panos 2.0.0, Apr 15 25

panos 2.0.0 published on Tuesday, Apr 15, 2025 by paloaltonetworks

paloaltonetworks/terraform-provider-panos

panos.SecurityPolicy

Explore with Pulumi AI

panos 2.0.0 published on Tuesday, Apr 15, 2025 by paloaltonetworks

paloaltonetworks/terraform-provider-panos

Example Usage

Coming soon!

Coming soon!

Coming soon!

Coming soon!

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.panos.DeviceGroup;
import com.pulumi.panos.DeviceGroupArgs;
import com.pulumi.panos.inputs.DeviceGroupLocationArgs;
import com.pulumi.panos.inputs.DeviceGroupLocationPanoramaArgs;
import com.pulumi.panos.SecurityPolicy;
import com.pulumi.panos.SecurityPolicyArgs;
import com.pulumi.panos.inputs.SecurityPolicyLocationArgs;
import com.pulumi.panos.inputs.SecurityPolicyRuleArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example = new DeviceGroup("example", DeviceGroupArgs.builder()
            .location(DeviceGroupLocationArgs.builder()
                .panorama()
                .build())
            .build());

        // Manages the entire security policy
        var name = new SecurityPolicy("name", SecurityPolicyArgs.builder()
            .location(SecurityPolicyLocationArgs.builder()
                .device_group(%!v(PANIC=Format method: runtime error: invalid memory address or nil pointer dereference))
                .build())
            .rules(SecurityPolicyRuleArgs.builder()
                .name("rule-1")
                .sourceZones("any")
                .sourceAddresses("1.1.1.1")
                .destinationZones("any")
                .destinationAddresses("172.0.0.0/8")
                .services("any")
                .applications("any")
                .build())
            .build());

    }
}

resources:
  # Manages the entire security policy
  name:
    type: panos:SecurityPolicy
    properties:
      location:
        device_group:
          name: ${example.name}
      rules:
        - name: rule-1
          sourceZones:
            - any
          sourceAddresses:
            - 1.1.1.1
          destinationZones:
            - any
          destinationAddresses:
            - 172.0.0.0/8
          services:
            - any
          applications:
            - any
  example:
    type: panos:DeviceGroup
    properties:
      location:
        panorama: {}

Create SecurityPolicy Resource

Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

Constructor syntax

new SecurityPolicy(name: string, args: SecurityPolicyArgs, opts?: CustomResourceOptions);

@overload
def SecurityPolicy(resource_name: str,
                   args: SecurityPolicyArgs,
                   opts: Optional[ResourceOptions] = None)

@overload
def SecurityPolicy(resource_name: str,
                   opts: Optional[ResourceOptions] = None,
                   location: Optional[SecurityPolicyLocationArgs] = None,
                   rules: Optional[Sequence[SecurityPolicyRuleArgs]] = None)

func NewSecurityPolicy(ctx *Context, name string, args SecurityPolicyArgs, opts ...ResourceOption) (*SecurityPolicy, error)

public SecurityPolicy(string name, SecurityPolicyArgs args, CustomResourceOptions? opts = null)

public SecurityPolicy(String name, SecurityPolicyArgs args)
public SecurityPolicy(String name, SecurityPolicyArgs args, CustomResourceOptions options)

type: panos:SecurityPolicy
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

Parameters

name string: The unique name of the resource.
args SecurityPolicyArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

resource_name str: The unique name of the resource.
args SecurityPolicyArgs: The arguments to resource properties.
opts ResourceOptions: Bag of options to control resource's behavior.

ctx Context: Context object for the current deployment.
name string: The unique name of the resource.
args SecurityPolicyArgs: The arguments to resource properties.
opts ResourceOption: Bag of options to control resource's behavior.

name string: The unique name of the resource.
args SecurityPolicyArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

name String: The unique name of the resource.
args SecurityPolicyArgs: The arguments to resource properties.
options CustomResourceOptions: Bag of options to control resource's behavior.

Constructor example

The following reference example uses placeholder values for all input properties.

