cloudflare logo
Cloudflare v5.2.1, May 23 23

cloudflare.FirewallRule

Explore with Pulumi AI

Define Firewall rules using filter expressions for more control over how traffic is matched to the rule. A filter expression permits selecting traffic by multiple criteria allowing greater freedom in rule creation.

Filter expressions needs to be created first before using Firewall Rule.

If you want to configure Custom Firewall rules, you need to use cloudflare.Ruleset, because Custom Rules are built upon the Cloudflare Ruleset Engine.

Example Usage

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Cloudflare = Pulumi.Cloudflare;

return await Deployment.RunAsync(() => 
{
    var wordpressFilter = new Cloudflare.Filter("wordpressFilter", new()
    {
        ZoneId = "0da42c8d2132a9ddaf714f9e7c920711",
        Description = "Wordpress break-in attempts that are outside of the office",
        Expression = "(http.request.uri.path ~ \".*wp-login.php\" or http.request.uri.path ~ \".*xmlrpc.php\") and ip.src ne 192.0.2.1",
    });

    var wordpressFirewallRule = new Cloudflare.FirewallRule("wordpressFirewallRule", new()
    {
        ZoneId = "0da42c8d2132a9ddaf714f9e7c920711",
        Description = "Block wordpress break-in attempts",
        FilterId = wordpressFilter.Id,
        Action = "block",
    });

});
package main

import (
	"github.com/pulumi/pulumi-cloudflare/sdk/v5/go/cloudflare"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		wordpressFilter, err := cloudflare.NewFilter(ctx, "wordpressFilter", &cloudflare.FilterArgs{
			ZoneId:      pulumi.String("0da42c8d2132a9ddaf714f9e7c920711"),
			Description: pulumi.String("Wordpress break-in attempts that are outside of the office"),
			Expression:  pulumi.String("(http.request.uri.path ~ \".*wp-login.php\" or http.request.uri.path ~ \".*xmlrpc.php\") and ip.src ne 192.0.2.1"),
		})
		if err != nil {
			return err
		}
		_, err = cloudflare.NewFirewallRule(ctx, "wordpressFirewallRule", &cloudflare.FirewallRuleArgs{
			ZoneId:      pulumi.String("0da42c8d2132a9ddaf714f9e7c920711"),
			Description: pulumi.String("Block wordpress break-in attempts"),
			FilterId:    wordpressFilter.ID(),
			Action:      pulumi.String("block"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}
package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.cloudflare.Filter;
import com.pulumi.cloudflare.FilterArgs;
import com.pulumi.cloudflare.FirewallRule;
import com.pulumi.cloudflare.FirewallRuleArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var wordpressFilter = new Filter("wordpressFilter", FilterArgs.builder()        
            .zoneId("0da42c8d2132a9ddaf714f9e7c920711")
            .description("Wordpress break-in attempts that are outside of the office")
            .expression("(http.request.uri.path ~ \".*wp-login.php\" or http.request.uri.path ~ \".*xmlrpc.php\") and ip.src ne 192.0.2.1")
            .build());

        var wordpressFirewallRule = new FirewallRule("wordpressFirewallRule", FirewallRuleArgs.builder()        
            .zoneId("0da42c8d2132a9ddaf714f9e7c920711")
            .description("Block wordpress break-in attempts")
            .filterId(wordpressFilter.id())
            .action("block")
            .build());

    }
}
import pulumi
import pulumi_cloudflare as cloudflare

wordpress_filter = cloudflare.Filter("wordpressFilter",
    zone_id="0da42c8d2132a9ddaf714f9e7c920711",
    description="Wordpress break-in attempts that are outside of the office",
    expression="(http.request.uri.path ~ \".*wp-login.php\" or http.request.uri.path ~ \".*xmlrpc.php\") and ip.src ne 192.0.2.1")
wordpress_firewall_rule = cloudflare.FirewallRule("wordpressFirewallRule",
    zone_id="0da42c8d2132a9ddaf714f9e7c920711",
    description="Block wordpress break-in attempts",
    filter_id=wordpress_filter.id,
    action="block")
import * as pulumi from "@pulumi/pulumi";
import * as cloudflare from "@pulumi/cloudflare";

