published on Monday, Aug 17, 2026 by stackitcloud
published on Monday, Aug 17, 2026 by stackitcloud
ALB WAF Custom Rule Group resource schema. Uses the defaultRegion specified in the provider configuration as a fallback in case no region is defined on resource level.
This resource is in beta and may be subject to breaking changes in the future. Use with caution. See our guide for how to opt-in to use beta resources.
Example Usage
resource "stackit_alb_waf_custom_rule_group" "example" {
project_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
name = "example-custom-rule-group"
rules = [
{
description = "My custom rule group"
behavior = {
action = "ACTION_DENY"
log = true
log_msg = "Some custom notification message string"
}
conditions = [
{
operator = {
type = "OPERATOR_BEGINS_WITH"
value = "allowed objects"
}
transformations = [
"TRANSFORMATION_LOWERCASE"
]
variable = {
type = "VARIABLE_REQUEST_HEADERS"
value = "Host"
}
}
]
}
]
}
Create AlbWafCustomRuleGroup Resource
Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.
Constructor syntax
new AlbWafCustomRuleGroup(name: string, args: AlbWafCustomRuleGroupArgs, opts?: CustomResourceOptions);@overload
def AlbWafCustomRuleGroup(resource_name: str,
args: AlbWafCustomRuleGroupArgs,
opts: Optional[ResourceOptions] = None)
@overload
def AlbWafCustomRuleGroup(resource_name: str,
opts: Optional[ResourceOptions] = None,
project_id: Optional[str] = None,
rules: Optional[Sequence[AlbWafCustomRuleGroupRuleArgs]] = None,
name: Optional[str] = None,
region: Optional[str] = None)func NewAlbWafCustomRuleGroup(ctx *Context, name string, args AlbWafCustomRuleGroupArgs, opts ...ResourceOption) (*AlbWafCustomRuleGroup, error)public AlbWafCustomRuleGroup(string name, AlbWafCustomRuleGroupArgs args, CustomResourceOptions? opts = null)
public AlbWafCustomRuleGroup(String name, AlbWafCustomRuleGroupArgs args)
public AlbWafCustomRuleGroup(String name, AlbWafCustomRuleGroupArgs args, CustomResourceOptions options)
type: stackit:AlbWafCustomRuleGroup
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.
resource "stackit_alb_waf_custom_rule_group" "name" {
# resource properties
}Parameters
- name string
- The unique name of the resource.
- args AlbWafCustomRuleGroupArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- resource_name str
- The unique name of the resource.
- args AlbWafCustomRuleGroupArgs
- The arguments to resource properties.
- opts ResourceOptions
- Bag of options to control resource's behavior.
- ctx Context
- Context object for the current deployment.
- name string
- The unique name of the resource.
- args AlbWafCustomRuleGroupArgs
- The arguments to resource properties.
- opts ResourceOption
- Bag of options to control resource's behavior.
- name string
- The unique name of the resource.
- args AlbWafCustomRuleGroupArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- name String
- The unique name of the resource.
- args AlbWafCustomRuleGroupArgs
- The arguments to resource properties.
- options CustomResourceOptions
- Bag of options to control resource's behavior.
Constructor example
The following reference example uses placeholder values for all input properties.