var securityPolicyResource = new Panos.SecurityPolicy("securityPolicyResource", new()
{
    Location = new Panos.Inputs.SecurityPolicyLocationArgs
    {
        DeviceGroup = new Panos.Inputs.SecurityPolicyLocationDeviceGroupArgs
        {
            Name = "string",
            PanoramaDevice = "string",
            Rulebase = "string",
        },
        Shared = new Panos.Inputs.SecurityPolicyLocationSharedArgs
        {
            Rulebase = "string",
        },
        Vsys = new Panos.Inputs.SecurityPolicyLocationVsysArgs
        {
            Name = "string",
            NgfwDevice = "string",
        },
    },
    Rules = new[]
    {
        new Panos.Inputs.SecurityPolicyRuleArgs
        {
            Name = "string",
            NegateDestination = false,
            NegateSource = false,
            Description = "string",
            DestinationAddresses = new[]
            {
                "string",
            },
            DestinationHips = new[]
            {
                "string",
            },
            DestinationZones = new[]
            {
                "string",
            },
            DisableInspect = false,
            DisableServerResponseInspection = false,
            Disabled = false,
            GroupTag = "string",
            IcmpUnreachable = false,
            LogEnd = false,
            LogSetting = "string",
            LogStart = false,
            Categories = new[]
            {
                "string",
            },
            Applications = new[]
            {
                "string",
            },
            Qos = new Panos.Inputs.SecurityPolicyRuleQosArgs
            {
                Marking = new Panos.Inputs.SecurityPolicyRuleQosMarkingArgs
                {
                    FollowC2sFlow = null,
                    IpDscp = "string",
                    IpPrecedence = "string",
                },
            },
            ProfileSetting = new Panos.Inputs.SecurityPolicyRuleProfileSettingArgs
            {
                Groups = new[]
                {
                    "string",
                },
                Profiles = new Panos.Inputs.SecurityPolicyRuleProfileSettingProfilesArgs
                {
                    DataFilterings = new[]
                    {
                        "string",
                    },
                    FileBlockings = new[]
                    {
                        "string",
                    },
                    Gtps = new[]
                    {
                        "string",
                    },
                    Sctps = new[]
                    {
                        "string",
                    },
                    Spywares = new[]
                    {
                        "string",
                    },
                    UrlFilterings = new[]
                    {
                        "string",
                    },
                    Viri = new[]
                    {
                        "string",
                    },
                    Vulnerabilities = new[]
                    {
                        "string",
                    },
                    WildfireAnalyses = new[]
                    {
                        "string",
                    },
                },
            },
            Action = "string",
            RuleType = "string",
            Schedule = "string",
            Services = new[]
            {
                "string",
            },
            SourceAddresses = new[]
            {
                "string",
            },
            SourceHips = new[]
            {
                "string",
            },
            SourceImeis = new[]
            {
                "string",
            },
            SourceImsis = new[]
            {
                "string",
            },
            SourceNwSlices = new[]
            {
                "string",
            },
            SourceUsers = new[]
            {
                "string",
            },
            SourceZones = new[]
            {
                "string",
            },
            Tags = new[]
            {
                "string",
            },
            Target = new Panos.Inputs.SecurityPolicyRuleTargetArgs
            {
                Devices = new[]
                {
                    new Panos.Inputs.SecurityPolicyRuleTargetDeviceArgs
                    {
                        Name = "string",
                        Vsys = new[]
                        {
                            new Panos.Inputs.SecurityPolicyRuleTargetDeviceVsyArgs
                            {
                                Name = "string",
                            },
                        },
                    },
                },
                Negate = false,
                Tags = new[]
                {
                    "string",
                },
            },
        },
    },
});

