulumi.String("West Europe"),
})
if err != nil {
return err
}
exampleFrontdoorProfile, err := cdn.NewFrontdoorProfile(ctx, "example", &cdn.FrontdoorProfileArgs{
Name: pulumi.String("example-profile"),
ResourceGroupName: example.Name,
SkuName: pulumi.String("Premium_AzureFrontDoor"),
})
if err != nil {
return err
}
_, err = cdn.NewFrontdoorFirewallPolicy(ctx, "example", &cdn.FrontdoorFirewallPolicyArgs{
Name: pulumi.String("examplecdnfdwafpolicy"),
ResourceGroupName: example.Name,
SkuName: exampleFrontdoorProfile.SkuName,
Enabled: pulumi.Bool(true),
Mode: pulumi.String("Prevention"),
RedirectUrl: pulumi.String("https://www.contoso.com"),
CustomBlockResponseStatusCode: pulumi.Int(403),
CustomBlockResponseBody: pulumi.String("PGh0bWw+CjxoZWFkZXI+PHRpdGxlPkhlbGxvPC90aXRsZT48L2hlYWRlcj4KPGJvZHk+CkhlbGxvIHdvcmxkCjwvYm9keT4KPC9odG1sPg=="),
CustomRules: cdn.FrontdoorFirewallPolicyCustomRuleArray{
&cdn.FrontdoorFirewallPolicyCustomRuleArgs{
Name: pulumi.String("Rule1"),
Enabled: pulumi.Bool(true),
Priority: pulumi.Int(1),
RateLimitDurationInMinutes: pulumi.Int(1),
RateLimitThreshold: pulumi.Int(10),
Type: pulumi.String("MatchRule"),
Action: pulumi.String("Block"),
MatchConditions: cdn.FrontdoorFirewallPolicyCustomRuleMatchConditionArray{
&cdn.FrontdoorFirewallPolicyCustomRuleMatchConditionArgs{
MatchVariable: pulumi.String("RemoteAddr"),
Operator: pulumi.String("IPMatch"),
NegationCondition: pulumi.Bool(false),
MatchValues: pulumi.StringArray{
pulumi.String("10.0.1.0/24"),
pulumi.String("10.0.0.0/24"),
},
},
},
},
&cdn.FrontdoorFirewallPolicyCustomRuleArgs{
Name: pulumi.String("Rule2"),
Enabled: pulumi.Bool(true),
Priority: pulumi.Int(2),
RateLimitDurationInMinutes: pulumi.Int(1),
RateLimitThreshold: pulumi.Int(10),
Type: pulumi.String("MatchRule"),
Action: pulumi.String("Block"),
MatchConditions: cdn.FrontdoorFirewallPolicyCustomRuleMatchConditionArray{
&cdn.FrontdoorFirewallPolicyCustomRuleMatchConditionArgs{
MatchVariable: pulumi.String("RemoteAddr"),
Operator: pulumi.String("IPMatch"),
NegationCondition: pulumi.Bool(false),
MatchValues: pulumi.StringArray{
pulumi.String("192.168.1.0/24"),
},
},
&cdn.FrontdoorFirewallPolicyCustomRuleMatchConditionArgs{
MatchVariable: pulumi.String("RequestHeader"),
Selector: pulumi.String("UserAgent"),
Operator: pulumi.String("Contains"),
NegationCondition: pulumi.Bool(false),
MatchValues: pulumi.StringArray{
pulumi.String("windows"),
},
Transforms: pulumi.StringArray{
pulumi.String("Lowercase"),
pulumi.String("Trim"),
},
},
},
},
},
ManagedRules: cdn.FrontdoorFirewallPolicyManagedRuleArray{
&cdn.FrontdoorFirewallPolicyManagedRuleArgs{
Type: pulumi.String("DefaultRuleSet"),
Version: pulumi.String("1.0"),
Exclusions: cdn.FrontdoorFirewallPolicyManagedRuleExclusionArray{
&cdn.FrontdoorFirewallPolicyManagedRuleExclusionArgs{
MatchVariable: pulumi.String("QueryStringArgNames"),
Operator: pulumi.String("Equals"),
Selector: pulumi.String("not_suspicious"),
},
},
Overrides: cdn.FrontdoorFirewallPolicyManagedRuleOverrideArray{
&cdn.FrontdoorFirewallPolicyManagedRuleOverrideArgs{
RuleGroupName: pulumi.String("PHP"),
Rules: cdn.FrontdoorFirewallPolicyManagedRuleOverrideRuleArray{
&cdn.FrontdoorFirewallPolicyManagedRuleOverrideRuleArgs{
RuleId: pulumi.String("933100"),
Enabled: pulumi.Bool(false),
Action: pulumi.String("Block"),
},
},
},
&cdn.FrontdoorFirewallPolicyManagedRuleOverrideArgs{
RuleGroupName: pulumi.String("SQLI"),
Exclusions: cdn.FrontdoorFirewallPolicyManagedRuleOverrideExclusionArray{
&cdn.FrontdoorFirewallPolicyManagedRuleOverrideExclusionArgs{
MatchVariable: pulumi.String("QueryStringArgNames"),
Operator: pulumi.String("Equals"),
Selector: pulumi.String("really_not_suspicious"),
},
},
Rules: cdn.FrontdoorFirewallPolicyManagedRuleOverrideRuleArray{
&cdn.FrontdoorFirewallPolicyManagedRuleOverrideRuleArgs{
RuleId: pulumi.String("942200"),
Action: pulumi.String("Block"),
Exclusions: cdn.FrontdoorFirewallPolicyManagedRuleOverrideRuleExclusionArray{
&cdn.FrontdoorFirewallPolicyManagedRuleOverrideRuleExclusionArgs{
MatchVariable: pulumi.String("QueryStringArgNames"),
Operator: pulumi.String("Equals"),
Selector: pulumi.String("innocent"),
},
},
},
},
},
},
},
&cdn.FrontdoorFirewallPolicyManagedRuleArgs{
Type: pulumi.String("Microsoft_BotManagerRuleSet"),
Version: pulumi.String("1.0"),
Action: pulumi.String("Log"),
},
},
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Azure = Pulumi.Azure;
return await Deployment.RunAsync(() =>
{
var example = new Azure.Core.ResourceGroup("example", new()
{
Name = "example-cdn-frontdoor",
Location = "West Europe",
});
var exampleFrontdoorProfile = new Azure.Cdn.FrontdoorProfile("example", new()
{
Name = "example-profile",
ResourceGroupName = example.Name,
SkuName = "Premium_AzureFrontDoor",
});
var exampleFrontdoorFirewallPolicy = new Azure.Cdn.FrontdoorFirewallPolicy("example", new()
{
Name = "examplecdnfdwafpolicy",
ResourceGroupName = example.Name,
SkuName = exampleFrontdoorProfile.SkuName,
Enabled = true,
Mode = "Prevention",
RedirectUrl = "https://www.contoso.com",
CustomBlockResponseStatusCode = 403,
CustomBlockResponseBody = "PGh0bWw+CjxoZWFkZXI+PHRpdGxlPkhlbGxvPC90aXRsZT48L2hlYWRlcj4KPGJvZHk+CkhlbGxvIHdvcmxkCjwvYm9keT4KPC9odG1sPg==",
CustomRules = new[]
{
new Azure.Cdn.Inputs.FrontdoorFirewallPolicyCustomRuleArgs
{
Name = "Rule1",
Enabled = true,
Priority = 1,
RateLimitDurationInMinutes = 1,
RateLimitThreshold = 10,
Type = "MatchRule",
Action = "Block",
MatchConditions = new[]
{
new Azure.Cdn.Inputs.FrontdoorFirewallPolicyCustomRuleMatchConditionArgs
{
MatchVariable = "RemoteAddr",
Operator = "IPMatch",
NegationCondition = false,
MatchValues = new[]
{
"10.0.1.0/24",
"10.0.0.0/24",
},
},
},
},
new Azure.Cdn.Inputs.FrontdoorFirewallPolicyCustomRuleArgs
{
Name = "Rule2",
Enabled = true,
Priority = 2,
RateLimitDurationInMinutes = 1,
RateLimitThreshold = 10,
Type = "MatchRule",
Action = "Block",
MatchConditions = new[]
{
new Azure.Cdn.Inputs.FrontdoorFirewallPolicyCustomRuleMatchConditionArgs
{
MatchVariable = "RemoteAddr",
Operator = "IPMatch",
NegationCondition = false,
MatchValues = new[]
{
"192.168.1.0/24",
},
},
new Azure.Cdn.Inputs.FrontdoorFirewallPolicyCustomRuleMatchConditionArgs
{
MatchVariable = "RequestHeader",
Selector = "UserAgent",
Operator = "Contains",
NegationCondition = false,
MatchValues = new[]
{
"windows",
},
Transforms = new[]
{
"Lowercase",
"Trim",
},
},
},
},
},
ManagedRules = new[]
{
new Azure.Cdn.Inputs.FrontdoorFirewallPolicyManagedRuleArgs
{
Type = "DefaultRuleSet",
Version = "1.0",
Exclusions = new[]
{
new Azure.Cdn.Inputs.FrontdoorFirewallPolicyManagedRuleExclusionArgs
{
MatchVariable = "QueryStringArgNames",
Operator = "Equals",
Selector = "not_suspicious",
},
},
Overrides = new[]
{
new Azure.Cdn.Inputs.FrontdoorFirewallPolicyManagedRuleOverrideArgs
{
RuleGroupName = "PHP",
Rules = new[]
{
new Azure.Cdn.Inputs.FrontdoorFirewallPolicyManagedRuleOverrideRuleArgs
{
RuleId = "933100",
Enabled = false,
Action = "Block",
},
},
},
new Azure.Cdn.Inputs.FrontdoorFirewallPolicyManagedRuleOverrideArgs
{
RuleGroupName = "SQLI",
Exclusions = new[]
{
new Azure.Cdn.Inputs.FrontdoorFirewallPolicyManagedRuleOverrideExclusionArgs
{
MatchVariable = "QueryStringArgNames",
Operator = "Equals",
Selector = "really_not_suspicious",
},
},
Rules = new[]
{
new Azure.Cdn.Inputs.FrontdoorFirewallPolicyManagedRuleOverrideRuleArgs
{
RuleId = "942200",
Action = "Block",
Exclusions = new[]
{
new Azure.Cdn.Inputs.FrontdoorFirewallPolicyManagedRuleOverrideRuleExclusionArgs
{
MatchVariable = "QueryStringArgNames",
Operator = "Equals",
Selector = "innocent",
},
},
},
},
},
},
},
new Azure.Cdn.Inputs.FrontdoorFirewallPolicyManagedRuleArgs
{
Type = "Microsoft_BotManagerRuleSet",
Version = "1.0",
Action = "Log",
},
},
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azure.core.ResourceGroup;
import com.pulumi.azure.core.ResourceGroupArgs;
import com.pulumi.azure.cdn.FrontdoorProfile;
import com.pulumi.azure.cdn.FrontdoorProfileArgs;