var albWafCustomRuleGroupResource = new Stackit.AlbWafCustomRuleGroup("albWafCustomRuleGroupResource", new()
{
ProjectId = "string",
Rules = new[]
{
new Stackit.Inputs.AlbWafCustomRuleGroupRuleArgs
{
Behavior = new Stackit.Inputs.AlbWafCustomRuleGroupRuleBehaviorArgs
{
Action = "string",
Log = false,
LogMsg = "string",
Severity = "string",
},
Conditions = new[]
{
new Stackit.Inputs.AlbWafCustomRuleGroupRuleConditionArgs
{
Operator = new Stackit.Inputs.AlbWafCustomRuleGroupRuleConditionOperatorArgs
{
Type = "string",
Value = "string",
},
Variable = new Stackit.Inputs.AlbWafCustomRuleGroupRuleConditionVariableArgs
{
Type = "string",
Value = "string",
},
Transformations = new[]
{
"string",
},
},
},
Description = "string",
Id = 0,
},
},
Name = "string",
Region = "string",
});
example, err := stackit.NewAlbWafCustomRuleGroup(ctx, "albWafCustomRuleGroupResource", &stackit.AlbWafCustomRuleGroupArgs{
ProjectId: pulumi.String("string"),
Rules: stackit.AlbWafCustomRuleGroupRuleArray{
&stackit.AlbWafCustomRuleGroupRuleArgs{
Behavior: &stackit.AlbWafCustomRuleGroupRuleBehaviorArgs{
Action: pulumi.String("string"),
Log: pulumi.Bool(false),
LogMsg: pulumi.String("string"),
Severity: pulumi.String("string"),
},
Conditions: stackit.AlbWafCustomRuleGroupRuleConditionArray{
&stackit.AlbWafCustomRuleGroupRuleConditionArgs{
Operator: &stackit.AlbWafCustomRuleGroupRuleConditionOperatorArgs{
Type: pulumi.String("string"),
Value: pulumi.String("string"),
},
Variable: &stackit.AlbWafCustomRuleGroupRuleConditionVariableArgs{
Type: pulumi.String("string"),
Value: pulumi.String("string"),
},
Transformations: pulumi.StringArray{
pulumi.String("string"),
},
},
},
Description: pulumi.String("string"),
Id: pulumi.Int(0),
},
},
Name: pulumi.String("string"),
Region: pulumi.String("string"),
})
resource "stackit_alb_waf_custom_rule_group" "albWafCustomRuleGroupResource" {
lifecycle {
create_before_destroy = true
}
project_id = "string"
rules {
behavior = {
action = "string"
log = false
log_msg = "string"
severity = "string"
}
conditions {
operator = {
type = "string"
value = "string"
}
variable = {
type = "string"
value = "string"
}
transformations = ["string"]
}
description = "string"
id = 0
}
name = "string"
region = "string"
}
var albWafCustomRuleGroupResource = new AlbWafCustomRuleGroup("albWafCustomRuleGroupResource", AlbWafCustomRuleGroupArgs.builder()
.projectId("string")
.rules(AlbWafCustomRuleGroupRuleArgs.builder()
.behavior(AlbWafCustomRuleGroupRuleBehaviorArgs.builder()
.action("string")
.log(false)
.logMsg("string")
.severity("string")
.build())
.conditions(AlbWafCustomRuleGroupRuleConditionArgs.builder()
.operator(AlbWafCustomRuleGroupRuleConditionOperatorArgs.builder()
.type("string")
.value("string")
.build())
.variable(AlbWafCustomRuleGroupRuleConditionVariableArgs.builder()
.type("string")
.value("string")
.build())
.transformations("string")
.build())
.description("string")
.id(0)
.build())
.name("string")
.region("string")
.build());
alb_waf_custom_rule_group_resource = stackit.AlbWafCustomRuleGroup("albWafCustomRuleGroupResource",
project_id="string",
rules=[{
"behavior": {
"action": "string",
"log": False,
"log_msg": "string",
"severity": "string",
},
"conditions": [{
"operator": {
"type": "string",
"value": "string",
},
"variable": {
"type": "string",
"value": "string",
},
"transformations": ["string"],
}],
"description": "string",
"id": 0,
}],
name="string",
region="string")
const albWafCustomRuleGroupResource = new stackit.AlbWafCustomRuleGroup("albWafCustomRuleGroupResource", {
projectId: "string",
rules: [{
behavior: {
action: "string",
log: false,
logMsg: "string",
severity: "string",
},
conditions: [{
operator: {
type: "string",
value: "string",
},
variable: {
type: "string",
value: "string",
},
transformations: ["string"],
}],
description: "string",
id: 0,
}],
name: "string",
region: "string",
});
type: stackit:AlbWafCustomRuleGroup
properties:
name: string
projectId: string
region: string
rules:
- behavior:
action: string
log: false
logMsg: string
severity: string
conditions:
- operator:
type: string
value: string
transformations:
- string
variable:
type: string
value: string
description: string
id: 0
AlbWafCustomRuleGroup Resource Properties
To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.
Inputs
In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.
The AlbWafCustomRuleGroup resource accepts the following input properties:
- Project
Id string - STACKIT project ID associated with the ALB WAF Custom Rule Group.