const wordpressFilter = new cloudflare.Filter("wordpressFilter", {
    zoneId: "0da42c8d2132a9ddaf714f9e7c920711",
    description: "Wordpress break-in attempts that are outside of the office",
    expression: "(http.request.uri.path ~ \".*wp-login.php\" or http.request.uri.path ~ \".*xmlrpc.php\") and ip.src ne 192.0.2.1",
});
const wordpressFirewallRule = new cloudflare.FirewallRule("wordpressFirewallRule", {
    zoneId: "0da42c8d2132a9ddaf714f9e7c920711",
    description: "Block wordpress break-in attempts",
    filterId: wordpressFilter.id,
    action: "block",
});
resources:
  wordpressFilter:
    type: cloudflare:Filter
    properties:
      zoneId: 0da42c8d2132a9ddaf714f9e7c920711
      description: Wordpress break-in attempts that are outside of the office
      expression: (http.request.uri.path ~ ".*wp-login.php" or http.request.uri.path ~ ".*xmlrpc.php") and ip.src ne 192.0.2.1
  wordpressFirewallRule:
    type: cloudflare:FirewallRule
    properties:
      zoneId: 0da42c8d2132a9ddaf714f9e7c920711
      description: Block wordpress break-in attempts
      filterId: ${wordpressFilter.id}
      action: block

Create FirewallRule Resource

new FirewallRule(name: string, args: FirewallRuleArgs, opts?: CustomResourceOptions);
@overload
def FirewallRule(resource_name: str,
                 opts: Optional[ResourceOptions] = None,
                 action: Optional[str] = None,
                 description: Optional[str] = None,
                 filter_id: Optional[str] = None,
                 paused: Optional[bool] = None,
                 priority: Optional[int] = None,
                 products: Optional[Sequence[str]] = None,
                 zone_id: Optional[str] = None)
@overload
def FirewallRule(resource_name: str,
                 args: FirewallRuleArgs,
                 opts: Optional[ResourceOptions] = None)
func NewFirewallRule(ctx *Context, name string, args FirewallRuleArgs, opts ...ResourceOption) (*FirewallRule, error)
public FirewallRule(string name, FirewallRuleArgs args, CustomResourceOptions? opts = null)
public FirewallRule(String name, FirewallRuleArgs args)
public FirewallRule(String name, FirewallRuleArgs args, CustomResourceOptions options)
type: cloudflare:FirewallRule
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

name string
The unique name of the resource.
args FirewallRuleArgs
The arguments to resource properties.
opts CustomResourceOptions
Bag of options to control resource's behavior.
resource_name str
The unique name of the resource.
args FirewallRuleArgs
The arguments to resource properties.
opts ResourceOptions
Bag of options to control resource's behavior.
ctx Context
Context object for the current deployment.
name string
The unique name of the resource.
args FirewallRuleArgs
The arguments to resource properties.
opts ResourceOption
Bag of options to control resource's behavior.
name string
The unique name of the resource.
args FirewallRuleArgs
The arguments to resource properties.
opts CustomResourceOptions
Bag of options to control resource's behavior.
name String
The unique name of the resource.
args FirewallRuleArgs
The arguments to resource properties.
options CustomResourceOptions
Bag of options to control resource's behavior.

FirewallRule Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

Inputs

The FirewallRule resource accepts the following input properties:

Action string

The action to apply to a matched request. Available values: block, challenge, allow, js_challenge, managed_challenge, log, bypass.

FilterId string

The identifier of the Filter to use for determining if the Firewall Rule should be triggered.

ZoneId string

The zone identifier to target for the resource. Modifying this attribute will force creation of a new resource.

Description string

A description of the rule to help identify it.

Paused bool

Whether this filter based firewall rule is currently paused.

Priority int

The priority of the rule to allow control of processing order. A lower number indicates high priority. If not provided, any rules with a priority will be sequenced before those without.

Products List<string>

List of products to bypass for a request when the bypass action is used. Available values: zoneLockdown, uaBlock, bic, hot, securityLevel, rateLimit, waf.

Action string

The action to apply to a matched request. Available values: block, challenge, allow, js_challenge, managed_challenge, log, bypass.

FilterId string

The identifier of the Filter to use for determining if the Firewall Rule should be triggered.

ZoneId string

The zone identifier to target for the resource. Modifying this attribute will force creation of a new resource.

Description string

A description of the rule to help identify it.

Paused bool

Whether this filter based firewall rule is currently paused.

Priority int

The priority of the rule to allow control of processing order. A lower number indicates high priority. If not provided, any rules with a priority will be sequenced before those without.