import com.pulumi.azure.cdn.FrontdoorFirewallPolicy;
import com.pulumi.azure.cdn.FrontdoorFirewallPolicyArgs;
import com.pulumi.azure.cdn.inputs.FrontdoorFirewallPolicyCustomRuleArgs;
import com.pulumi.azure.cdn.inputs.FrontdoorFirewallPolicyManagedRuleArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var example = new ResourceGroup("example", ResourceGroupArgs.builder()
.name("example-cdn-frontdoor")
.location("West Europe")
.build());
var exampleFrontdoorProfile = new FrontdoorProfile("exampleFrontdoorProfile", FrontdoorProfileArgs.builder()
.name("example-profile")
.resourceGroupName(example.name())
.skuName("Premium_AzureFrontDoor")
.build());
var exampleFrontdoorFirewallPolicy = new FrontdoorFirewallPolicy("exampleFrontdoorFirewallPolicy", FrontdoorFirewallPolicyArgs.builder()
.name("examplecdnfdwafpolicy")
.resourceGroupName(example.name())
.skuName(exampleFrontdoorProfile.skuName())
.enabled(true)
.mode("Prevention")
.redirectUrl("https://www.contoso.com")
.customBlockResponseStatusCode(403)
.customBlockResponseBody("PGh0bWw+CjxoZWFkZXI+PHRpdGxlPkhlbGxvPC90aXRsZT48L2hlYWRlcj4KPGJvZHk+CkhlbGxvIHdvcmxkCjwvYm9keT4KPC9odG1sPg==")
.customRules(
FrontdoorFirewallPolicyCustomRuleArgs.builder()
.name("Rule1")
.enabled(true)
.priority(1)
.rateLimitDurationInMinutes(1)
.rateLimitThreshold(10)
.type("MatchRule")
.action("Block")
.matchConditions(FrontdoorFirewallPolicyCustomRuleMatchConditionArgs.builder()
.matchVariable("RemoteAddr")
.operator("IPMatch")
.negationCondition(false)
.matchValues(
"10.0.1.0/24",
"10.0.0.0/24")
.build())
.build(),
FrontdoorFirewallPolicyCustomRuleArgs.builder()
.name("Rule2")
.enabled(true)
.priority(2)
.rateLimitDurationInMinutes(1)
.rateLimitThreshold(10)
.type("MatchRule")
.action("Block")
.matchConditions(
FrontdoorFirewallPolicyCustomRuleMatchConditionArgs.builder()
.matchVariable("RemoteAddr")
.operator("IPMatch")
.negationCondition(false)
.matchValues("192.168.1.0/24")
.build(),
FrontdoorFirewallPolicyCustomRuleMatchConditionArgs.builder()
.matchVariable("RequestHeader")
.selector("UserAgent")
.operator("Contains")
.negationCondition(false)
.matchValues("windows")
.transforms(
"Lowercase",
"Trim")
.build())
.build())
.managedRules(
FrontdoorFirewallPolicyManagedRuleArgs.builder()
.type("DefaultRuleSet")
.version("1.0")
.exclusions(FrontdoorFirewallPolicyManagedRuleExclusionArgs.builder()
.matchVariable("QueryStringArgNames")
.operator("Equals")
.selector("not_suspicious")
.build())
.overrides(
FrontdoorFirewallPolicyManagedRuleOverrideArgs.builder()
.ruleGroupName("PHP")
.rules(FrontdoorFirewallPolicyManagedRuleOverrideRuleArgs.builder()
.ruleId("933100")
.enabled(false)
.action("Block")
.build())
.build(),
FrontdoorFirewallPolicyManagedRuleOverrideArgs.builder()
.ruleGroupName("SQLI")
.exclusions(FrontdoorFirewallPolicyManagedRuleOverrideExclusionArgs.builder()
.matchVariable("QueryStringArgNames")
.operator("Equals")
.selector("really_not_suspicious")
.build())
.rules(FrontdoorFirewallPolicyManagedRuleOverrideRuleArgs.builder()
.ruleId("942200")
.action("Block")
.exclusions(FrontdoorFirewallPolicyManagedRuleOverrideRuleExclusionArgs.builder()
.matchVariable("QueryStringArgNames")
.operator("Equals")
.selector("innocent")
.build())
.build())
.build())
.build(),
FrontdoorFirewallPolicyManagedRuleArgs.builder()
.type("Microsoft_BotManagerRuleSet")
.version("1.0")
.action("Log")
.build())
.build());
}
}
resources:
example:
type: azure:core:ResourceGroup
properties:
name: example-cdn-frontdoor
location: West Europe
exampleFrontdoorProfile:
type: azure:cdn:FrontdoorProfile
name: example
properties:
name: example-profile
resourceGroupName: ${example.name}
skuName: Premium_AzureFrontDoor
exampleFrontdoorFirewallPolicy:
type: azure:cdn:FrontdoorFirewallPolicy
name: example
properties:
name: examplecdnfdwafpolicy
resourceGroupName: ${example.name}
skuName: ${exampleFrontdoorProfile.skuName}
enabled: true
mode: Prevention
redirectUrl: https://www.contoso.com
customBlockResponseStatusCode: 403
customBlockResponseBody: PGh0bWw+CjxoZWFkZXI+PHRpdGxlPkhlbGxvPC90aXRsZT48L2hlYWRlcj4KPGJvZHk+CkhlbGxvIHdvcmxkCjwvYm9keT4KPC9odG1sPg==
customRules:
- name: Rule1
enabled: true
priority: 1
rateLimitDurationInMinutes: 1
rateLimitThreshold: 10
type: MatchRule
action: Block
matchConditions:
- matchVariable: RemoteAddr
operator: IPMatch
negationCondition: false
matchValues:
- 10.0.1.0/24
- 10.0.0.0/24
- name: Rule2
enabled: true
priority: 2
rateLimitDurationInMinutes: 1
rateLimitThreshold: 10
type: MatchRule
action: Block
matchConditions:
- matchVariable: RemoteAddr
operator: IPMatch
negationCondition: false
matchValues:
- 192.168.1.0/24
- matchVariable: RequestHeader
selector: UserAgent
operator: Contains
negationCondition: false
matchValues:
- windows
transforms:
- Lowercase
- Trim
managedRules:
- type: DefaultRuleSet
version: '1.0'
exclusions:
- matchVariable: QueryStringArgNames
operator: Equals
selector: not_suspicious
overrides:
- ruleGroupName: PHP
rules:
- ruleId: '933100'
enabled: false
action: Block
- ruleGroupName: SQLI
exclusions:
- matchVariable: QueryStringArgNames
operator: Equals
selector: really_not_suspicious
rules:
- ruleId: '942200'
action: Block
exclusions:
- matchVariable: QueryStringArgNames
operator: Equals
selector: innocent
- type: Microsoft_BotManagerRuleSet
version: '1.0'
action: Log
Create FrontdoorFirewallPolicy Resource
Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.
Constructor syntax
new FrontdoorFirewallPolicy(name: string, args: FrontdoorFirewallPolicyArgs, opts?: CustomResourceOptions);@overload
def FrontdoorFirewallPolicy(resource_name: str,
args: FrontdoorFirewallPolicyArgs,
opts: Optional[ResourceOptions] = None)
@overload
def FrontdoorFirewallPolicy(resource_name: str,
opts: Optional[ResourceOptions] = None,
mode: Optional[str] = None,
resource_group_name: Optional[str] = None,
sku_name: Optional[str] = None,
custom_block_response_body: Optional[str] = None,
custom_block_response_status_code: Optional[int] = None,
custom_rules: Optional[Sequence[FrontdoorFirewallPolicyCustomRuleArgs]] = None,
enabled: Optional[bool] = None,
managed_rules: Optional[Sequence[FrontdoorFirewallPolicyManagedRuleArgs]] = None,
name: Optional[str] = None,
redirect_url: Optional[str] = None,
request_body_check_enabled: Optional[bool] = None,
tags: Optional[Mapping[str, str]] = None)func NewFrontdoorFirewallPolicy(ctx *Context, name string, args FrontdoorFirewallPolicyArgs, opts ...ResourceOption) (*FrontdoorFirewallPolicy, error)public FrontdoorFirewallPolicy(string name, FrontdoorFirewallPolicyArgs args, CustomResourceOptions? opts = null)
public FrontdoorFirewallPolicy(String name, FrontdoorFirewallPolicyArgs args)
public FrontdoorFirewallPolicy(String name, FrontdoorFirewallPolicyArgs args, CustomResourceOptions options)
type: azure:cdn:FrontdoorFirewallPolicy
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.
Parameters
- name string
- The unique name of the resource.
- args FrontdoorFirewallPolicyArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- resource_name str
- The unique name of the resource.
- args FrontdoorFirewallPolicyArgs
- The arguments to resource properties.
- opts ResourceOptions
- Bag of options to control resource's behavior.
- ctx Context
- Context object for the current deployment.
- name string
- The unique name of the resource.
- args FrontdoorFirewallPolicyArgs
- The arguments to resource properties.
- opts ResourceOption
- Bag of options to control resource's behavior.
- name string
- The unique name of the resource.
- args FrontdoorFirewallPolicyArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- name String
- The unique name of the resource.
- args FrontdoorFirewallPolicyArgs
- The arguments to resource properties.
- options CustomResourceOptions
- Bag of options to control resource's behavior.
Example
The following reference example uses placeholder values for all input properties.
