Cloudflare v5.2.1, May 23 23

cloudflare.FirewallRule

Explore with Pulumi AI

Define Firewall rules using filter expressions for more control over how traffic is matched to the rule. A filter expression permits selecting traffic by multiple criteria allowing greater freedom in rule creation.

Filter expressions needs to be created first before using Firewall Rule.

If you want to configure Custom Firewall rules, you need to use cloudflare.Ruleset, because Custom Rules are built upon the Cloudflare Ruleset Engine.

Example Usage

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Cloudflare = Pulumi.Cloudflare;

return await Deployment.RunAsync(() => 
{
    var wordpressFilter = new Cloudflare.Filter("wordpressFilter", new()
    {
        ZoneId = "0da42c8d2132a9ddaf714f9e7c920711",
        Description = "Wordpress break-in attempts that are outside of the office",
        Expression = "(http.request.uri.path ~ \".*wp-login.php\" or http.request.uri.path ~ \".*xmlrpc.php\") and ip.src ne 192.0.2.1",
    });

    var wordpressFirewallRule = new Cloudflare.FirewallRule("wordpressFirewallRule", new()
    {
        ZoneId = "0da42c8d2132a9ddaf714f9e7c920711",
        Description = "Block wordpress break-in attempts",
        FilterId = wordpressFilter.Id,
        Action = "block",
    });

});

package main

import (
	"github.com/pulumi/pulumi-cloudflare/sdk/v5/go/cloudflare"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		wordpressFilter, err := cloudflare.NewFilter(ctx, "wordpressFilter", &cloudflare.FilterArgs{
			ZoneId:      pulumi.String("0da42c8d2132a9ddaf714f9e7c920711"),
			Description: pulumi.String("Wordpress break-in attempts that are outside of the office"),
			Expression:  pulumi.String("(http.request.uri.path ~ \".*wp-login.php\" or http.request.uri.path ~ \".*xmlrpc.php\") and ip.src ne 192.0.2.1"),
		})
		if err != nil {
			return err
		}
		_, err = cloudflare.NewFirewallRule(ctx, "wordpressFirewallRule", &cloudflare.FirewallRuleArgs{
			ZoneId:      pulumi.String("0da42c8d2132a9ddaf714f9e7c920711"),
			Description: pulumi.String("Block wordpress break-in attempts"),
			FilterId:    wordpressFilter.ID(),
			Action:      pulumi.String("block"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.cloudflare.Filter;
import com.pulumi.cloudflare.FilterArgs;
import com.pulumi.cloudflare.FirewallRule;
import com.pulumi.cloudflare.FirewallRuleArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var wordpressFilter = new Filter("wordpressFilter", FilterArgs.builder()        
            .zoneId("0da42c8d2132a9ddaf714f9e7c920711")
            .description("Wordpress break-in attempts that are outside of the office")
            .expression("(http.request.uri.path ~ \".*wp-login.php\" or http.request.uri.path ~ \".*xmlrpc.php\") and ip.src ne 192.0.2.1")
            .build());

        var wordpressFirewallRule = new FirewallRule("wordpressFirewallRule", FirewallRuleArgs.builder()        
            .zoneId("0da42c8d2132a9ddaf714f9e7c920711")
            .description("Block wordpress break-in attempts")
            .filterId(wordpressFilter.id())
            .action("block")
            .build());

    }
}

import pulumi
import pulumi_cloudflare as cloudflare

wordpress_filter = cloudflare.Filter("wordpressFilter",
    zone_id="0da42c8d2132a9ddaf714f9e7c920711",
    description="Wordpress break-in attempts that are outside of the office",
    expression="(http.request.uri.path ~ \".*wp-login.php\" or http.request.uri.path ~ \".*xmlrpc.php\") and ip.src ne 192.0.2.1")
wordpress_firewall_rule = cloudflare.FirewallRule("wordpressFirewallRule",
    zone_id="0da42c8d2132a9ddaf714f9e7c920711",
    description="Block wordpress break-in attempts",
    filter_id=wordpress_filter.id,
    action="block")

import * as pulumi from "@pulumi/pulumi";
import * as cloudflare from "@pulumi/cloudflare";