Products []string

List of products to bypass for a request when the bypass action is used. Available values: zoneLockdown, uaBlock, bic, hot, securityLevel, rateLimit, waf.

action String

The action to apply to a matched request. Available values: block, challenge, allow, js_challenge, managed_challenge, log, bypass.

filterId String

The identifier of the Filter to use for determining if the Firewall Rule should be triggered.

zoneId String

The zone identifier to target for the resource. Modifying this attribute will force creation of a new resource.

description String

A description of the rule to help identify it.

paused Boolean

Whether this filter based firewall rule is currently paused.

priority Integer

The priority of the rule to allow control of processing order. A lower number indicates high priority. If not provided, any rules with a priority will be sequenced before those without.

products List<String>

List of products to bypass for a request when the bypass action is used. Available values: zoneLockdown, uaBlock, bic, hot, securityLevel, rateLimit, waf.

action string

The action to apply to a matched request. Available values: block, challenge, allow, js_challenge, managed_challenge, log, bypass.

filterId string

The identifier of the Filter to use for determining if the Firewall Rule should be triggered.

zoneId string

The zone identifier to target for the resource. Modifying this attribute will force creation of a new resource.

description string

A description of the rule to help identify it.

paused boolean

Whether this filter based firewall rule is currently paused.

priority number

The priority of the rule to allow control of processing order. A lower number indicates high priority. If not provided, any rules with a priority will be sequenced before those without.

products string[]

List of products to bypass for a request when the bypass action is used. Available values: zoneLockdown, uaBlock, bic, hot, securityLevel, rateLimit, waf.

action str

The action to apply to a matched request. Available values: block, challenge, allow, js_challenge, managed_challenge, log, bypass.

filter_id str

The identifier of the Filter to use for determining if the Firewall Rule should be triggered.

zone_id str

The zone identifier to target for the resource. Modifying this attribute will force creation of a new resource.

description str

A description of the rule to help identify it.

paused bool

Whether this filter based firewall rule is currently paused.

priority int

The priority of the rule to allow control of processing order. A lower number indicates high priority. If not provided, any rules with a priority will be sequenced before those without.

products Sequence[str]

List of products to bypass for a request when the bypass action is used. Available values: zoneLockdown, uaBlock, bic, hot, securityLevel, rateLimit, waf.

action String

The action to apply to a matched request. Available values: block, challenge, allow, js_challenge, managed_challenge, log, bypass.

filterId String

The identifier of the Filter to use for determining if the Firewall Rule should be triggered.

zoneId String

The zone identifier to target for the resource. Modifying this attribute will force creation of a new resource.

description String

A description of the rule to help identify it.

paused Boolean

Whether this filter based firewall rule is currently paused.

priority Number

The priority of the rule to allow control of processing order. A lower number indicates high priority. If not provided, any rules with a priority will be sequenced before those without.

products List<String>

List of products to bypass for a request when the bypass action is used. Available values: zoneLockdown, uaBlock, bic, hot, securityLevel, rateLimit, waf.

Outputs

All input properties are implicitly available as output properties. Additionally, the FirewallRule resource produces the following output properties:

Id string

The provider-assigned unique ID for this managed resource.

Id string

The provider-assigned unique ID for this managed resource.

id String

The provider-assigned unique ID for this managed resource.

id string

The provider-assigned unique ID for this managed resource.

id str

The provider-assigned unique ID for this managed resource.

id String

The provider-assigned unique ID for this managed resource.

Look up Existing FirewallRule Resource

Get an existing FirewallRule resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: FirewallRuleState, opts?: CustomResourceOptions): FirewallRule
@staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        action: Optional[str] = None,
        description: Optional[str] = None,
        filter_id: Optional[str] = None,
        paused: Optional[bool] = None,
        priority: Optional[int] = None,
        products: Optional[Sequence[str]] = None,
        zone_id: Optional[str] = None) -> FirewallRule
func GetFirewallRule(ctx *Context, name string, id IDInput, state *FirewallRuleState, opts ...ResourceOption) (*FirewallRule, error)
public static FirewallRule Get(string name, Input<string> id, FirewallRuleState? state, CustomResourceOptions? opts = null)
public static FirewallRule get(String name, Output<String> id, FirewallRuleState state, CustomResourceOptions options)
Resource lookup is not supported in YAML
name
The unique name of the resulting resource.
id
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
resource_name
The unique name of the resulting resource.
id
The unique provider ID of the resource to lookup.
name
The unique name of the resulting resource.
id
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
name
The unique name of the resulting resource.
id
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
name
The unique name of the resulting resource.
id
The unique provider ID of the resource to lookup.
state
Any extra arguments used during the lookup.
opts
A bag of options that control this resource's behavior.
The following state arguments are supported:
Action string

The action to apply to a matched request. Available values: block, challenge, allow, js_challenge, managed_challenge, log, bypass.