var frontdoorFirewallPolicyResource = new Azure.Cdn.FrontdoorFirewallPolicy("frontdoorFirewallPolicyResource", new()
{
Mode = "string",
ResourceGroupName = "string",
SkuName = "string",
CustomBlockResponseBody = "string",
CustomBlockResponseStatusCode = 0,
CustomRules = new[]
{
new Azure.Cdn.Inputs.FrontdoorFirewallPolicyCustomRuleArgs
{
Action = "string",
Name = "string",
Type = "string",
Enabled = false,
MatchConditions = new[]
{
new Azure.Cdn.Inputs.FrontdoorFirewallPolicyCustomRuleMatchConditionArgs
{
MatchValues = new[]
{
"string",
},
MatchVariable = "string",
Operator = "string",
NegationCondition = false,
Selector = "string",
Transforms = new[]
{
"string",
},
},
},
Priority = 0,
RateLimitDurationInMinutes = 0,
RateLimitThreshold = 0,
},
},
Enabled = false,
ManagedRules = new[]
{
new Azure.Cdn.Inputs.FrontdoorFirewallPolicyManagedRuleArgs
{
Action = "string",
Type = "string",
Version = "string",
Exclusions = new[]
{
new Azure.Cdn.Inputs.FrontdoorFirewallPolicyManagedRuleExclusionArgs
{
MatchVariable = "string",
Operator = "string",
Selector = "string",
},
},
Overrides = new[]
{
new Azure.Cdn.Inputs.FrontdoorFirewallPolicyManagedRuleOverrideArgs
{
RuleGroupName = "string",
Exclusions = new[]
{
new Azure.Cdn.Inputs.FrontdoorFirewallPolicyManagedRuleOverrideExclusionArgs
{
MatchVariable = "string",
Operator = "string",
Selector = "string",
},
},
Rules = new[]
{
new Azure.Cdn.Inputs.FrontdoorFirewallPolicyManagedRuleOverrideRuleArgs
{
Action = "string",
RuleId = "string",
Enabled = false,
Exclusions = new[]
{
new Azure.Cdn.Inputs.FrontdoorFirewallPolicyManagedRuleOverrideRuleExclusionArgs
{
MatchVariable = "string",
Operator = "string",
Selector = "string",
},
},
},
},
},
},
},
},
Name = "string",
RedirectUrl = "string",
RequestBodyCheckEnabled = false,
Tags =
{
{ "string", "string" },
},
});
example, err := cdn.NewFrontdoorFirewallPolicy(ctx, "frontdoorFirewallPolicyResource", &cdn.FrontdoorFirewallPolicyArgs{
Mode: pulumi.String("string"),
ResourceGroupName: pulumi.String("string"),
SkuName: pulumi.String("string"),
CustomBlockResponseBody: pulumi.String("string"),
CustomBlockResponseStatusCode: pulumi.Int(0),
CustomRules: cdn.FrontdoorFirewallPolicyCustomRuleArray{
&cdn.FrontdoorFirewallPolicyCustomRuleArgs{
Action: pulumi.String("string"),
Name: pulumi.String("string"),
Type: pulumi.String("string"),
Enabled: pulumi.Bool(false),
MatchConditions: cdn.FrontdoorFirewallPolicyCustomRuleMatchConditionArray{
&cdn.FrontdoorFirewallPolicyCustomRuleMatchConditionArgs{
MatchValues: pulumi.StringArray{
pulumi.String("string"),
},
MatchVariable: pulumi.String("string"),
Operator: pulumi.String("string"),
NegationCondition: pulumi.Bool(false),
Selector: pulumi.String("string"),
Transforms: pulumi.StringArray{
pulumi.String("string"),
},
},
},
Priority: pulumi.Int(0),
RateLimitDurationInMinutes: pulumi.Int(0),
RateLimitThreshold: pulumi.Int(0),
},
},
Enabled: pulumi.Bool(false),
ManagedRules: cdn.FrontdoorFirewallPolicyManagedRuleArray{
&cdn.FrontdoorFirewallPolicyManagedRuleArgs{
Action: pulumi.String("string"),
Type: pulumi.String("string"),
Version: pulumi.String("string"),
Exclusions: cdn.FrontdoorFirewallPolicyManagedRuleExclusionArray{
&cdn.FrontdoorFirewallPolicyManagedRuleExclusionArgs{
MatchVariable: pulumi.String("string"),
Operator: pulumi.String("string"),
Selector: pulumi.String("string"),
},
},
Overrides: cdn.FrontdoorFirewallPolicyManagedRuleOverrideArray{
&cdn.FrontdoorFirewallPolicyManagedRuleOverrideArgs{
RuleGroupName: pulumi.String("string"),
Exclusions: cdn.FrontdoorFirewallPolicyManagedRuleOverrideExclusionArray{
&cdn.FrontdoorFirewallPolicyManagedRuleOverrideExclusionArgs{
MatchVariable: pulumi.String("string"),
Operator: pulumi.String("string"),
Selector: pulumi.String("string"),
},
},
Rules: cdn.FrontdoorFirewallPolicyManagedRuleOverrideRuleArray{
&cdn.FrontdoorFirewallPolicyManagedRuleOverrideRuleArgs{
Action: pulumi.String("string"),
RuleId: pulumi.String("string"),
Enabled: pulumi.Bool(false),
Exclusions: cdn.FrontdoorFirewallPolicyManagedRuleOverrideRuleExclusionArray{
&cdn.FrontdoorFirewallPolicyManagedRuleOverrideRuleExclusionArgs{
MatchVariable: pulumi.String("string"),
Operator: pulumi.String("string"),
Selector: pulumi.String("string"),
},
},
},
},
},
},
},
},
Name: pulumi.String("string"),
RedirectUrl: pulumi.String("string"),
RequestBodyCheckEnabled: pulumi.Bool(false),
Tags: pulumi.StringMap{
"string": pulumi.String("string"),
},
})
var frontdoorFirewallPolicyResource = new FrontdoorFirewallPolicy("frontdoorFirewallPolicyResource", FrontdoorFirewallPolicyArgs.builder()
.mode("string")
.resourceGroupName("string")
.skuName("string")
.customBlockResponseBody("string")
.customBlockResponseStatusCode(0)
.customRules(FrontdoorFirewallPolicyCustomRuleArgs.builder()
.action("string")
.name("string")
.type("string")
.enabled(false)
.matchConditions(FrontdoorFirewallPolicyCustomRuleMatchConditionArgs.builder()
.matchValues("string")
.matchVariable("string")
.operator("string")
.negationCondition(false)
.selector("string")
.transforms("string")
.build())
.priority(0)
.rateLimitDurationInMinutes(0)
.rateLimitThreshold(0)
.build())
.enabled(false)
.managedRules(FrontdoorFirewallPolicyManagedRuleArgs.builder()
.action("string")
.type("string")
.version("string")
.exclusions(FrontdoorFirewallPolicyManagedRuleExclusionArgs.builder()
.matchVariable("string")
.operator("string")
.selector("string")
.build())
.overrides(FrontdoorFirewallPolicyManagedRuleOverrideArgs.builder()
.ruleGroupName("string")
.exclusions(FrontdoorFirewallPolicyManagedRuleOverrideExclusionArgs.builder()
.matchVariable("string")
.operator("string")
.selector("string")
.build())
.rules(FrontdoorFirewallPolicyManagedRuleOverrideRuleArgs.builder()
.action("string")
.ruleId("string")
.enabled(false)
.exclusions(FrontdoorFirewallPolicyManagedRuleOverrideRuleExclusionArgs.builder()
.matchVariable("string")
.operator("string")
.selector("string")
.build())
.build())
.build())
.build())
.name("string")
.redirectUrl("string")
.requestBodyCheckEnabled(false)
.tags(Map.of("string", "string"))
.build());
frontdoor_firewall_policy_resource = azure.cdn.FrontdoorFirewallPolicy("frontdoorFirewallPolicyResource",
mode="string",
resource_group_name="string",
sku_name="string",
custom_block_response_body="string",
custom_block_response_status_code=0,
custom_rules=[azure.cdn.FrontdoorFirewallPolicyCustomRuleArgs(
action="string",
name="string",
type="string",
enabled=False,
match_conditions=[azure.cdn.FrontdoorFirewallPolicyCustomRuleMatchConditionArgs(
match_values=["string"],
match_variable="string",
operator="string",
negation_condition=False,
selector="string",
transforms=["string"],
)],
priority=0,
rate_limit_duration_in_minutes=0,
rate_limit_threshold=0,
)],
enabled=False,
managed_rules=[azure.cdn.FrontdoorFirewallPolicyManagedRuleArgs(
action="string",
type="string",
version="string",
exclusions=[azure.cdn.FrontdoorFirewallPolicyManagedRuleExclusionArgs(
match_variable="string",
operator="string",
selector="string",
)],
overrides=[azure.cdn.FrontdoorFirewallPolicyManagedRuleOverrideArgs(
rule_group_name="string",
exclusions=[azure.cdn.FrontdoorFirewallPolicyManagedRuleOverrideExclusionArgs(
match_variable="string",
operator="string",
selector="string",
)],
rules=[azure.cdn.FrontdoorFirewallPolicyManagedRuleOverrideRuleArgs(
action="string",
rule_id="string",
enabled=False,
exclusions=[azure.cdn.FrontdoorFirewallPolicyManagedRuleOverrideRuleExclusionArgs(
match_variable="string",
operator="string",
selector="string",
)],
)],
)],
)],
name="string",
redirect_url="string",
request_body_check_enabled=False,
tags={
"string": "string",
})
const frontdoorFirewallPolicyResource = new azure.cdn.FrontdoorFirewallPolicy("frontdoorFirewallPolicyResource", {
mode: "string",
resourceGroupName: "string",
skuName: "string",
customBlockResponseBody: "string",
customBlockResponseStatusCode: 0,
customRules: [{
action: "string",
name: "string",
type: "string",
enabled: false,
matchConditions: [{
matchValues: ["string"],
matchVariable: "string",
operator: "string",
negationCondition: false,
selector: "string",
transforms: ["string"],
}],
priority: 0,
rateLimitDurationInMinutes: 0,
rateLimitThreshold: 0,
}],
enabled: false,
managedRules: [{
action: "string",
type: "string",
version: "string",
exclusions: [{
matchVariable: "string",
operator: "string",
selector: "string",
}],
overrides: [{
ruleGroupName: "string",
exclusions: [{
matchVariable: "string",
operator: "string",
selector: "string",
}],
rules: [{
action: "string",
ruleId: "string",
enabled: false,
exclusions: [{
matchVariable: "string",
operator: "string",
selector: "string",
}],
}],
}],
}],
name: "string",
redirectUrl: "string",
requestBodyCheckEnabled: false,
tags: {
string: "string",
},
});
type: azure:cdn:FrontdoorFirewallPolicy
properties:
customBlockResponseBody: string
customBlockResponseStatusCode: 0
customRules:
- action: string
enabled: false
matchConditions:
- matchValues:
- string
matchVariable: string
negationCondition: false
operator: string
selector: string
transforms:
- string
name: string
priority: 0
rateLimitDurationInMinutes: 0
rateLimitThreshold: 0
type: string
enabled: false
managedRules:
- action: string
exclusions:
- matchVariable: string
operator: string
selector: string
overrides:
- exclusions:
- matchVariable: string
operator: string
selector: string
ruleGroupName: string
rules:
- action: string
enabled: false
exclusions:
- matchVariable: string
operator: string
selector: string
ruleId: string
type: string
version: string
mode: string
name: string
redirectUrl: string
requestBodyCheckEnabled: false
resourceGroupName: string
skuName: string
tags:
string: string
FrontdoorFirewallPolicy Resource Properties
To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.
Inputs
The FrontdoorFirewallPolicy resource accepts the following input properties:
- Mode string
- The Front Door Firewall Policy mode. Possible values are
Detection,Prevention. - Resource
Group stringName - The name of the resource group. Changing this forces a new resource to be created.
- Sku
Name string The sku's pricing tier for this Front Door Firewall Policy. Possible values include
Standard_AzureFrontDoororPremium_AzureFrontDoor. Changing this forces a new resource to be created.NOTE: The
Standard_AzureFrontDoorFront Door Firewall Policy sku may containcustomrules only. ThePremium_AzureFrontDoorFront Door Firewall Policy skus may contain bothcustomandmanagedrules.- Custom
Block stringResponse Body - If a
custom_ruleblock's action type isblock, this is the response body. The body must be specified in base64 encoding. - Custom
Block intResponse Status Code - If a
custom_ruleblock's action type isblock, this is the response status code. Possible values are200,403,405,406, or429. - Custom
Rules List<FrontdoorFirewall Policy Custom Rule> - One or more
custom_ruleblocks as defined below. - Enabled bool
- Is the Front Door Firewall Policy enabled? Defaults to
true. - Managed
Rules List<FrontdoorFirewall Policy Managed Rule> - One or more
managed_ruleblocks as defined below. - Name string
- The name of the policy. Changing this forces a new resource to be created.
- Redirect
Url string - If action type is redirect, this field represents redirect URL for the client.
- Request
Body boolCheck Enabled Should policy managed rules inspect the request body content? Defaults to
true.NOTE: When run in
Detectionmode, the Front Door Firewall Policy doesn't take any other actions other than monitoring and logging the request and its matched Front Door Rule to the Web Application Firewall logs.- Dictionary<string, string>
- A mapping of tags to assign to the Front Door Firewall Policy.