example, err := panos.NewSecurityPolicy(ctx, "securityPolicyResource", &panos.SecurityPolicyArgs{
	Location: &panos.SecurityPolicyLocationArgs{
		DeviceGroup: &panos.SecurityPolicyLocationDeviceGroupArgs{
			Name:           pulumi.String("string"),
			PanoramaDevice: pulumi.String("string"),
			Rulebase:       pulumi.String("string"),
		},
		Shared: &panos.SecurityPolicyLocationSharedArgs{
			Rulebase: pulumi.String("string"),
		},
		Vsys: &panos.SecurityPolicyLocationVsysArgs{
			Name:       pulumi.String("string"),
			NgfwDevice: pulumi.String("string"),
		},
	},
	Rules: panos.SecurityPolicyRuleArray{
		&panos.SecurityPolicyRuleArgs{
			Name:              pulumi.String("string"),
			NegateDestination: pulumi.Bool(false),
			NegateSource:      pulumi.Bool(false),
			Description:       pulumi.String("string"),
			DestinationAddresses: pulumi.StringArray{
				pulumi.String("string"),
			},
			DestinationHips: pulumi.StringArray{
				pulumi.String("string"),
			},
			DestinationZones: pulumi.StringArray{
				pulumi.String("string"),
			},
			DisableInspect:                  pulumi.Bool(false),
			DisableServerResponseInspection: pulumi.Bool(false),
			Disabled:                        pulumi.Bool(false),
			GroupTag:                        pulumi.String("string"),
			IcmpUnreachable:                 pulumi.Bool(false),
			LogEnd:                          pulumi.Bool(false),
			LogSetting:                      pulumi.String("string"),
			LogStart:                        pulumi.Bool(false),
			Categories: pulumi.StringArray{
				pulumi.String("string"),
			},
			Applications: pulumi.StringArray{
				pulumi.String("string"),
			},
			Qos: &panos.SecurityPolicyRuleQosArgs{
				Marking: &panos.SecurityPolicyRuleQosMarkingArgs{
					FollowC2sFlow: &panos.SecurityPolicyRuleQosMarkingFollowC2sFlowArgs{},
					IpDscp:        pulumi.String("string"),
					IpPrecedence:  pulumi.String("string"),
				},
			},
			ProfileSetting: &panos.SecurityPolicyRuleProfileSettingArgs{
				Groups: pulumi.StringArray{
					pulumi.String("string"),
				},
				Profiles: &panos.SecurityPolicyRuleProfileSettingProfilesArgs{
					DataFilterings: pulumi.StringArray{
						pulumi.String("string"),
					},
					FileBlockings: pulumi.StringArray{
						pulumi.String("string"),
					},
					Gtps: pulumi.StringArray{
						pulumi.String("string"),
					},
					Sctps: pulumi.StringArray{
						pulumi.String("string"),
					},
					Spywares: pulumi.StringArray{
						pulumi.String("string"),
					},
					UrlFilterings: pulumi.StringArray{
						pulumi.String("string"),
					},
					Viri: pulumi.StringArray{
						pulumi.String("string"),
					},
					Vulnerabilities: pulumi.StringArray{
						pulumi.String("string"),
					},
					WildfireAnalyses: pulumi.StringArray{
						pulumi.String("string"),
					},
				},
			},
			Action:   pulumi.String("string"),
			RuleType: pulumi.String("string"),
			Schedule: pulumi.String("string"),
			Services: pulumi.StringArray{
				pulumi.String("string"),
			},
			SourceAddresses: pulumi.StringArray{
				pulumi.String("string"),
			},
			SourceHips: pulumi.StringArray{
				pulumi.String("string"),
			},
			SourceImeis: pulumi.StringArray{
				pulumi.String("string"),
			},
			SourceImsis: pulumi.StringArray{
				pulumi.String("string"),
			},
			SourceNwSlices: pulumi.StringArray{
				pulumi.String("string"),
			},
			SourceUsers: pulumi.StringArray{
				pulumi.String("string"),
			},
			SourceZones: pulumi.StringArray{
				pulumi.String("string"),
			},
			Tags: pulumi.StringArray{
				pulumi.String("string"),
			},
			Target: &panos.SecurityPolicyRuleTargetArgs{
				Devices: panos.SecurityPolicyRuleTargetDeviceArray{
					&panos.SecurityPolicyRuleTargetDeviceArgs{
						Name: pulumi.String("string"),
						Vsys: panos.SecurityPolicyRuleTargetDeviceVsyArray{
							&panos.SecurityPolicyRuleTargetDeviceVsyArgs{
								Name: pulumi.String("string"),
							},
						},
					},
				},
				Negate: pulumi.Bool(false),
				Tags: pulumi.StringArray{
					pulumi.String("string"),
				},
			},
		},
	},
})

var securityPolicyResource = new SecurityPolicy("securityPolicyResource", SecurityPolicyArgs.builder()
    .location(SecurityPolicyLocationArgs.builder()
        .deviceGroup(SecurityPolicyLocationDeviceGroupArgs.builder()
            .name("string")
            .panoramaDevice("string")
            .rulebase("string")
            .build())
        .shared(SecurityPolicyLocationSharedArgs.builder()
            .rulebase("string")
            .build())
        .vsys(SecurityPolicyLocationVsysArgs.builder()
            .name("string")
            .ngfwDevice("string")
            .build())
        .build())
    .rules(SecurityPolicyRuleArgs.builder()
        .name("string")
        .negateDestination(false)
        .negateSource(false)
        .description("string")
        .destinationAddresses("string")
        .destinationHips("string")
        .destinationZones("string")
        .disableInspect(false)
        .disableServerResponseInspection(false)
        .disabled(false)
        .groupTag("string")
        .icmpUnreachable(false)
        .logEnd(false)
        .logSetting("string")
        .logStart(false)
        .categories("string")
        .applications("string")
        .qos(SecurityPolicyRuleQosArgs.builder()
            .marking(SecurityPolicyRuleQosMarkingArgs.builder()
                .followC2sFlow()
                .ipDscp("string")
                .ipPrecedence("string")
                .build())
            .build())
        .profileSetting(SecurityPolicyRuleProfileSettingArgs.builder()
            .groups("string")
            .profiles(SecurityPolicyRuleProfileSettingProfilesArgs.builder()
                .dataFilterings("string")
                .fileBlockings("string")
                .gtps("string")
                .sctps("string")
                .spywares("string")
                .urlFilterings("string")
                .viri("string")
                .vulnerabilities("string")
                .wildfireAnalyses("string")
                .build())
            .build())
        .action("string")
        .ruleType("string")
        .schedule("string")
        .services("string")
        .sourceAddresses("string")
        .sourceHips("string")
        .sourceImeis("string")
        .sourceImsis("string")
        .sourceNwSlices("string")
        .sourceUsers("string")
        .sourceZones("string")
        .tags("string")
        .target(SecurityPolicyRuleTargetArgs.builder()
            .devices(SecurityPolicyRuleTargetDeviceArgs.builder()
                .name("string")
                .vsys(SecurityPolicyRuleTargetDeviceVsyArgs.builder()
                    .name("string")
                    .build())
                .build())
            .negate(false)
            .tags("string")
            .build())
        .build())
    .build());