- Rules
List<Alb
Waf Custom Rule Group Rule> - Enriched rules containing auto-generated IDs and computed severity values.
- Name string
- Custom rule group configuration name.
- Region string
- STACKIT region name the resource is located in. If not defined, the provider region is used.
- Project
Id string - STACKIT project ID associated with the ALB WAF Custom Rule Group.
- Rules
[]Alb
Waf Custom Rule Group Rule Args - Enriched rules containing auto-generated IDs and computed severity values.
- Name string
- Custom rule group configuration name.
- Region string
- STACKIT region name the resource is located in. If not defined, the provider region is used.
- project_
id string - STACKIT project ID associated with the ALB WAF Custom Rule Group.
- rules list(object)
- Enriched rules containing auto-generated IDs and computed severity values.
- name string
- Custom rule group configuration name.
- region string
- STACKIT region name the resource is located in. If not defined, the provider region is used.
- project
Id String - STACKIT project ID associated with the ALB WAF Custom Rule Group.
- rules
List<Alb
Waf Custom Rule Group Rule> - Enriched rules containing auto-generated IDs and computed severity values.
- name String
- Custom rule group configuration name.
- region String
- STACKIT region name the resource is located in. If not defined, the provider region is used.
- project
Id string - STACKIT project ID associated with the ALB WAF Custom Rule Group.
- rules
Alb
Waf Custom Rule Group Rule[] - Enriched rules containing auto-generated IDs and computed severity values.
- name string
- Custom rule group configuration name.
- region string
- STACKIT region name the resource is located in. If not defined, the provider region is used.
- project_
id str - STACKIT project ID associated with the ALB WAF Custom Rule Group.
- rules
Sequence[Alb
Waf Custom Rule Group Rule Args] - Enriched rules containing auto-generated IDs and computed severity values.
- name str
- Custom rule group configuration name.
- region str
- STACKIT region name the resource is located in. If not defined, the provider region is used.
- project
Id String - STACKIT project ID associated with the ALB WAF Custom Rule Group.
- rules List<Property Map>
- Enriched rules containing auto-generated IDs and computed severity values.
- name String
- Custom rule group configuration name.
- region String
- STACKIT region name the resource is located in. If not defined, the provider region is used.
Outputs
All input properties are implicitly available as output properties. Additionally, the AlbWafCustomRuleGroup resource produces the following output properties:
- Id string
- The provider-assigned unique ID for this managed resource.
- Id string
- The provider-assigned unique ID for this managed resource.
- id string
- The provider-assigned unique ID for this managed resource.
- id String
- The provider-assigned unique ID for this managed resource.
- id string
- The provider-assigned unique ID for this managed resource.
- id str
- The provider-assigned unique ID for this managed resource.
- id String
- The provider-assigned unique ID for this managed resource.
Look up Existing AlbWafCustomRuleGroup Resource
Get an existing AlbWafCustomRuleGroup resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.
public static get(name: string, id: Input<ID>, state?: AlbWafCustomRuleGroupState, opts?: CustomResourceOptions): AlbWafCustomRuleGroup@staticmethod
def get(resource_name: str,
id: str,
opts: Optional[ResourceOptions] = None,
name: Optional[str] = None,
project_id: Optional[str] = None,
region: Optional[str] = None,
rules: Optional[Sequence[AlbWafCustomRuleGroupRuleArgs]] = None) -> AlbWafCustomRuleGroupfunc GetAlbWafCustomRuleGroup(ctx *Context, name string, id IDInput, state *AlbWafCustomRuleGroupState, opts ...ResourceOption) (*AlbWafCustomRuleGroup, error)public static AlbWafCustomRuleGroup Get(string name, Input<string> id, AlbWafCustomRuleGroupState? state, CustomResourceOptions? opts = null)public static AlbWafCustomRuleGroup get(String name, Output<String> id, AlbWafCustomRuleGroupState state, CustomResourceOptions options)resources: _: type: stackit:AlbWafCustomRuleGroup get: id: ${id}import {
to = stackit_alb_waf_custom_rule_group.example
id = "${id}"
}
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- resource_name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- Name string
- Custom rule group configuration name.