- Mode string
- The Front Door Firewall Policy mode. Possible values are
Detection,Prevention. - Resource
Group stringName - The name of the resource group. Changing this forces a new resource to be created.
- Sku
Name string The sku's pricing tier for this Front Door Firewall Policy. Possible values include
Standard_AzureFrontDoororPremium_AzureFrontDoor. Changing this forces a new resource to be created.NOTE: The
Standard_AzureFrontDoorFront Door Firewall Policy sku may containcustomrules only. ThePremium_AzureFrontDoorFront Door Firewall Policy skus may contain bothcustomandmanagedrules.- Custom
Block stringResponse Body - If a
custom_ruleblock's action type isblock, this is the response body. The body must be specified in base64 encoding. - Custom
Block intResponse Status Code - If a
custom_ruleblock's action type isblock, this is the response status code. Possible values are200,403,405,406, or429. - Custom
Rules []FrontdoorFirewall Policy Custom Rule Args - One or more
custom_ruleblocks as defined below. - Enabled bool
- Is the Front Door Firewall Policy enabled? Defaults to
true. - Managed
Rules []FrontdoorFirewall Policy Managed Rule Args - One or more
managed_ruleblocks as defined below. - Name string
- The name of the policy. Changing this forces a new resource to be created.
- Redirect
Url string - If action type is redirect, this field represents redirect URL for the client.
- Request
Body boolCheck Enabled Should policy managed rules inspect the request body content? Defaults to
true.NOTE: When run in
Detectionmode, the Front Door Firewall Policy doesn't take any other actions other than monitoring and logging the request and its matched Front Door Rule to the Web Application Firewall logs.- map[string]string
- A mapping of tags to assign to the Front Door Firewall Policy.
- mode String
- The Front Door Firewall Policy mode. Possible values are
Detection,Prevention. - resource
Group StringName - The name of the resource group. Changing this forces a new resource to be created.
- sku
Name String The sku's pricing tier for this Front Door Firewall Policy. Possible values include
Standard_AzureFrontDoororPremium_AzureFrontDoor. Changing this forces a new resource to be created.NOTE: The
Standard_AzureFrontDoorFront Door Firewall Policy sku may containcustomrules only. ThePremium_AzureFrontDoorFront Door Firewall Policy skus may contain bothcustomandmanagedrules.- custom
Block StringResponse Body - If a
custom_ruleblock's action type isblock, this is the response body. The body must be specified in base64 encoding. - custom
Block IntegerResponse Status Code - If a
custom_ruleblock's action type isblock, this is the response status code. Possible values are200,403,405,406, or429. - custom
Rules List<FrontdoorFirewall Policy Custom Rule> - One or more
custom_ruleblocks as defined below. - enabled Boolean
- Is the Front Door Firewall Policy enabled? Defaults to
true. - managed
Rules List<FrontdoorFirewall Policy Managed Rule> - One or more
managed_ruleblocks as defined below. - name String
- The name of the policy. Changing this forces a new resource to be created.
- redirect
Url String - If action type is redirect, this field represents redirect URL for the client.
- request
Body BooleanCheck Enabled Should policy managed rules inspect the request body content? Defaults to
true.NOTE: When run in
Detectionmode, the Front Door Firewall Policy doesn't take any other actions other than monitoring and logging the request and its matched Front Door Rule to the Web Application Firewall logs.- Map<String,String>
- A mapping of tags to assign to the Front Door Firewall Policy.
- mode string
- The Front Door Firewall Policy mode. Possible values are
Detection,Prevention. - resource
Group stringName - The name of the resource group. Changing this forces a new resource to be created.
- sku
Name string The sku's pricing tier for this Front Door Firewall Policy. Possible values include
Standard_AzureFrontDoororPremium_AzureFrontDoor. Changing this forces a new resource to be created.NOTE: The
Standard_AzureFrontDoorFront Door Firewall Policy sku may containcustomrules only. ThePremium_AzureFrontDoorFront Door Firewall Policy skus may contain bothcustomandmanagedrules.- custom
Block stringResponse Body - If a
custom_ruleblock's action type isblock, this is the response body. The body must be specified in base64 encoding. - custom
Block numberResponse Status Code - If a
custom_ruleblock's action type isblock, this is the response status code. Possible values are200,403,405,406, or429. - custom
Rules FrontdoorFirewall Policy Custom Rule[] - One or more
custom_ruleblocks as defined below. - enabled boolean
- Is the Front Door Firewall Policy enabled? Defaults to
true. - managed
Rules FrontdoorFirewall Policy Managed Rule[] - One or more
managed_ruleblocks as defined below. - name string
- The name of the policy. Changing this forces a new resource to be created.
- redirect
Url string - If action type is redirect, this field represents redirect URL for the client.
- request
Body booleanCheck Enabled Should policy managed rules inspect the request body content? Defaults to
true.NOTE: When run in
Detectionmode, the Front Door Firewall Policy doesn't take any other actions other than monitoring and logging the request and its matched Front Door Rule to the Web Application Firewall logs.- {[key: string]: string}
- A mapping of tags to assign to the Front Door Firewall Policy.
- mode str
- The Front Door Firewall Policy mode. Possible values are
Detection,Prevention. - resource_
group_ strname - The name of the resource group. Changing this forces a new resource to be created.
- sku_
name str The sku's pricing tier for this Front Door Firewall Policy. Possible values include
Standard_AzureFrontDoororPremium_AzureFrontDoor. Changing this forces a new resource to be created.NOTE: The
Standard_AzureFrontDoorFront Door Firewall Policy sku may containcustomrules only. ThePremium_AzureFrontDoorFront Door Firewall Policy skus may contain bothcustomandmanagedrules.- custom_
block_ strresponse_ body - If a
custom_ruleblock's action type isblock, this is the response body. The body must be specified in base64 encoding. - custom_
block_ intresponse_ status_ code - If a
custom_ruleblock's action type isblock, this is the response status code. Possible values are200,403,405,406, or429. - custom_
rules Sequence[FrontdoorFirewall Policy Custom Rule Args] - One or more
custom_ruleblocks as defined below. - enabled bool
- Is the Front Door Firewall Policy enabled? Defaults to
true. - managed_
rules Sequence[FrontdoorFirewall Policy Managed Rule Args] - One or more
managed_ruleblocks as defined below. - name str
- The name of the policy. Changing this forces a new resource to be created.
- redirect_
url str - If action type is redirect, this field represents redirect URL for the client.
- request_
body_ boolcheck_ enabled Should policy managed rules inspect the request body content? Defaults to
true.NOTE: When run in
Detectionmode, the Front Door Firewall Policy doesn't take any other actions other than monitoring and logging the request and its matched Front Door Rule to the Web Application Firewall logs.- Mapping[str, str]
- A mapping of tags to assign to the Front Door Firewall Policy.
- mode String
- The Front Door Firewall Policy mode. Possible values are
Detection,Prevention. - resource
Group StringName - The name of the resource group. Changing this forces a new resource to be created.
- sku
Name String The sku's pricing tier for this Front Door Firewall Policy. Possible values include
Standard_AzureFrontDoororPremium_AzureFrontDoor. Changing this forces a new resource to be created.NOTE: The
Standard_AzureFrontDoorFront Door Firewall Policy sku may containcustomrules only. ThePremium_AzureFrontDoorFront Door Firewall Policy skus may contain bothcustomandmanagedrules.- custom
Block StringResponse Body - If a
custom_ruleblock's action type isblock, this is the response body. The body must be specified in base64 encoding. - custom
Block NumberResponse Status Code - If a
custom_ruleblock's action type isblock, this is the response status code. Possible values are200,403,405,406, or429. - custom
Rules List<Property Map> - One or more
custom_ruleblocks as defined below. - enabled Boolean
- Is the Front Door Firewall Policy enabled? Defaults to
true. - managed
Rules List<Property Map> - One or more
managed_ruleblocks as defined below. - name String
- The name of the policy. Changing this forces a new resource to be created.
- redirect
Url String - If action type is redirect, this field represents redirect URL for the client.
- request
Body BooleanCheck Enabled Should policy managed rules inspect the request body content? Defaults to
true.NOTE: When run in
Detectionmode, the Front Door Firewall Policy doesn't take any other actions other than monitoring and logging the request and its matched Front Door Rule to the Web Application Firewall logs.- Map<String>
- A mapping of tags to assign to the Front Door Firewall Policy.
Outputs
All input properties are implicitly available as output properties. Additionally, the FrontdoorFirewallPolicy resource produces the following output properties:
- Frontend
Endpoint List<string>Ids - The Front Door Profiles frontend endpoints associated with this Front Door Firewall Policy.
- Id string
- The provider-assigned unique ID for this managed resource.
- Frontend
Endpoint []stringIds - The Front Door Profiles frontend endpoints associated with this Front Door Firewall Policy.
- Id string
- The provider-assigned unique ID for this managed resource.
- frontend
Endpoint List<String>Ids - The Front Door Profiles frontend endpoints associated with this Front Door Firewall Policy.
- id String
- The provider-assigned unique ID for this managed resource.
- frontend
Endpoint string[]Ids - The Front Door Profiles frontend endpoints associated with this Front Door Firewall Policy.
- id string
- The provider-assigned unique ID for this managed resource.
- frontend_
endpoint_ Sequence[str]ids - The Front Door Profiles frontend endpoints associated with this Front Door Firewall Policy.
- id str
- The provider-assigned unique ID for this managed resource.
- frontend
Endpoint List<String>Ids - The Front Door Profiles frontend endpoints associated with this Front Door Firewall Policy.
- id String
- The provider-assigned unique ID for this managed resource.
Look up Existing FrontdoorFirewallPolicy Resource
Get an existing FrontdoorFirewallPolicy resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.
public static get(name: string, id: Input<ID>, state?: FrontdoorFirewallPolicyState, opts?: CustomResourceOptions): FrontdoorFirewallPolicy@staticmethod
def get(resource_name: str,
id: str,
opts: Optional[ResourceOptions] = None,
custom_block_response_body: Optional[str] = None,
custom_block_response_status_code: Optional[int] = None,
custom_rules: Optional[Sequence[FrontdoorFirewallPolicyCustomRuleArgs]] = None,
enabled: Optional[bool] = None,
frontend_endpoint_ids: Optional[Sequence[str]] = None,
managed_rules: Optional[Sequence[FrontdoorFirewallPolicyManagedRuleArgs]] = None,
mode: Optional[str] = None,
name: Optional[str] = None,
redirect_url: Optional[str] = None,
request_body_check_enabled: Optional[bool] = None,
resource_group_name: Optional[str] = None,
sku_name: Optional[str] = None,
tags: Optional[Mapping[str, str]] = None) -> FrontdoorFirewallPolicyfunc GetFrontdoorFirewallPolicy(ctx *Context, name string, id IDInput, state *FrontdoorFirewallPolicyState, opts ...ResourceOption) (*FrontdoorFirewallPolicy, error)public static FrontdoorFirewallPolicy Get(string name, Input<string> id, FrontdoorFirewallPolicyState? state, CustomResourceOptions? opts = null)public static FrontdoorFirewallPolicy get(String name, Output<String> id, FrontdoorFirewallPolicyState state, CustomResourceOptions options)Resource lookup is not supported in YAML- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- resource_name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- Custom
Block stringResponse Body - If a
custom_ruleblock's action type isblock, this is the response body. The body must be specified in base64 encoding. - Custom
Block intResponse Status Code - If a
custom_ruleblock's action type isblock, this is the response status code. Possible values are200,403,405,406, or429. - Custom
Rules List<FrontdoorFirewall Policy Custom Rule> - One or more
custom_ruleblocks as defined below. - Enabled bool
- Is the Front Door Firewall Policy enabled? Defaults to
true. - Frontend
Endpoint List<string>Ids - The Front Door Profiles frontend endpoints associated with this Front Door Firewall Policy.