security_policy_resource = panos.SecurityPolicy("securityPolicyResource",
    location={
        "device_group": {
            "name": "string",
            "panorama_device": "string",
            "rulebase": "string",
        },
        "shared": {
            "rulebase": "string",
        },
        "vsys": {
            "name": "string",
            "ngfw_device": "string",
        },
    },
    rules=[{
        "name": "string",
        "negate_destination": False,
        "negate_source": False,
        "description": "string",
        "destination_addresses": ["string"],
        "destination_hips": ["string"],
        "destination_zones": ["string"],
        "disable_inspect": False,
        "disable_server_response_inspection": False,
        "disabled": False,
        "group_tag": "string",
        "icmp_unreachable": False,
        "log_end": False,
        "log_setting": "string",
        "log_start": False,
        "categories": ["string"],
        "applications": ["string"],
        "qos": {
            "marking": {
                "follow_c2s_flow": {},
                "ip_dscp": "string",
                "ip_precedence": "string",
            },
        },
        "profile_setting": {
            "groups": ["string"],
            "profiles": {
                "data_filterings": ["string"],
                "file_blockings": ["string"],
                "gtps": ["string"],
                "sctps": ["string"],
                "spywares": ["string"],
                "url_filterings": ["string"],
                "viri": ["string"],
                "vulnerabilities": ["string"],
                "wildfire_analyses": ["string"],
            },
        },
        "action": "string",
        "rule_type": "string",
        "schedule": "string",
        "services": ["string"],
        "source_addresses": ["string"],
        "source_hips": ["string"],
        "source_imeis": ["string"],
        "source_imsis": ["string"],
        "source_nw_slices": ["string"],
        "source_users": ["string"],
        "source_zones": ["string"],
        "tags": ["string"],
        "target": {
            "devices": [{
                "name": "string",
                "vsys": [{
                    "name": "string",
                }],
            }],
            "negate": False,
            "tags": ["string"],
        },
    }])

const securityPolicyResource = new panos.SecurityPolicy("securityPolicyResource", {
    location: {
        deviceGroup: {
            name: "string",
            panoramaDevice: "string",
            rulebase: "string",
        },
        shared: {
            rulebase: "string",
        },
        vsys: {
            name: "string",
            ngfwDevice: "string",
        },
    },
    rules: [{
        name: "string",
        negateDestination: false,
        negateSource: false,
        description: "string",
        destinationAddresses: ["string"],
        destinationHips: ["string"],
        destinationZones: ["string"],
        disableInspect: false,
        disableServerResponseInspection: false,
        disabled: false,
        groupTag: "string",
        icmpUnreachable: false,
        logEnd: false,
        logSetting: "string",
        logStart: false,
        categories: ["string"],
        applications: ["string"],
        qos: {
            marking: {
                followC2sFlow: {},
                ipDscp: "string",
                ipPrecedence: "string",
            },
        },
        profileSetting: {
            groups: ["string"],
            profiles: {
                dataFilterings: ["string"],
                fileBlockings: ["string"],
                gtps: ["string"],
                sctps: ["string"],
                spywares: ["string"],
                urlFilterings: ["string"],
                viri: ["string"],
                vulnerabilities: ["string"],
                wildfireAnalyses: ["string"],
            },
        },
        action: "string",
        ruleType: "string",
        schedule: "string",
        services: ["string"],
        sourceAddresses: ["string"],
        sourceHips: ["string"],
        sourceImeis: ["string"],
        sourceImsis: ["string"],
        sourceNwSlices: ["string"],
        sourceUsers: ["string"],
        sourceZones: ["string"],
        tags: ["string"],
        target: {
            devices: [{
                name: "string",
                vsys: [{
                    name: "string",
                }],
            }],
            negate: false,
            tags: ["string"],
        },
    }],
});