Description string

A description of the rule to help identify it.

FilterId string

The identifier of the Filter to use for determining if the Firewall Rule should be triggered.

Paused bool

Whether this filter based firewall rule is currently paused.

Priority int

The priority of the rule to allow control of processing order. A lower number indicates high priority. If not provided, any rules with a priority will be sequenced before those without.

Products List<string>

List of products to bypass for a request when the bypass action is used. Available values: zoneLockdown, uaBlock, bic, hot, securityLevel, rateLimit, waf.

ZoneId string

The zone identifier to target for the resource. Modifying this attribute will force creation of a new resource.

Action string

The action to apply to a matched request. Available values: block, challenge, allow, js_challenge, managed_challenge, log, bypass.

Description string

A description of the rule to help identify it.

FilterId string

The identifier of the Filter to use for determining if the Firewall Rule should be triggered.

Paused bool

Whether this filter based firewall rule is currently paused.

Priority int

The priority of the rule to allow control of processing order. A lower number indicates high priority. If not provided, any rules with a priority will be sequenced before those without.

Products []string

List of products to bypass for a request when the bypass action is used. Available values: zoneLockdown, uaBlock, bic, hot, securityLevel, rateLimit, waf.

ZoneId string

The zone identifier to target for the resource. Modifying this attribute will force creation of a new resource.

action String

The action to apply to a matched request. Available values: block, challenge, allow, js_challenge, managed_challenge, log, bypass.

description String

A description of the rule to help identify it.

filterId String

The identifier of the Filter to use for determining if the Firewall Rule should be triggered.

paused Boolean

Whether this filter based firewall rule is currently paused.

priority Integer

The priority of the rule to allow control of processing order. A lower number indicates high priority. If not provided, any rules with a priority will be sequenced before those without.

products List<String>

List of products to bypass for a request when the bypass action is used. Available values: zoneLockdown, uaBlock, bic, hot, securityLevel, rateLimit, waf.

zoneId String

The zone identifier to target for the resource. Modifying this attribute will force creation of a new resource.

action string

The action to apply to a matched request. Available values: block, challenge, allow, js_challenge, managed_challenge, log, bypass.

description string

A description of the rule to help identify it.

filterId string

The identifier of the Filter to use for determining if the Firewall Rule should be triggered.

paused boolean

Whether this filter based firewall rule is currently paused.

priority number

The priority of the rule to allow control of processing order. A lower number indicates high priority. If not provided, any rules with a priority will be sequenced before those without.

products string[]

List of products to bypass for a request when the bypass action is used. Available values: zoneLockdown, uaBlock, bic, hot, securityLevel, rateLimit, waf.

zoneId string

The zone identifier to target for the resource. Modifying this attribute will force creation of a new resource.

action str

The action to apply to a matched request. Available values: block, challenge, allow, js_challenge, managed_challenge, log, bypass.

description str

A description of the rule to help identify it.

filter_id str

The identifier of the Filter to use for determining if the Firewall Rule should be triggered.

paused bool

Whether this filter based firewall rule is currently paused.

priority int

The priority of the rule to allow control of processing order. A lower number indicates high priority. If not provided, any rules with a priority will be sequenced before those without.

products Sequence[str]

List of products to bypass for a request when the bypass action is used. Available values: zoneLockdown, uaBlock, bic, hot, securityLevel, rateLimit, waf.

zone_id str

The zone identifier to target for the resource. Modifying this attribute will force creation of a new resource.

action String

The action to apply to a matched request. Available values: block, challenge, allow, js_challenge, managed_challenge, log, bypass.

description String

A description of the rule to help identify it.

filterId String

The identifier of the Filter to use for determining if the Firewall Rule should be triggered.

paused Boolean

Whether this filter based firewall rule is currently paused.

priority Number

The priority of the rule to allow control of processing order. A lower number indicates high priority. If not provided, any rules with a priority will be sequenced before those without.

products List<String>

List of products to bypass for a request when the bypass action is used. Available values: zoneLockdown, uaBlock, bic, hot, securityLevel, rateLimit, waf.

zoneId String

The zone identifier to target for the resource. Modifying this attribute will force creation of a new resource.

Import

 $ pulumi import cloudflare:index/firewallRule:FirewallRule example <zone_id>/<firewall_rule_id>

Package Details

Repository
Cloudflare pulumi/pulumi-cloudflare
License
Apache-2.0
Notes

This Pulumi package is based on the cloudflare Terraform Provider.