- Managed
Rules List<FrontdoorFirewall Policy Managed Rule> - One or more
managed_ruleblocks as defined below. - Mode string
- The Front Door Firewall Policy mode. Possible values are
Detection,Prevention. - Name string
- The name of the policy. Changing this forces a new resource to be created.
- Redirect
Url string - If action type is redirect, this field represents redirect URL for the client.
- Request
Body boolCheck Enabled Should policy managed rules inspect the request body content? Defaults to
true.NOTE: When run in
Detectionmode, the Front Door Firewall Policy doesn't take any other actions other than monitoring and logging the request and its matched Front Door Rule to the Web Application Firewall logs.- Resource
Group stringName - The name of the resource group. Changing this forces a new resource to be created.
- Sku
Name string The sku's pricing tier for this Front Door Firewall Policy. Possible values include
Standard_AzureFrontDoororPremium_AzureFrontDoor. Changing this forces a new resource to be created.NOTE: The
Standard_AzureFrontDoorFront Door Firewall Policy sku may containcustomrules only. ThePremium_AzureFrontDoorFront Door Firewall Policy skus may contain bothcustomandmanagedrules.- Dictionary<string, string>
- A mapping of tags to assign to the Front Door Firewall Policy.
- Custom
Block stringResponse Body - If a
custom_ruleblock's action type isblock, this is the response body. The body must be specified in base64 encoding. - Custom
Block intResponse Status Code - If a
custom_ruleblock's action type isblock, this is the response status code. Possible values are200,403,405,406, or429. - Custom
Rules []FrontdoorFirewall Policy Custom Rule Args - One or more
custom_ruleblocks as defined below. - Enabled bool
- Is the Front Door Firewall Policy enabled? Defaults to
true. - Frontend
Endpoint []stringIds - The Front Door Profiles frontend endpoints associated with this Front Door Firewall Policy.
- Managed
Rules []FrontdoorFirewall Policy Managed Rule Args - One or more
managed_ruleblocks as defined below. - Mode string
- The Front Door Firewall Policy mode. Possible values are
Detection,Prevention. - Name string
- The name of the policy. Changing this forces a new resource to be created.
- Redirect
Url string - If action type is redirect, this field represents redirect URL for the client.
- Request
Body boolCheck Enabled Should policy managed rules inspect the request body content? Defaults to
true.NOTE: When run in
Detectionmode, the Front Door Firewall Policy doesn't take any other actions other than monitoring and logging the request and its matched Front Door Rule to the Web Application Firewall logs.- Resource
Group stringName - The name of the resource group. Changing this forces a new resource to be created.
- Sku
Name string The sku's pricing tier for this Front Door Firewall Policy. Possible values include
Standard_AzureFrontDoororPremium_AzureFrontDoor. Changing this forces a new resource to be created.NOTE: The
Standard_AzureFrontDoorFront Door Firewall Policy sku may containcustomrules only. ThePremium_AzureFrontDoorFront Door Firewall Policy skus may contain bothcustomandmanagedrules.- map[string]string
- A mapping of tags to assign to the Front Door Firewall Policy.
- custom
Block StringResponse Body - If a
custom_ruleblock's action type isblock, this is the response body. The body must be specified in base64 encoding. - custom
Block IntegerResponse Status Code - If a
custom_ruleblock's action type isblock, this is the response status code. Possible values are200,403,405,406, or429. - custom
Rules List<FrontdoorFirewall Policy Custom Rule> - One or more
custom_ruleblocks as defined below. - enabled Boolean
- Is the Front Door Firewall Policy enabled? Defaults to
true. - frontend
Endpoint List<String>Ids - The Front Door Profiles frontend endpoints associated with this Front Door Firewall Policy.
- managed
Rules List<FrontdoorFirewall Policy Managed Rule> - One or more
managed_ruleblocks as defined below. - mode String
- The Front Door Firewall Policy mode. Possible values are
Detection,Prevention. - name String
- The name of the policy. Changing this forces a new resource to be created.
- redirect
Url String - If action type is redirect, this field represents redirect URL for the client.
- request
Body BooleanCheck Enabled Should policy managed rules inspect the request body content? Defaults to
true.NOTE: When run in
Detectionmode, the Front Door Firewall Policy doesn't take any other actions other than monitoring and logging the request and its matched Front Door Rule to the Web Application Firewall logs.- resource
Group StringName - The name of the resource group. Changing this forces a new resource to be created.
- sku
Name String The sku's pricing tier for this Front Door Firewall Policy. Possible values include
Standard_AzureFrontDoororPremium_AzureFrontDoor. Changing this forces a new resource to be created.NOTE: The
Standard_AzureFrontDoorFront Door Firewall Policy sku may containcustomrules only. ThePremium_AzureFrontDoorFront Door Firewall Policy skus may contain bothcustomandmanagedrules.- Map<String,String>
- A mapping of tags to assign to the Front Door Firewall Policy.
- custom
Block stringResponse Body - If a
custom_ruleblock's action type isblock, this is the response body. The body must be specified in base64 encoding. - custom
Block numberResponse Status Code - If a
custom_ruleblock's action type isblock, this is the response status code. Possible values are200,403,405,406, or429. - custom
Rules FrontdoorFirewall Policy Custom Rule[] - One or more
custom_ruleblocks as defined below. - enabled boolean
- Is the Front Door Firewall Policy enabled? Defaults to
true. - frontend
Endpoint string[]Ids - The Front Door Profiles frontend endpoints associated with this Front Door Firewall Policy.
- managed
Rules FrontdoorFirewall Policy Managed Rule[] - One or more
managed_ruleblocks as defined below. - mode string
- The Front Door Firewall Policy mode. Possible values are
Detection,Prevention. - name string
- The name of the policy. Changing this forces a new resource to be created.
- redirect
Url string - If action type is redirect, this field represents redirect URL for the client.
- request
Body booleanCheck Enabled Should policy managed rules inspect the request body content? Defaults to
true.NOTE: When run in
Detectionmode, the Front Door Firewall Policy doesn't take any other actions other than monitoring and logging the request and its matched Front Door Rule to the Web Application Firewall logs.- resource
Group stringName - The name of the resource group. Changing this forces a new resource to be created.
- sku
Name string The sku's pricing tier for this Front Door Firewall Policy. Possible values include
Standard_AzureFrontDoororPremium_AzureFrontDoor. Changing this forces a new resource to be created.NOTE: The
Standard_AzureFrontDoorFront Door Firewall Policy sku may containcustomrules only. ThePremium_AzureFrontDoorFront Door Firewall Policy skus may contain bothcustomandmanagedrules.- {[key: string]: string}
- A mapping of tags to assign to the Front Door Firewall Policy.
- custom_
block_ strresponse_ body - If a
custom_ruleblock's action type isblock, this is the response body. The body must be specified in base64 encoding. - custom_
block_ intresponse_ status_ code - If a
custom_ruleblock's action type isblock, this is the response status code. Possible values are200,403,405,406, or429. - custom_
rules Sequence[FrontdoorFirewall Policy Custom Rule Args] - One or more
custom_ruleblocks as defined below. - enabled bool
- Is the Front Door Firewall Policy enabled? Defaults to
true. - frontend_
endpoint_ Sequence[str]ids - The Front Door Profiles frontend endpoints associated with this Front Door Firewall Policy.
- managed_
rules Sequence[FrontdoorFirewall Policy Managed Rule Args] - One or more
managed_ruleblocks as defined below. - mode str
- The Front Door Firewall Policy mode. Possible values are
Detection,Prevention. - name str
- The name of the policy. Changing this forces a new resource to be created.
- redirect_
url str - If action type is redirect, this field represents redirect URL for the client.
- request_
body_ boolcheck_ enabled Should policy managed rules inspect the request body content? Defaults to
true.NOTE: When run in
Detectionmode, the Front Door Firewall Policy doesn't take any other actions other than monitoring and logging the request and its matched Front Door Rule to the Web Application Firewall logs.- resource_
group_ strname - The name of the resource group. Changing this forces a new resource to be created.
- sku_
name str The sku's pricing tier for this Front Door Firewall Policy. Possible values include
Standard_AzureFrontDoororPremium_AzureFrontDoor. Changing this forces a new resource to be created.NOTE: The
Standard_AzureFrontDoorFront Door Firewall Policy sku may containcustomrules only. ThePremium_AzureFrontDoorFront Door Firewall Policy skus may contain bothcustomandmanagedrules.- Mapping[str, str]
- A mapping of tags to assign to the Front Door Firewall Policy.
- custom
Block StringResponse Body - If a
custom_ruleblock's action type isblock, this is the response body. The body must be specified in base64 encoding. - custom
Block NumberResponse Status Code - If a
custom_ruleblock's action type isblock, this is the response status code. Possible values are200,403,405,406, or429. - custom
Rules List<Property Map> - One or more
custom_ruleblocks as defined below. - enabled Boolean
- Is the Front Door Firewall Policy enabled? Defaults to
true. - frontend
Endpoint List<String>Ids - The Front Door Profiles frontend endpoints associated with this Front Door Firewall Policy.
- managed
Rules List<Property Map> - One or more
managed_ruleblocks as defined below. - mode String
- The Front Door Firewall Policy mode. Possible values are
Detection,Prevention. - name String
- The name of the policy. Changing this forces a new resource to be created.
- redirect
Url String - If action type is redirect, this field represents redirect URL for the client.
- request
Body BooleanCheck Enabled Should policy managed rules inspect the request body content? Defaults to
true.NOTE: When run in
Detectionmode, the Front Door Firewall Policy doesn't take any other actions other than monitoring and logging the request and its matched Front Door Rule to the Web Application Firewall logs.- resource
Group StringName - The name of the resource group. Changing this forces a new resource to be created.
- sku
Name String The sku's pricing tier for this Front Door Firewall Policy. Possible values include
Standard_AzureFrontDoororPremium_AzureFrontDoor. Changing this forces a new resource to be created.NOTE: The
Standard_AzureFrontDoorFront Door Firewall Policy sku may containcustomrules only. ThePremium_AzureFrontDoorFront Door Firewall Policy skus may contain bothcustomandmanagedrules.- Map<String>
- A mapping of tags to assign to the Front Door Firewall Policy.
Supporting Types
FrontdoorFirewallPolicyCustomRule, FrontdoorFirewallPolicyCustomRuleArgs
- Action string
- The action to perform when the rule is matched. Possible values are
Allow,Block,Log, orRedirect. - Name string
- Gets name of the resource that is unique within a policy. This name can be used to access the resource.
- Type string
- The type of rule. Possible values are
MatchRuleorRateLimitRule. - Enabled bool
- Is the rule is enabled or disabled? Defaults to
true. - Match
Conditions List<FrontdoorFirewall Policy Custom Rule Match Condition> - One or more
match_conditionblock defined below. Can support up to10match_conditionblocks. - Priority int
- The priority of the rule. Rules with a lower value will be evaluated before rules with a higher value. Defaults to
1. - Rate
Limit intDuration In Minutes - The rate limit duration in minutes. Defaults to
1. - Rate
Limit intThreshold - The rate limit threshold. Defaults to
10.