type: panos:SecurityPolicy
properties:
    location:
        deviceGroup:
            name: string
            panoramaDevice: string
            rulebase: string
        shared:
            rulebase: string
        vsys:
            name: string
            ngfwDevice: string
    rules:
        - action: string
          applications:
            - string
          categories:
            - string
          description: string
          destinationAddresses:
            - string
          destinationHips:
            - string
          destinationZones:
            - string
          disableInspect: false
          disableServerResponseInspection: false
          disabled: false
          groupTag: string
          icmpUnreachable: false
          logEnd: false
          logSetting: string
          logStart: false
          name: string
          negateDestination: false
          negateSource: false
          profileSetting:
            groups:
                - string
            profiles:
                dataFilterings:
                    - string
                fileBlockings:
                    - string
                gtps:
                    - string
                sctps:
                    - string
                spywares:
                    - string
                urlFilterings:
                    - string
                viri:
                    - string
                vulnerabilities:
                    - string
                wildfireAnalyses:
                    - string
          qos:
            marking:
                followC2sFlow: {}
                ipDscp: string
                ipPrecedence: string
          ruleType: string
          schedule: string
          services:
            - string
          sourceAddresses:
            - string
          sourceHips:
            - string
          sourceImeis:
            - string
          sourceImsis:
            - string
          sourceNwSlices:
            - string
          sourceUsers:
            - string
          sourceZones:
            - string
          tags:
            - string
          target:
            devices:
                - name: string
                  vsys:
                    - name: string
            negate: false
            tags:
                - string

SecurityPolicy Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

Inputs

In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

The SecurityPolicy resource accepts the following input properties:

Location SecurityPolicyLocation: The location of this object.
Rules List<SecurityPolicyRule>

Location SecurityPolicyLocationArgs: The location of this object.
Rules []SecurityPolicyRuleArgs

location SecurityPolicyLocation: The location of this object.
rules List<SecurityPolicyRule>

location SecurityPolicyLocation: The location of this object.
rules SecurityPolicyRule[]

location SecurityPolicyLocationArgs: The location of this object.
rules Sequence[SecurityPolicyRuleArgs]

location Property Map: The location of this object.
rules List<Property Map>

Outputs

All input properties are implicitly available as output properties. Additionally, the SecurityPolicy resource produces the following output properties:

Id string: The provider-assigned unique ID for this managed resource.

Id string: The provider-assigned unique ID for this managed resource.

id String: The provider-assigned unique ID for this managed resource.

id string: The provider-assigned unique ID for this managed resource.

id str: The provider-assigned unique ID for this managed resource.

id String: The provider-assigned unique ID for this managed resource.

Look up Existing SecurityPolicy Resource

Get an existing SecurityPolicy resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: SecurityPolicyState, opts?: CustomResourceOptions): SecurityPolicy

@staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        location: Optional[SecurityPolicyLocationArgs] = None,
        rules: Optional[Sequence[SecurityPolicyRuleArgs]] = None) -> SecurityPolicy

func GetSecurityPolicy(ctx *Context, name string, id IDInput, state *SecurityPolicyState, opts ...ResourceOption) (*SecurityPolicy, error)

public static SecurityPolicy Get(string name, Input<string> id, SecurityPolicyState? state, CustomResourceOptions? opts = null)

public static SecurityPolicy get(String name, Output<String> id, SecurityPolicyState state, CustomResourceOptions options)

resources:  _:    type: panos:SecurityPolicy    get:      id: ${id}

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

resource_name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

The following state arguments are supported:

Location SecurityPolicyLocation: The location of this object.
Rules List<SecurityPolicyRule>

Location SecurityPolicyLocationArgs: The location of this object.
Rules []SecurityPolicyRuleArgs

location SecurityPolicyLocation: The location of this object.
rules List<SecurityPolicyRule>

location SecurityPolicyLocation: The location of this object.
rules SecurityPolicyRule[]

location SecurityPolicyLocationArgs: The location of this object.
rules Sequence[SecurityPolicyRuleArgs]

location Property Map: The location of this object.
rules List<Property Map>

Supporting Types

SecurityPolicyLocation, SecurityPolicyLocationArgs

DeviceGroup SecurityPolicyLocationDeviceGroup: Located in a specific device group.
Shared SecurityPolicyLocationShared: Located in a shared rulebase
Vsys SecurityPolicyLocationVsys: Located in a specific vsys.

DeviceGroup SecurityPolicyLocationDeviceGroup: Located in a specific device group.
Shared SecurityPolicyLocationShared: Located in a shared rulebase
Vsys SecurityPolicyLocationVsys: Located in a specific vsys.

deviceGroup SecurityPolicyLocationDeviceGroup: Located in a specific device group.
shared SecurityPolicyLocationShared: Located in a shared rulebase
vsys SecurityPolicyLocationVsys: Located in a specific vsys.

deviceGroup SecurityPolicyLocationDeviceGroup: Located in a specific device group.
shared SecurityPolicyLocationShared: Located in a shared rulebase
vsys SecurityPolicyLocationVsys: Located in a specific vsys.

device_group SecurityPolicyLocationDeviceGroup: Located in a specific device group.
shared SecurityPolicyLocationShared: Located in a shared rulebase
vsys SecurityPolicyLocationVsys: Located in a specific vsys.

deviceGroup Property Map: Located in a specific device group.
shared Property Map: Located in a shared rulebase
vsys Property Map: Located in a specific vsys.