const wordpressFilter = new cloudflare.Filter("wordpressFilter", {
    zoneId: "0da42c8d2132a9ddaf714f9e7c920711",
    description: "Wordpress break-in attempts that are outside of the office",
    expression: "(http.request.uri.path ~ \".*wp-login.php\" or http.request.uri.path ~ \".*xmlrpc.php\") and ip.src ne 192.0.2.1",
});
const wordpressFirewallRule = new cloudflare.FirewallRule("wordpressFirewallRule", {
    zoneId: "0da42c8d2132a9ddaf714f9e7c920711",
    description: "Block wordpress break-in attempts",
    filterId: wordpressFilter.id,
    action: "block",
});

resources:
  wordpressFilter:
    type: cloudflare:Filter
    properties:
      zoneId: 0da42c8d2132a9ddaf714f9e7c920711
      description: Wordpress break-in attempts that are outside of the office
      expression: (http.request.uri.path ~ ".*wp-login.php" or http.request.uri.path ~ ".*xmlrpc.php") and ip.src ne 192.0.2.1
  wordpressFirewallRule:
    type: cloudflare:FirewallRule
    properties:
      zoneId: 0da42c8d2132a9ddaf714f9e7c920711
      description: Block wordpress break-in attempts
      filterId: ${wordpressFilter.id}
      action: block

Create FirewallRule Resource

new FirewallRule(name: string, args: FirewallRuleArgs, opts?: CustomResourceOptions);

@overload
def FirewallRule(resource_name: str,
                 opts: Optional[ResourceOptions] = None,
                 action: Optional[str] = None,
                 description: Optional[str] = None,
                 filter_id: Optional[str] = None,
                 paused: Optional[bool] = None,
                 priority: Optional[int] = None,
                 products: Optional[Sequence[str]] = None,
                 zone_id: Optional[str] = None)
@overload
def FirewallRule(resource_name: str,
                 args: FirewallRuleArgs,
                 opts: Optional[ResourceOptions] = None)

func NewFirewallRule(ctx *Context, name string, args FirewallRuleArgs, opts ...ResourceOption) (*FirewallRule, error)

public FirewallRule(string name, FirewallRuleArgs args, CustomResourceOptions? opts = null)

public FirewallRule(String name, FirewallRuleArgs args)
public FirewallRule(String name, FirewallRuleArgs args, CustomResourceOptions options)

type: cloudflare:FirewallRule
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

name string: The unique name of the resource.
args FirewallRuleArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

resource_name str: The unique name of the resource.
args FirewallRuleArgs: The arguments to resource properties.
opts ResourceOptions: Bag of options to control resource's behavior.

ctx Context: Context object for the current deployment.
name string: The unique name of the resource.
args FirewallRuleArgs: The arguments to resource properties.
opts ResourceOption: Bag of options to control resource's behavior.

name string: The unique name of the resource.
args FirewallRuleArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

name String: The unique name of the resource.
args FirewallRuleArgs: The arguments to resource properties.
options CustomResourceOptions: Bag of options to control resource's behavior.

FirewallRule Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

Inputs

The FirewallRule resource accepts the following input properties:

Action string: The action to apply to a matched request. Available values: block, challenge, allow, js_challenge, managed_challenge, log, bypass.
FilterId string: The identifier of the Filter to use for determining if the Firewall Rule should be triggered.
ZoneId string: The zone identifier to target for the resource. Modifying this attribute will force creation of a new resource.
Description string: A description of the rule to help identify it.
Paused bool: Whether this filter based firewall rule is currently paused.
Priority int: The priority of the rule to allow control of processing order. A lower number indicates high priority. If not provided, any rules with a priority will be sequenced before those without.
Products List<string>: List of products to bypass for a request when the bypass action is used. Available values: zoneLockdown, uaBlock, bic, hot, securityLevel, rateLimit, waf.

Action string: The action to apply to a matched request. Available values: block, challenge, allow, js_challenge, managed_challenge, log, bypass.
FilterId string: The identifier of the Filter to use for determining if the Firewall Rule should be triggered.
ZoneId string: The zone identifier to target for the resource. Modifying this attribute will force creation of a new resource.
Description string: A description of the rule to help identify it.
Paused bool: Whether this filter based firewall rule is currently paused.
Priority int: The priority of the rule to allow control of processing order. A lower number indicates high priority. If not provided, any rules with a priority will be sequenced before those without.
Products []string: List of products to bypass for a request when the bypass action is used. Available values: zoneLockdown, uaBlock, bic, hot, securityLevel, rateLimit, waf.