- Action string
- The action to perform when the rule is matched. Possible values are
Allow,Block,Log, orRedirect. - Name string
- Gets name of the resource that is unique within a policy. This name can be used to access the resource.
- Type string
- The type of rule. Possible values are
MatchRuleorRateLimitRule. - Enabled bool
- Is the rule is enabled or disabled? Defaults to
true. - Match
Conditions []FrontdoorFirewall Policy Custom Rule Match Condition - One or more
match_conditionblock defined below. Can support up to10match_conditionblocks. - Priority int
- The priority of the rule. Rules with a lower value will be evaluated before rules with a higher value. Defaults to
1. - Rate
Limit intDuration In Minutes - The rate limit duration in minutes. Defaults to
1. - Rate
Limit intThreshold - The rate limit threshold. Defaults to
10.
- action String
- The action to perform when the rule is matched. Possible values are
Allow,Block,Log, orRedirect. - name String
- Gets name of the resource that is unique within a policy. This name can be used to access the resource.
- type String
- The type of rule. Possible values are
MatchRuleorRateLimitRule. - enabled Boolean
- Is the rule is enabled or disabled? Defaults to
true. - match
Conditions List<FrontdoorFirewall Policy Custom Rule Match Condition> - One or more
match_conditionblock defined below. Can support up to10match_conditionblocks. - priority Integer
- The priority of the rule. Rules with a lower value will be evaluated before rules with a higher value. Defaults to
1. - rate
Limit IntegerDuration In Minutes - The rate limit duration in minutes. Defaults to
1. - rate
Limit IntegerThreshold - The rate limit threshold. Defaults to
10.
- action string
- The action to perform when the rule is matched. Possible values are
Allow,Block,Log, orRedirect. - name string
- Gets name of the resource that is unique within a policy. This name can be used to access the resource.
- type string
- The type of rule. Possible values are
MatchRuleorRateLimitRule. - enabled boolean
- Is the rule is enabled or disabled? Defaults to
true. - match
Conditions FrontdoorFirewall Policy Custom Rule Match Condition[] - One or more
match_conditionblock defined below. Can support up to10match_conditionblocks. - priority number
- The priority of the rule. Rules with a lower value will be evaluated before rules with a higher value. Defaults to
1. - rate
Limit numberDuration In Minutes - The rate limit duration in minutes. Defaults to
1. - rate
Limit numberThreshold - The rate limit threshold. Defaults to
10.
- action str
- The action to perform when the rule is matched. Possible values are
Allow,Block,Log, orRedirect. - name str
- Gets name of the resource that is unique within a policy. This name can be used to access the resource.
- type str
- The type of rule. Possible values are
MatchRuleorRateLimitRule. - enabled bool
- Is the rule is enabled or disabled? Defaults to
true. - match_
conditions Sequence[FrontdoorFirewall Policy Custom Rule Match Condition] - One or more
match_conditionblock defined below. Can support up to10match_conditionblocks. - priority int
- The priority of the rule. Rules with a lower value will be evaluated before rules with a higher value. Defaults to
1. - rate_
limit_ intduration_ in_ minutes - The rate limit duration in minutes. Defaults to
1. - rate_
limit_ intthreshold - The rate limit threshold. Defaults to
10.
- action String
- The action to perform when the rule is matched. Possible values are
Allow,Block,Log, orRedirect. - name String
- Gets name of the resource that is unique within a policy. This name can be used to access the resource.
- type String
- The type of rule. Possible values are
MatchRuleorRateLimitRule. - enabled Boolean
- Is the rule is enabled or disabled? Defaults to
true. - match
Conditions List<Property Map> - One or more
match_conditionblock defined below. Can support up to10match_conditionblocks. - priority Number
- The priority of the rule. Rules with a lower value will be evaluated before rules with a higher value. Defaults to
1. - rate
Limit NumberDuration In Minutes - The rate limit duration in minutes. Defaults to
1. - rate
Limit NumberThreshold - The rate limit threshold. Defaults to
10.
FrontdoorFirewallPolicyCustomRuleMatchCondition, FrontdoorFirewallPolicyCustomRuleMatchConditionArgs
- Match
Values List<string> - Up to
600possible values to match. Limit is in total across allmatch_conditionblocks andmatch_valuesarguments. String value itself can be up to256characters in length. - Match
Variable string - The request variable to compare with. Possible values are
Cookies,PostArgs,QueryString,RemoteAddr,RequestBody,RequestHeader,RequestMethod,RequestUri, orSocketAddr. - Operator string
- Comparison type to use for matching with the variable value. Possible values are
Any,BeginsWith,Contains,EndsWith,Equal,GeoMatch,GreaterThan,GreaterThanOrEqual,IPMatch,LessThan,LessThanOrEqualorRegEx. - Negation
Condition bool - Should the result of the condition be negated.
- Selector string
- Match against a specific key if the
match_variableisQueryString,PostArgs,RequestHeaderorCookies. - Transforms List<string>
- Up to
5transforms to apply. Possible values areLowercase,RemoveNulls,Trim,Uppercase,URLDecodeorURLEncode.
- Match
Values []string - Up to
600possible values to match. Limit is in total across allmatch_conditionblocks andmatch_valuesarguments. String value itself can be up to256characters in length. - Match
Variable string - The request variable to compare with. Possible values are
Cookies,PostArgs,QueryString,RemoteAddr,RequestBody,RequestHeader,RequestMethod,RequestUri, orSocketAddr. - Operator string
- Comparison type to use for matching with the variable value. Possible values are
Any,BeginsWith,Contains,EndsWith,Equal,GeoMatch,GreaterThan,GreaterThanOrEqual,IPMatch,LessThan,LessThanOrEqualorRegEx. - Negation
Condition bool - Should the result of the condition be negated.
- Selector string
- Match against a specific key if the
match_variableisQueryString,PostArgs,RequestHeaderorCookies. - Transforms []string
- Up to
5transforms to apply. Possible values areLowercase,RemoveNulls,Trim,Uppercase,URLDecodeorURLEncode.
- match
Values List<String> - Up to
600possible values to match. Limit is in total across allmatch_conditionblocks andmatch_valuesarguments. String value itself can be up to256characters in length. - match
Variable String - The request variable to compare with. Possible values are
Cookies,PostArgs,QueryString,RemoteAddr,RequestBody,RequestHeader,RequestMethod,RequestUri, orSocketAddr. - operator String
- Comparison type to use for matching with the variable value. Possible values are
Any,BeginsWith,Contains,EndsWith,Equal,GeoMatch,GreaterThan,GreaterThanOrEqual,IPMatch,LessThan,LessThanOrEqualorRegEx. - negation
Condition Boolean - Should the result of the condition be negated.
- selector String
- Match against a specific key if the
match_variableisQueryString,PostArgs,RequestHeaderorCookies. - transforms List<String>
- Up to
5transforms to apply. Possible values areLowercase,RemoveNulls,Trim,Uppercase,URLDecodeorURLEncode.
- match
Values string[] - Up to
600possible values to match. Limit is in total across allmatch_conditionblocks andmatch_valuesarguments. String value itself can be up to256characters in length. - match
Variable string - The request variable to compare with. Possible values are
Cookies,PostArgs,QueryString,RemoteAddr,RequestBody,RequestHeader,RequestMethod,RequestUri, orSocketAddr. - operator string
- Comparison type to use for matching with the variable value. Possible values are
Any,BeginsWith,Contains,EndsWith,Equal,GeoMatch,GreaterThan,GreaterThanOrEqual,IPMatch,LessThan,LessThanOrEqualorRegEx. - negation
Condition boolean - Should the result of the condition be negated.
- selector string
- Match against a specific key if the
match_variableisQueryString,PostArgs,RequestHeaderorCookies. - transforms string[]
- Up to
5transforms to apply. Possible values areLowercase,RemoveNulls,Trim,Uppercase,URLDecodeorURLEncode.
- match_
values Sequence[str] - Up to
600possible values to match. Limit is in total across allmatch_conditionblocks andmatch_valuesarguments. String value itself can be up to256characters in length. - match_
variable str - The request variable to compare with. Possible values are
Cookies,PostArgs,QueryString,RemoteAddr,RequestBody,RequestHeader,RequestMethod,RequestUri, orSocketAddr. - operator str
- Comparison type to use for matching with the variable value. Possible values are
Any,BeginsWith,Contains,EndsWith,Equal,GeoMatch,GreaterThan,GreaterThanOrEqual,IPMatch,LessThan,LessThanOrEqualorRegEx. - negation_
condition bool - Should the result of the condition be negated.
- selector str
- Match against a specific key if the
match_variableisQueryString,PostArgs,RequestHeaderorCookies. - transforms Sequence[str]
- Up to
5transforms to apply. Possible values areLowercase,RemoveNulls,Trim,Uppercase,URLDecodeorURLEncode.
- match
Values List<String> - Up to
600possible values to match. Limit is in total across allmatch_conditionblocks andmatch_valuesarguments. String value itself can be up to256characters in length. - match
Variable String - The request variable to compare with. Possible values are
Cookies,PostArgs,QueryString,RemoteAddr,RequestBody,RequestHeader,RequestMethod,RequestUri, orSocketAddr. - operator String
- Comparison type to use for matching with the variable value. Possible values are
Any,BeginsWith,Contains,EndsWith,Equal,GeoMatch,GreaterThan,GreaterThanOrEqual,IPMatch,LessThan,LessThanOrEqualorRegEx. - negation
Condition Boolean - Should the result of the condition be negated.
- selector String
- Match against a specific key if the
match_variableisQueryString,PostArgs,RequestHeaderorCookies. - transforms List<String>
- Up to
5transforms to apply. Possible values areLowercase,RemoveNulls,Trim,Uppercase,URLDecodeorURLEncode.
FrontdoorFirewallPolicyManagedRule, FrontdoorFirewallPolicyManagedRuleArgs
- Action string
- The action to perform for all DRS rules when the managed rule is matched or when the anomaly score is 5 or greater depending on which version of the DRS you are using. Possible values include
Allow,Log,Block, andRedirect. - Type string
- The name of the managed rule to use with this resource. Possible values include
DefaultRuleSet,Microsoft_DefaultRuleSet,BotProtectionorMicrosoft_BotManagerRuleSet. - Version string
- The version of the managed rule to use with this resource. Possible values depends on which DRS type you are using, for the
DefaultRuleSettype the possible values include1.0orpreview-0.1. ForMicrosoft_DefaultRuleSetthe possible values include1.1,2.0or2.1. ForBotProtectionthe value must bepreview-0.1and forMicrosoft_BotManagerRuleSetthe value must be1.0. - Exclusions
List<Frontdoor
Firewall Policy Managed Rule Exclusion> - One or more
exclusionblocks as defined below. - Overrides
List<Frontdoor
Firewall Policy Managed Rule Override> - One or more
overrideblocks as defined below.