SecurityPolicyLocationDeviceGroup, SecurityPolicyLocationDeviceGroupArgs

Name string: The device group.
PanoramaDevice string: The panorama device.
Rulebase string: The rulebase.

Name string: The device group.
PanoramaDevice string: The panorama device.
Rulebase string: The rulebase.

name String: The device group.
panoramaDevice String: The panorama device.
rulebase String: The rulebase.

name string: The device group.
panoramaDevice string: The panorama device.
rulebase string: The rulebase.

name str: The device group.
panorama_device str: The panorama device.
rulebase str: The rulebase.

name String: The device group.
panoramaDevice String: The panorama device.
rulebase String: The rulebase.

SecurityPolicyLocationShared, SecurityPolicyLocationSharedArgs

Rulebase string: Rulebase name

Rulebase string: Rulebase name

rulebase String: Rulebase name

rulebase string: Rulebase name

rulebase str: Rulebase name

rulebase String: Rulebase name

SecurityPolicyLocationVsys, SecurityPolicyLocationVsysArgs

Name string: The vsys name
NgfwDevice string: The NGFW device

Name string: The vsys name
NgfwDevice string: The NGFW device

name String: The vsys name
ngfwDevice String: The NGFW device

name string: The vsys name
ngfwDevice string: The NGFW device

name str: The vsys name
ngfw_device str: The NGFW device

name String: The vsys name
ngfwDevice String: The NGFW device

SecurityPolicyRule, SecurityPolicyRuleArgs

Name string
Action string
Applications List<string>
Categories List<string>
Description string
DestinationAddresses List<string>
DestinationHips List<string>
DestinationZones List<string>
DisableInspect bool
DisableServerResponseInspection bool: Disable inspection of server side traffic
Disabled bool: Disable the rule
GroupTag string
IcmpUnreachable bool: Send ICMP unreachable error when action is drop or reset
LogEnd bool: Log at session end (required for certain ACC tables)
LogSetting string
LogStart bool: Log at session start
NegateDestination bool
NegateSource bool
ProfileSetting SecurityPolicyRuleProfileSetting
Qos SecurityPolicyRuleQos
RuleType string
Schedule string
Services List<string>
SourceAddresses List<string>
SourceHips List<string>
SourceImeis List<string>
SourceImsis List<string>
SourceNwSlices List<string>
SourceUsers List<string>
SourceZones List<string>
Tags List<string>
Target SecurityPolicyRuleTarget

Name string
Action string
Applications []string
Categories []string
Description string
DestinationAddresses []string
DestinationHips []string
DestinationZones []string
DisableInspect bool
DisableServerResponseInspection bool: Disable inspection of server side traffic
Disabled bool: Disable the rule
GroupTag string
IcmpUnreachable bool: Send ICMP unreachable error when action is drop or reset
LogEnd bool: Log at session end (required for certain ACC tables)
LogSetting string
LogStart bool: Log at session start
NegateDestination bool
NegateSource bool
ProfileSetting SecurityPolicyRuleProfileSetting
Qos SecurityPolicyRuleQos
RuleType string
Schedule string
Services []string
SourceAddresses []string
SourceHips []string
SourceImeis []string
SourceImsis []string
SourceNwSlices []string
SourceUsers []string
SourceZones []string
Tags []string
Target SecurityPolicyRuleTarget

name String
action String
applications List<String>
categories List<String>
description String
destinationAddresses List<String>
destinationHips List<String>
destinationZones List<String>
disableInspect Boolean
disableServerResponseInspection Boolean: Disable inspection of server side traffic
disabled Boolean: Disable the rule
groupTag String
icmpUnreachable Boolean: Send ICMP unreachable error when action is drop or reset
logEnd Boolean: Log at session end (required for certain ACC tables)
logSetting String
logStart Boolean: Log at session start
negateDestination Boolean
negateSource Boolean
profileSetting SecurityPolicyRuleProfileSetting
qos SecurityPolicyRuleQos
ruleType String
schedule String
services List<String>
sourceAddresses List<String>
sourceHips List<String>
sourceImeis List<String>
sourceImsis List<String>
sourceNwSlices List<String>
sourceUsers List<String>
sourceZones List<String>
tags List<String>
target SecurityPolicyRuleTarget