action String: The action to apply to a matched request. Available values: block, challenge, allow, js_challenge, managed_challenge, log, bypass.
filterId String: The identifier of the Filter to use for determining if the Firewall Rule should be triggered.
zoneId String: The zone identifier to target for the resource. Modifying this attribute will force creation of a new resource.
description String: A description of the rule to help identify it.
paused Boolean: Whether this filter based firewall rule is currently paused.
priority Integer: The priority of the rule to allow control of processing order. A lower number indicates high priority. If not provided, any rules with a priority will be sequenced before those without.
products List<String>: List of products to bypass for a request when the bypass action is used. Available values: zoneLockdown, uaBlock, bic, hot, securityLevel, rateLimit, waf.

action string: The action to apply to a matched request. Available values: block, challenge, allow, js_challenge, managed_challenge, log, bypass.
filterId string: The identifier of the Filter to use for determining if the Firewall Rule should be triggered.
zoneId string: The zone identifier to target for the resource. Modifying this attribute will force creation of a new resource.
description string: A description of the rule to help identify it.
paused boolean: Whether this filter based firewall rule is currently paused.
priority number: The priority of the rule to allow control of processing order. A lower number indicates high priority. If not provided, any rules with a priority will be sequenced before those without.
products string[]: List of products to bypass for a request when the bypass action is used. Available values: zoneLockdown, uaBlock, bic, hot, securityLevel, rateLimit, waf.

action str: The action to apply to a matched request. Available values: block, challenge, allow, js_challenge, managed_challenge, log, bypass.
filter_id str: The identifier of the Filter to use for determining if the Firewall Rule should be triggered.
zone_id str: The zone identifier to target for the resource. Modifying this attribute will force creation of a new resource.
description str: A description of the rule to help identify it.
paused bool: Whether this filter based firewall rule is currently paused.
priority int: The priority of the rule to allow control of processing order. A lower number indicates high priority. If not provided, any rules with a priority will be sequenced before those without.
products Sequence[str]: List of products to bypass for a request when the bypass action is used. Available values: zoneLockdown, uaBlock, bic, hot, securityLevel, rateLimit, waf.

action String: The action to apply to a matched request. Available values: block, challenge, allow, js_challenge, managed_challenge, log, bypass.
filterId String: The identifier of the Filter to use for determining if the Firewall Rule should be triggered.
zoneId String: The zone identifier to target for the resource. Modifying this attribute will force creation of a new resource.
description String: A description of the rule to help identify it.
paused Boolean: Whether this filter based firewall rule is currently paused.
priority Number: The priority of the rule to allow control of processing order. A lower number indicates high priority. If not provided, any rules with a priority will be sequenced before those without.
products List<String>: List of products to bypass for a request when the bypass action is used. Available values: zoneLockdown, uaBlock, bic, hot, securityLevel, rateLimit, waf.

Outputs

All input properties are implicitly available as output properties. Additionally, the FirewallRule resource produces the following output properties:

Id string: The provider-assigned unique ID for this managed resource.

Id string: The provider-assigned unique ID for this managed resource.

id String: The provider-assigned unique ID for this managed resource.

id string: The provider-assigned unique ID for this managed resource.

id str: The provider-assigned unique ID for this managed resource.

id String: The provider-assigned unique ID for this managed resource.

Look up Existing FirewallRule Resource

Get an existing FirewallRule resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: FirewallRuleState, opts?: CustomResourceOptions): FirewallRule

@staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        action: Optional[str] = None,
        description: Optional[str] = None,
        filter_id: Optional[str] = None,
        paused: Optional[bool] = None,
        priority: Optional[int] = None,
        products: Optional[Sequence[str]] = None,
        zone_id: Optional[str] = None) -> FirewallRule

func GetFirewallRule(ctx *Context, name string, id IDInput, state *FirewallRuleState, opts ...ResourceOption) (*FirewallRule, error)

public static FirewallRule Get(string name, Input<string> id, FirewallRuleState? state, CustomResourceOptions? opts = null)

public static FirewallRule get(String name, Output<String> id, FirewallRuleState state, CustomResourceOptions options)

Resource lookup is not supported in YAML

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

resource_name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

The following state arguments are supported:

Action string: The action to apply to a matched request. Available values: block, challenge, allow, js_challenge, managed_challenge, log, bypass.
Description string: A description of the rule to help identify it.
FilterId string: The identifier of the Filter to use for determining if the Firewall Rule should be triggered.
Paused bool: Whether this filter based firewall rule is currently paused.
Priority int: The priority of the rule to allow control of processing order. A lower number indicates high priority. If not provided, any rules with a priority will be sequenced before those without.
Products List<string>: List of products to bypass for a request when the bypass action is used. Available values: zoneLockdown, uaBlock, bic, hot, securityLevel, rateLimit, waf.
ZoneId string: The zone identifier to target for the resource. Modifying this attribute will force creation of a new resource.