- Action string
- The action to perform for all DRS rules when the managed rule is matched or when the anomaly score is 5 or greater depending on which version of the DRS you are using. Possible values include
Allow,Log,Block, andRedirect. - Type string
- The name of the managed rule to use with this resource. Possible values include
DefaultRuleSet,Microsoft_DefaultRuleSet,BotProtectionorMicrosoft_BotManagerRuleSet. - Version string
- The version of the managed rule to use with this resource. Possible values depends on which DRS type you are using, for the
DefaultRuleSettype the possible values include1.0orpreview-0.1. ForMicrosoft_DefaultRuleSetthe possible values include1.1,2.0or2.1. ForBotProtectionthe value must bepreview-0.1and forMicrosoft_BotManagerRuleSetthe value must be1.0. - Exclusions
[]Frontdoor
Firewall Policy Managed Rule Exclusion - One or more
exclusionblocks as defined below. - Overrides
[]Frontdoor
Firewall Policy Managed Rule Override - One or more
overrideblocks as defined below.
- action String
- The action to perform for all DRS rules when the managed rule is matched or when the anomaly score is 5 or greater depending on which version of the DRS you are using. Possible values include
Allow,Log,Block, andRedirect. - type String
- The name of the managed rule to use with this resource. Possible values include
DefaultRuleSet,Microsoft_DefaultRuleSet,BotProtectionorMicrosoft_BotManagerRuleSet. - version String
- The version of the managed rule to use with this resource. Possible values depends on which DRS type you are using, for the
DefaultRuleSettype the possible values include1.0orpreview-0.1. ForMicrosoft_DefaultRuleSetthe possible values include1.1,2.0or2.1. ForBotProtectionthe value must bepreview-0.1and forMicrosoft_BotManagerRuleSetthe value must be1.0. - exclusions
List<Frontdoor
Firewall Policy Managed Rule Exclusion> - One or more
exclusionblocks as defined below. - overrides
List<Frontdoor
Firewall Policy Managed Rule Override> - One or more
overrideblocks as defined below.
- action string
- The action to perform for all DRS rules when the managed rule is matched or when the anomaly score is 5 or greater depending on which version of the DRS you are using. Possible values include
Allow,Log,Block, andRedirect. - type string
- The name of the managed rule to use with this resource. Possible values include
DefaultRuleSet,Microsoft_DefaultRuleSet,BotProtectionorMicrosoft_BotManagerRuleSet. - version string
- The version of the managed rule to use with this resource. Possible values depends on which DRS type you are using, for the
DefaultRuleSettype the possible values include1.0orpreview-0.1. ForMicrosoft_DefaultRuleSetthe possible values include1.1,2.0or2.1. ForBotProtectionthe value must bepreview-0.1and forMicrosoft_BotManagerRuleSetthe value must be1.0. - exclusions
Frontdoor
Firewall Policy Managed Rule Exclusion[] - One or more
exclusionblocks as defined below. - overrides
Frontdoor
Firewall Policy Managed Rule Override[] - One or more
overrideblocks as defined below.
- action str
- The action to perform for all DRS rules when the managed rule is matched or when the anomaly score is 5 or greater depending on which version of the DRS you are using. Possible values include
Allow,Log,Block, andRedirect. - type str
- The name of the managed rule to use with this resource. Possible values include
DefaultRuleSet,Microsoft_DefaultRuleSet,BotProtectionorMicrosoft_BotManagerRuleSet. - version str
- The version of the managed rule to use with this resource. Possible values depends on which DRS type you are using, for the
DefaultRuleSettype the possible values include1.0orpreview-0.1. ForMicrosoft_DefaultRuleSetthe possible values include1.1,2.0or2.1. ForBotProtectionthe value must bepreview-0.1and forMicrosoft_BotManagerRuleSetthe value must be1.0. - exclusions
Sequence[Frontdoor
Firewall Policy Managed Rule Exclusion] - One or more
exclusionblocks as defined below. - overrides
Sequence[Frontdoor
Firewall Policy Managed Rule Override] - One or more
overrideblocks as defined below.
- action String
- The action to perform for all DRS rules when the managed rule is matched or when the anomaly score is 5 or greater depending on which version of the DRS you are using. Possible values include
Allow,Log,Block, andRedirect. - type String
- The name of the managed rule to use with this resource. Possible values include
DefaultRuleSet,Microsoft_DefaultRuleSet,BotProtectionorMicrosoft_BotManagerRuleSet. - version String
- The version of the managed rule to use with this resource. Possible values depends on which DRS type you are using, for the
DefaultRuleSettype the possible values include1.0orpreview-0.1. ForMicrosoft_DefaultRuleSetthe possible values include1.1,2.0or2.1. ForBotProtectionthe value must bepreview-0.1and forMicrosoft_BotManagerRuleSetthe value must be1.0. - exclusions List<Property Map>
- One or more
exclusionblocks as defined below. - overrides List<Property Map>
- One or more
overrideblocks as defined below.
FrontdoorFirewallPolicyManagedRuleExclusion, FrontdoorFirewallPolicyManagedRuleExclusionArgs
- Match
Variable string The variable type to be excluded. Possible values are
QueryStringArgNames,RequestBodyPostArgNames,RequestCookieNames,RequestHeaderNames,RequestBodyJsonArgNamesNOTE:
RequestBodyJsonArgNamesis only available on Default Rule Set (DRS) 2.0 or later- Operator string
- Comparison operator to apply to the selector when specifying which elements in the collection this exclusion applies to. Possible values are:
Equals,Contains,StartsWith,EndsWith,EqualsAny. - Selector string
Selector for the value in the
match_variableattribute this exclusion applies to.NOTE:
selectormust be set to*ifoperatoris set toEqualsAny.
- Match
Variable string The variable type to be excluded. Possible values are
QueryStringArgNames,RequestBodyPostArgNames,RequestCookieNames,RequestHeaderNames,RequestBodyJsonArgNamesNOTE:
RequestBodyJsonArgNamesis only available on Default Rule Set (DRS) 2.0 or later- Operator string
- Comparison operator to apply to the selector when specifying which elements in the collection this exclusion applies to. Possible values are:
Equals,Contains,StartsWith,EndsWith,EqualsAny. - Selector string
Selector for the value in the
match_variableattribute this exclusion applies to.NOTE:
selectormust be set to*ifoperatoris set toEqualsAny.
- match
Variable String The variable type to be excluded. Possible values are
QueryStringArgNames,RequestBodyPostArgNames,RequestCookieNames,RequestHeaderNames,RequestBodyJsonArgNamesNOTE:
RequestBodyJsonArgNamesis only available on Default Rule Set (DRS) 2.0 or later- operator String
- Comparison operator to apply to the selector when specifying which elements in the collection this exclusion applies to. Possible values are:
Equals,Contains,StartsWith,EndsWith,EqualsAny. - selector String
Selector for the value in the
match_variableattribute this exclusion applies to.NOTE:
selectormust be set to*ifoperatoris set toEqualsAny.
- match
Variable string The variable type to be excluded. Possible values are
QueryStringArgNames,RequestBodyPostArgNames,RequestCookieNames,RequestHeaderNames,RequestBodyJsonArgNamesNOTE:
RequestBodyJsonArgNamesis only available on Default Rule Set (DRS) 2.0 or later- operator string
- Comparison operator to apply to the selector when specifying which elements in the collection this exclusion applies to. Possible values are:
Equals,Contains,StartsWith,EndsWith,EqualsAny. - selector string
Selector for the value in the
match_variableattribute this exclusion applies to.NOTE:
selectormust be set to*ifoperatoris set toEqualsAny.
- match_
variable str The variable type to be excluded. Possible values are
QueryStringArgNames,RequestBodyPostArgNames,RequestCookieNames,RequestHeaderNames,RequestBodyJsonArgNamesNOTE:
RequestBodyJsonArgNamesis only available on Default Rule Set (DRS) 2.0 or later- operator str
- Comparison operator to apply to the selector when specifying which elements in the collection this exclusion applies to. Possible values are:
Equals,Contains,StartsWith,EndsWith,EqualsAny. - selector str
Selector for the value in the
match_variableattribute this exclusion applies to.NOTE:
selectormust be set to*ifoperatoris set toEqualsAny.
- match
Variable String The variable type to be excluded. Possible values are
QueryStringArgNames,RequestBodyPostArgNames,RequestCookieNames,RequestHeaderNames,RequestBodyJsonArgNamesNOTE:
RequestBodyJsonArgNamesis only available on Default Rule Set (DRS) 2.0 or later- operator String
- Comparison operator to apply to the selector when specifying which elements in the collection this exclusion applies to. Possible values are:
Equals,Contains,StartsWith,EndsWith,EqualsAny. - selector String
Selector for the value in the
match_variableattribute this exclusion applies to.NOTE:
selectormust be set to*ifoperatoris set toEqualsAny.
FrontdoorFirewallPolicyManagedRuleOverride, FrontdoorFirewallPolicyManagedRuleOverrideArgs
- Rule
Group stringName - The managed rule group to override.
- Exclusions
List<Frontdoor
Firewall Policy Managed Rule Override Exclusion> - One or more
exclusionblocks as defined below. - Rules
List<Frontdoor
Firewall Policy Managed Rule Override Rule> - One or more
ruleblocks as defined below. If none are specified, all of the rules in the group will be disabled.
- Rule
Group stringName - The managed rule group to override.
- Exclusions
[]Frontdoor
Firewall Policy Managed Rule Override Exclusion - One or more
exclusionblocks as defined below. - Rules
[]Frontdoor
Firewall Policy Managed Rule Override Rule - One or more
ruleblocks as defined below. If none are specified, all of the rules in the group will be disabled.
- rule
Group StringName - The managed rule group to override.
- exclusions
List<Frontdoor
Firewall Policy Managed Rule Override Exclusion> - One or more
exclusionblocks as defined below. - rules
List<Frontdoor
Firewall Policy Managed Rule Override Rule> - One or more
ruleblocks as defined below. If none are specified, all of the rules in the group will be disabled.
- rule
Group stringName - The managed rule group to override.
- exclusions
Frontdoor
Firewall Policy Managed Rule Override Exclusion[] - One or more
exclusionblocks as defined below. - rules
Frontdoor
Firewall Policy Managed Rule Override Rule[] - One or more
ruleblocks as defined below. If none are specified, all of the rules in the group will be disabled.
- rule_
group_ strname - The managed rule group to override.
- exclusions
Sequence[Frontdoor
Firewall Policy Managed Rule Override Exclusion] - One or more
exclusionblocks as defined below. - rules
Sequence[Frontdoor
Firewall Policy Managed Rule Override Rule] - One or more
ruleblocks as defined below. If none are specified, all of the rules in the group will be disabled.
- rule
Group StringName - The managed rule group to override.
- exclusions List<Property Map>
- One or more
exclusionblocks as defined below. - rules List<Property Map>
- One or more
ruleblocks as defined below. If none are specified, all of the rules in the group will be disabled.
FrontdoorFirewallPolicyManagedRuleOverrideExclusion, FrontdoorFirewallPolicyManagedRuleOverrideExclusionArgs
- Match
Variable string The variable type to be excluded. Possible values are
QueryStringArgNames,RequestBodyPostArgNames,RequestCookieNames,RequestHeaderNames,RequestBodyJsonArgNamesNOTE:
RequestBodyJsonArgNamesis only available on Default Rule Set (DRS) 2.0 or later- Operator string
- Comparison operator to apply to the selector when specifying which elements in the collection this exclusion applies to. Possible values are:
Equals,Contains,StartsWith,EndsWith,EqualsAny. - Selector string
Selector for the value in the
match_variableattribute this exclusion applies to.NOTE:
selectormust be set to*ifoperatoris set toEqualsAny.