name string
action string
applications string[]
categories string[]
description string
destinationAddresses string[]
destinationHips string[]
destinationZones string[]
disableInspect boolean
disableServerResponseInspection boolean: Disable inspection of server side traffic
disabled boolean: Disable the rule
groupTag string
icmpUnreachable boolean: Send ICMP unreachable error when action is drop or reset
logEnd boolean: Log at session end (required for certain ACC tables)
logSetting string
logStart boolean: Log at session start
negateDestination boolean
negateSource boolean
profileSetting SecurityPolicyRuleProfileSetting
qos SecurityPolicyRuleQos
ruleType string
schedule string
services string[]
sourceAddresses string[]
sourceHips string[]
sourceImeis string[]
sourceImsis string[]
sourceNwSlices string[]
sourceUsers string[]
sourceZones string[]
tags string[]
target SecurityPolicyRuleTarget

name str
action str
applications Sequence[str]
categories Sequence[str]
description str
destination_addresses Sequence[str]
destination_hips Sequence[str]
destination_zones Sequence[str]
disable_inspect bool
disable_server_response_inspection bool: Disable inspection of server side traffic
disabled bool: Disable the rule
group_tag str
icmp_unreachable bool: Send ICMP unreachable error when action is drop or reset
log_end bool: Log at session end (required for certain ACC tables)
log_setting str
log_start bool: Log at session start
negate_destination bool
negate_source bool
profile_setting SecurityPolicyRuleProfileSetting
qos SecurityPolicyRuleQos
rule_type str
schedule str
services Sequence[str]
source_addresses Sequence[str]
source_hips Sequence[str]
source_imeis Sequence[str]
source_imsis Sequence[str]
source_nw_slices Sequence[str]
source_users Sequence[str]
source_zones Sequence[str]
tags Sequence[str]
target SecurityPolicyRuleTarget

name String
action String
applications List<String>
categories List<String>
description String
destinationAddresses List<String>
destinationHips List<String>
destinationZones List<String>
disableInspect Boolean
disableServerResponseInspection Boolean: Disable inspection of server side traffic
disabled Boolean: Disable the rule
groupTag String
icmpUnreachable Boolean: Send ICMP unreachable error when action is drop or reset
logEnd Boolean: Log at session end (required for certain ACC tables)
logSetting String
logStart Boolean: Log at session start
negateDestination Boolean
negateSource Boolean
profileSetting Property Map
qos Property Map
ruleType String
schedule String
services List<String>
sourceAddresses List<String>
sourceHips List<String>
sourceImeis List<String>
sourceImsis List<String>
sourceNwSlices List<String>
sourceUsers List<String>
sourceZones List<String>
tags List<String>
target Property Map

SecurityPolicyRuleProfileSetting, SecurityPolicyRuleProfileSettingArgs

Groups List<string>
Profiles SecurityPolicyRuleProfileSettingProfiles

Groups []string
Profiles SecurityPolicyRuleProfileSettingProfiles

groups List<String>
profiles SecurityPolicyRuleProfileSettingProfiles

groups string[]
profiles SecurityPolicyRuleProfileSettingProfiles

groups Sequence[str]
profiles SecurityPolicyRuleProfileSettingProfiles

groups List<String>
profiles Property Map

SecurityPolicyRuleProfileSettingProfiles, SecurityPolicyRuleProfileSettingProfilesArgs

DataFilterings List<string>
FileBlockings List<string>
Gtps List<string>
Sctps List<string>
Spywares List<string>
UrlFilterings List<string>
Viri List<string>
Vulnerabilities List<string>
WildfireAnalyses List<string>

DataFilterings []string
FileBlockings []string
Gtps []string
Sctps []string
Spywares []string
UrlFilterings []string
Viri []string
Vulnerabilities []string
WildfireAnalyses []string

dataFilterings List<String>
fileBlockings List<String>
gtps List<String>
sctps List<String>
spywares List<String>
urlFilterings List<String>
viri List<String>
vulnerabilities List<String>
wildfireAnalyses List<String>

dataFilterings string[]
fileBlockings string[]
gtps string[]
sctps string[]
spywares string[]
urlFilterings string[]
viri string[]
vulnerabilities string[]
wildfireAnalyses string[]

data_filterings Sequence[str]
file_blockings Sequence[str]
gtps Sequence[str]
sctps Sequence[str]
spywares Sequence[str]
url_filterings Sequence[str]
viri Sequence[str]
vulnerabilities Sequence[str]
wildfire_analyses Sequence[str]

dataFilterings List<String>
fileBlockings List<String>
gtps List<String>
sctps List<String>
spywares List<String>
urlFilterings List<String>
viri List<String>
vulnerabilities List<String>
wildfireAnalyses List<String>

SecurityPolicyRuleQos, SecurityPolicyRuleQosArgs

Marking SecurityPolicyRuleQosMarking

Marking SecurityPolicyRuleQosMarking

marking SecurityPolicyRuleQosMarking

marking SecurityPolicyRuleQosMarking

marking SecurityPolicyRuleQosMarking

marking Property Map

SecurityPolicyRuleQosMarking, SecurityPolicyRuleQosMarkingArgs

FollowC2sFlow SecurityPolicyRuleQosMarkingFollowC2sFlow
IpDscp string: IP DSCP
IpPrecedence string: IP Precedence