Action string: The action to apply to a matched request. Available values: block, challenge, allow, js_challenge, managed_challenge, log, bypass.
Description string: A description of the rule to help identify it.
FilterId string: The identifier of the Filter to use for determining if the Firewall Rule should be triggered.
Paused bool: Whether this filter based firewall rule is currently paused.
Priority int: The priority of the rule to allow control of processing order. A lower number indicates high priority. If not provided, any rules with a priority will be sequenced before those without.
Products []string: List of products to bypass for a request when the bypass action is used. Available values: zoneLockdown, uaBlock, bic, hot, securityLevel, rateLimit, waf.
ZoneId string: The zone identifier to target for the resource. Modifying this attribute will force creation of a new resource.

action String: The action to apply to a matched request. Available values: block, challenge, allow, js_challenge, managed_challenge, log, bypass.
description String: A description of the rule to help identify it.
filterId String: The identifier of the Filter to use for determining if the Firewall Rule should be triggered.
paused Boolean: Whether this filter based firewall rule is currently paused.
priority Integer: The priority of the rule to allow control of processing order. A lower number indicates high priority. If not provided, any rules with a priority will be sequenced before those without.
products List<String>: List of products to bypass for a request when the bypass action is used. Available values: zoneLockdown, uaBlock, bic, hot, securityLevel, rateLimit, waf.
zoneId String: The zone identifier to target for the resource. Modifying this attribute will force creation of a new resource.

action string: The action to apply to a matched request. Available values: block, challenge, allow, js_challenge, managed_challenge, log, bypass.
description string: A description of the rule to help identify it.
filterId string: The identifier of the Filter to use for determining if the Firewall Rule should be triggered.
paused boolean: Whether this filter based firewall rule is currently paused.
priority number: The priority of the rule to allow control of processing order. A lower number indicates high priority. If not provided, any rules with a priority will be sequenced before those without.
products string[]: List of products to bypass for a request when the bypass action is used. Available values: zoneLockdown, uaBlock, bic, hot, securityLevel, rateLimit, waf.
zoneId string: The zone identifier to target for the resource. Modifying this attribute will force creation of a new resource.

action str: The action to apply to a matched request. Available values: block, challenge, allow, js_challenge, managed_challenge, log, bypass.
description str: A description of the rule to help identify it.
filter_id str: The identifier of the Filter to use for determining if the Firewall Rule should be triggered.
paused bool: Whether this filter based firewall rule is currently paused.
priority int: The priority of the rule to allow control of processing order. A lower number indicates high priority. If not provided, any rules with a priority will be sequenced before those without.
products Sequence[str]: List of products to bypass for a request when the bypass action is used. Available values: zoneLockdown, uaBlock, bic, hot, securityLevel, rateLimit, waf.
zone_id str: The zone identifier to target for the resource. Modifying this attribute will force creation of a new resource.

action String: The action to apply to a matched request. Available values: block, challenge, allow, js_challenge, managed_challenge, log, bypass.
description String: A description of the rule to help identify it.
filterId String: The identifier of the Filter to use for determining if the Firewall Rule should be triggered.
paused Boolean: Whether this filter based firewall rule is currently paused.
priority Number: The priority of the rule to allow control of processing order. A lower number indicates high priority. If not provided, any rules with a priority will be sequenced before those without.
products List<String>: List of products to bypass for a request when the bypass action is used. Available values: zoneLockdown, uaBlock, bic, hot, securityLevel, rateLimit, waf.
zoneId String: The zone identifier to target for the resource. Modifying this attribute will force creation of a new resource.

Import

 $ pulumi import cloudflare:index/firewallRule:FirewallRule example <zone_id>/<firewall_rule_id>

Package Details

Repository: Cloudflare pulumi/pulumi-cloudflare
License: Apache-2.0
Notes: This Pulumi package is based on the cloudflare Terraform Provider.