- Match
Variable string The variable type to be excluded. Possible values are
QueryStringArgNames,RequestBodyPostArgNames,RequestCookieNames,RequestHeaderNames,RequestBodyJsonArgNamesNOTE:
RequestBodyJsonArgNamesis only available on Default Rule Set (DRS) 2.0 or later- Operator string
- Comparison operator to apply to the selector when specifying which elements in the collection this exclusion applies to. Possible values are:
Equals,Contains,StartsWith,EndsWith,EqualsAny. - Selector string
Selector for the value in the
match_variableattribute this exclusion applies to.NOTE:
selectormust be set to*ifoperatoris set toEqualsAny.
- match
Variable String The variable type to be excluded. Possible values are
QueryStringArgNames,RequestBodyPostArgNames,RequestCookieNames,RequestHeaderNames,RequestBodyJsonArgNamesNOTE:
RequestBodyJsonArgNamesis only available on Default Rule Set (DRS) 2.0 or later- operator String
- Comparison operator to apply to the selector when specifying which elements in the collection this exclusion applies to. Possible values are:
Equals,Contains,StartsWith,EndsWith,EqualsAny. - selector String
Selector for the value in the
match_variableattribute this exclusion applies to.NOTE:
selectormust be set to*ifoperatoris set toEqualsAny.
- match
Variable string The variable type to be excluded. Possible values are
QueryStringArgNames,RequestBodyPostArgNames,RequestCookieNames,RequestHeaderNames,RequestBodyJsonArgNamesNOTE:
RequestBodyJsonArgNamesis only available on Default Rule Set (DRS) 2.0 or later- operator string
- Comparison operator to apply to the selector when specifying which elements in the collection this exclusion applies to. Possible values are:
Equals,Contains,StartsWith,EndsWith,EqualsAny. - selector string
Selector for the value in the
match_variableattribute this exclusion applies to.NOTE:
selectormust be set to*ifoperatoris set toEqualsAny.
- match_
variable str The variable type to be excluded. Possible values are
QueryStringArgNames,RequestBodyPostArgNames,RequestCookieNames,RequestHeaderNames,RequestBodyJsonArgNamesNOTE:
RequestBodyJsonArgNamesis only available on Default Rule Set (DRS) 2.0 or later- operator str
- Comparison operator to apply to the selector when specifying which elements in the collection this exclusion applies to. Possible values are:
Equals,Contains,StartsWith,EndsWith,EqualsAny. - selector str
Selector for the value in the
match_variableattribute this exclusion applies to.NOTE:
selectormust be set to*ifoperatoris set toEqualsAny.
- match
Variable String The variable type to be excluded. Possible values are
QueryStringArgNames,RequestBodyPostArgNames,RequestCookieNames,RequestHeaderNames,RequestBodyJsonArgNamesNOTE:
RequestBodyJsonArgNamesis only available on Default Rule Set (DRS) 2.0 or later- operator String
- Comparison operator to apply to the selector when specifying which elements in the collection this exclusion applies to. Possible values are:
Equals,Contains,StartsWith,EndsWith,EqualsAny. - selector String
Selector for the value in the
match_variableattribute this exclusion applies to.NOTE:
selectormust be set to*ifoperatoris set toEqualsAny.
FrontdoorFirewallPolicyManagedRuleOverrideRule, FrontdoorFirewallPolicyManagedRuleOverrideRuleArgs
- Action string
The action to be applied when the managed rule matches or when the anomaly score is 5 or greater. Possible values for DRS
1.1and below areAllow,Log,Block, andRedirect. For DRS2.0and above the possible values areLogorAnomalyScoring.->NOTE: Please see the DRS product documentation for more information.
- Rule
Id string - Identifier for the managed rule.
- Enabled bool
- Is the managed rule override enabled or disabled. Defaults to
false - Exclusions
List<Frontdoor
Firewall Policy Managed Rule Override Rule Exclusion> - One or more
exclusionblocks as defined below.
- Action string
The action to be applied when the managed rule matches or when the anomaly score is 5 or greater. Possible values for DRS
1.1and below areAllow,Log,Block, andRedirect. For DRS2.0and above the possible values areLogorAnomalyScoring.->NOTE: Please see the DRS product documentation for more information.
- Rule
Id string - Identifier for the managed rule.
- Enabled bool
- Is the managed rule override enabled or disabled. Defaults to
false - Exclusions
[]Frontdoor
Firewall Policy Managed Rule Override Rule Exclusion - One or more
exclusionblocks as defined below.
- action String
The action to be applied when the managed rule matches or when the anomaly score is 5 or greater. Possible values for DRS
1.1and below areAllow,Log,Block, andRedirect. For DRS2.0and above the possible values areLogorAnomalyScoring.->NOTE: Please see the DRS product documentation for more information.
- rule
Id String - Identifier for the managed rule.
- enabled Boolean
- Is the managed rule override enabled or disabled. Defaults to
false - exclusions
List<Frontdoor
Firewall Policy Managed Rule Override Rule Exclusion> - One or more
exclusionblocks as defined below.
- action string
The action to be applied when the managed rule matches or when the anomaly score is 5 or greater. Possible values for DRS
1.1and below areAllow,Log,Block, andRedirect. For DRS2.0and above the possible values areLogorAnomalyScoring.->NOTE: Please see the DRS product documentation for more information.
- rule
Id string - Identifier for the managed rule.
- enabled boolean
- Is the managed rule override enabled or disabled. Defaults to
false - exclusions
Frontdoor
Firewall Policy Managed Rule Override Rule Exclusion[] - One or more
exclusionblocks as defined below.
- action str
The action to be applied when the managed rule matches or when the anomaly score is 5 or greater. Possible values for DRS
1.1and below areAllow,Log,Block, andRedirect. For DRS2.0and above the possible values areLogorAnomalyScoring.->NOTE: Please see the DRS product documentation for more information.
- rule_
id str - Identifier for the managed rule.
- enabled bool
- Is the managed rule override enabled or disabled. Defaults to
false - exclusions
Sequence[Frontdoor
Firewall Policy Managed Rule Override Rule Exclusion] - One or more
exclusionblocks as defined below.
- action String
The action to be applied when the managed rule matches or when the anomaly score is 5 or greater. Possible values for DRS
1.1and below areAllow,Log,Block, andRedirect. For DRS2.0and above the possible values areLogorAnomalyScoring.->NOTE: Please see the DRS product documentation for more information.
- rule
Id String - Identifier for the managed rule.
- enabled Boolean
- Is the managed rule override enabled or disabled. Defaults to
false - exclusions List<Property Map>
- One or more
exclusionblocks as defined below.
FrontdoorFirewallPolicyManagedRuleOverrideRuleExclusion, FrontdoorFirewallPolicyManagedRuleOverrideRuleExclusionArgs
- Match
Variable string The variable type to be excluded. Possible values are
QueryStringArgNames,RequestBodyPostArgNames,RequestCookieNames,RequestHeaderNames,RequestBodyJsonArgNamesNOTE:
RequestBodyJsonArgNamesis only available on Default Rule Set (DRS) 2.0 or later- Operator string
- Comparison operator to apply to the selector when specifying which elements in the collection this exclusion applies to. Possible values are:
Equals,Contains,StartsWith,EndsWith,EqualsAny. - Selector string
Selector for the value in the
match_variableattribute this exclusion applies to.NOTE:
selectormust be set to*ifoperatoris set toEqualsAny.
- Match
Variable string The variable type to be excluded. Possible values are
QueryStringArgNames,RequestBodyPostArgNames,RequestCookieNames,RequestHeaderNames,RequestBodyJsonArgNamesNOTE:
RequestBodyJsonArgNamesis only available on Default Rule Set (DRS) 2.0 or later- Operator string
- Comparison operator to apply to the selector when specifying which elements in the collection this exclusion applies to. Possible values are:
Equals,Contains,StartsWith,EndsWith,EqualsAny. - Selector string
Selector for the value in the
match_variableattribute this exclusion applies to.NOTE:
selectormust be set to*ifoperatoris set toEqualsAny.
- match
Variable String The variable type to be excluded. Possible values are
QueryStringArgNames,RequestBodyPostArgNames,RequestCookieNames,RequestHeaderNames,RequestBodyJsonArgNamesNOTE:
RequestBodyJsonArgNamesis only available on Default Rule Set (DRS) 2.0 or later- operator String
- Comparison operator to apply to the selector when specifying which elements in the collection this exclusion applies to. Possible values are:
Equals,Contains,StartsWith,EndsWith,EqualsAny. - selector String
Selector for the value in the
match_variableattribute this exclusion applies to.NOTE:
selectormust be set to*ifoperatoris set toEqualsAny.
- match
Variable string The variable type to be excluded. Possible values are
QueryStringArgNames,RequestBodyPostArgNames,RequestCookieNames,RequestHeaderNames,RequestBodyJsonArgNamesNOTE:
RequestBodyJsonArgNamesis only available on Default Rule Set (DRS) 2.0 or later- operator string
- Comparison operator to apply to the selector when specifying which elements in the collection this exclusion applies to. Possible values are:
Equals,Contains,StartsWith,EndsWith,EqualsAny. - selector string
Selector for the value in the
match_variableattribute this exclusion applies to.NOTE:
selectormust be set to*ifoperatoris set toEqualsAny.
- match_
variable str The variable type to be excluded. Possible values are
QueryStringArgNames,RequestBodyPostArgNames,RequestCookieNames,RequestHeaderNames,RequestBodyJsonArgNamesNOTE:
RequestBodyJsonArgNamesis only available on Default Rule Set (DRS) 2.0 or later- operator str
- Comparison operator to apply to the selector when specifying which elements in the collection this exclusion applies to. Possible values are:
Equals,Contains,StartsWith,EndsWith,EqualsAny. - selector str
Selector for the value in the
match_variableattribute this exclusion applies to.NOTE:
selectormust be set to*ifoperatoris set toEqualsAny.
- match
Variable String The variable type to be excluded. Possible values are
QueryStringArgNames,RequestBodyPostArgNames,RequestCookieNames,RequestHeaderNames,RequestBodyJsonArgNamesNOTE:
RequestBodyJsonArgNamesis only available on Default Rule Set (DRS) 2.0 or later- operator String
- Comparison operator to apply to the selector when specifying which elements in the collection this exclusion applies to. Possible values are:
Equals,Contains,StartsWith,EndsWith,EqualsAny. - selector String
Selector for the value in the
match_variableattribute this exclusion applies to.NOTE:
selectormust be set to*ifoperatoris set toEqualsAny.
Import
Front Door Firewall Policies can be imported using the resource id, e.g.
$ pulumi import azure:cdn/frontdoorFirewallPolicy:FrontdoorFirewallPolicy example /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/resourceGroup1/providers/Microsoft.Network/frontDoorWebApplicationFirewallPolicies/firewallPolicy1
To learn more about importing existing cloud resources, see Importing resources.
Package Details
- Repository
- Azure Classic pulumi/pulumi-azure
- License
- Apache-2.0
- Notes
- This Pulumi package is based on the
azurermTerraform Provider.