FollowC2sFlow SecurityPolicyRuleQosMarkingFollowC2sFlow
IpDscp string: IP DSCP
IpPrecedence string: IP Precedence

followC2sFlow SecurityPolicyRuleQosMarkingFollowC2sFlow
ipDscp String: IP DSCP
ipPrecedence String: IP Precedence

followC2sFlow SecurityPolicyRuleQosMarkingFollowC2sFlow
ipDscp string: IP DSCP
ipPrecedence string: IP Precedence

follow_c2s_flow SecurityPolicyRuleQosMarkingFollowC2sFlow
ip_dscp str: IP DSCP
ip_precedence str: IP Precedence

followC2sFlow Property Map
ipDscp String: IP DSCP
ipPrecedence String: IP Precedence

SecurityPolicyRuleTarget, SecurityPolicyRuleTargetArgs

Devices List<SecurityPolicyRuleTargetDevice>
Negate bool: Target to all but these specified devices and tags
Tags List<string>

Devices []SecurityPolicyRuleTargetDevice
Negate bool: Target to all but these specified devices and tags
Tags []string

devices List<SecurityPolicyRuleTargetDevice>
negate Boolean: Target to all but these specified devices and tags
tags List<String>

devices SecurityPolicyRuleTargetDevice[]
negate boolean: Target to all but these specified devices and tags
tags string[]

devices Sequence[SecurityPolicyRuleTargetDevice]
negate bool: Target to all but these specified devices and tags
tags Sequence[str]

devices List<Property Map>
negate Boolean: Target to all but these specified devices and tags
tags List<String>

SecurityPolicyRuleTargetDevice, SecurityPolicyRuleTargetDeviceArgs

Name string
Vsys List<SecurityPolicyRuleTargetDeviceVsy>

Name string
Vsys []SecurityPolicyRuleTargetDeviceVsy

name String
vsys List<SecurityPolicyRuleTargetDeviceVsy>

name string
vsys SecurityPolicyRuleTargetDeviceVsy[]

name str
vsys Sequence[SecurityPolicyRuleTargetDeviceVsy]

name String
vsys List<Property Map>

SecurityPolicyRuleTargetDeviceVsy, SecurityPolicyRuleTargetDeviceVsyArgs

Name string

Name string

name String

name string

name str

name String

Import

The entire policy can be imported by providing the following base64 encoded object as the ID

{

location = {

    device_group = {

    name = "example-device-group"

    rulebase = "pre-rulebase"

    panorama_device = "localhost.localdomain"

    }

}

names = [

    "rule-1", <- the first rule in the policy

]

}

$ pulumi import panos:index/securityPolicy:SecurityPolicy example $(echo '{"location":{"device_group":{"name":"example-device-group","panorama_device":"localhost.localdomain","rulebase":"pre-rulebase"}},"names":["rule-1"]}' | base64)

To learn more about importing existing cloud resources, see Importing resources.

Package Details

Repository: panos paloaltonetworks/terraform-provider-panos
License
Notes: This Pulumi package is based on the panos Terraform Provider.

panos 2.0.0 published on Tuesday, Apr 15, 2025 by paloaltonetworks

paloaltonetworks/terraform-provider-panos

panos.SecurityPolicy

On this page

On this page

Example Usage

Create SecurityPolicy Resource

Constructor syntax

Parameters

Constructor example

SecurityPolicy Resource Properties

Inputs

Outputs

Look up Existing SecurityPolicy Resource

Supporting Types

SecurityPolicyLocation, SecurityPolicyLocationArgs

SecurityPolicyLocationDeviceGroup, SecurityPolicyLocationDeviceGroupArgs

SecurityPolicyLocationShared, SecurityPolicyLocationSharedArgs

SecurityPolicyLocationVsys, SecurityPolicyLocationVsysArgs

SecurityPolicyRule, SecurityPolicyRuleArgs

SecurityPolicyRuleProfileSetting, SecurityPolicyRuleProfileSettingArgs

SecurityPolicyRuleProfileSettingProfiles, SecurityPolicyRuleProfileSettingProfilesArgs

SecurityPolicyRuleQos, SecurityPolicyRuleQosArgs

SecurityPolicyRuleQosMarking, SecurityPolicyRuleQosMarkingArgs

SecurityPolicyRuleTarget, SecurityPolicyRuleTargetArgs

SecurityPolicyRuleTargetDevice, SecurityPolicyRuleTargetDeviceArgs

SecurityPolicyRuleTargetDeviceVsy, SecurityPolicyRuleTargetDeviceVsyArgs

Import

Package Details

On this page

On this page