- Project
Id string - STACKIT project ID associated with the ALB WAF Custom Rule Group.
- Region string
- STACKIT region name the resource is located in. If not defined, the provider region is used.
- Rules
List<Alb
Waf Custom Rule Group Rule> - Enriched rules containing auto-generated IDs and computed severity values.
- Name string
- Custom rule group configuration name.
- Project
Id string - STACKIT project ID associated with the ALB WAF Custom Rule Group.
- Region string
- STACKIT region name the resource is located in. If not defined, the provider region is used.
- Rules
[]Alb
Waf Custom Rule Group Rule Args - Enriched rules containing auto-generated IDs and computed severity values.
- name string
- Custom rule group configuration name.
- project_
id string - STACKIT project ID associated with the ALB WAF Custom Rule Group.
- region string
- STACKIT region name the resource is located in. If not defined, the provider region is used.
- rules list(object)
- Enriched rules containing auto-generated IDs and computed severity values.
- name String
- Custom rule group configuration name.
- project
Id String - STACKIT project ID associated with the ALB WAF Custom Rule Group.
- region String
- STACKIT region name the resource is located in. If not defined, the provider region is used.
- rules
List<Alb
Waf Custom Rule Group Rule> - Enriched rules containing auto-generated IDs and computed severity values.
- name string
- Custom rule group configuration name.
- project
Id string - STACKIT project ID associated with the ALB WAF Custom Rule Group.
- region string
- STACKIT region name the resource is located in. If not defined, the provider region is used.
- rules
Alb
Waf Custom Rule Group Rule[] - Enriched rules containing auto-generated IDs and computed severity values.
- name str
- Custom rule group configuration name.
- project_
id str - STACKIT project ID associated with the ALB WAF Custom Rule Group.
- region str
- STACKIT region name the resource is located in. If not defined, the provider region is used.
- rules
Sequence[Alb
Waf Custom Rule Group Rule Args] - Enriched rules containing auto-generated IDs and computed severity values.
- name String
- Custom rule group configuration name.
- project
Id String - STACKIT project ID associated with the ALB WAF Custom Rule Group.
- region String
- STACKIT region name the resource is located in. If not defined, the provider region is used.
- rules List<Property Map>
- Enriched rules containing auto-generated IDs and computed severity values.
Supporting Types
AlbWafCustomRuleGroupRule, AlbWafCustomRuleGroupRuleArgs
- Behavior
Alb
Waf Custom Rule Group Rule Behavior - Conditions
List<Alb
Waf Custom Rule Group Rule Condition> - Description string
- A clear description explaining the threat vector or criteria addressed by this rule.
- Id int
- Backend auto-allocated unique rule ID within the valid 1-99999 threshold.
- Behavior
Alb
Waf Custom Rule Group Rule Behavior - Conditions
[]Alb
Waf Custom Rule Group Rule Condition - Description string
- A clear description explaining the threat vector or criteria addressed by this rule.
- Id int
- Backend auto-allocated unique rule ID within the valid 1-99999 threshold.
- behavior object
- conditions list(object)
- description string
- A clear description explaining the threat vector or criteria addressed by this rule.
- id number
- Backend auto-allocated unique rule ID within the valid 1-99999 threshold.
- behavior
Alb
Waf Custom Rule Group Rule Behavior - conditions
List<Alb
Waf Custom Rule Group Rule Condition> - description String
- A clear description explaining the threat vector or criteria addressed by this rule.
- id Integer
- Backend auto-allocated unique rule ID within the valid 1-99999 threshold.
- behavior
Alb
Waf Custom Rule Group Rule Behavior - conditions
Alb
Waf Custom Rule Group Rule Condition[] - description string
- A clear description explaining the threat vector or criteria addressed by this rule.
- id number
- Backend auto-allocated unique rule ID within the valid 1-99999 threshold.
- behavior
Alb
Waf Custom Rule Group Rule Behavior - conditions
Sequence[Alb
Waf Custom Rule Group Rule Condition] - description str
- A clear description explaining the threat vector or criteria addressed by this rule.
- id int
- Backend auto-allocated unique rule ID within the valid 1-99999 threshold.
- behavior Property Map
- conditions List<Property Map>
- description String
- A clear description explaining the threat vector or criteria addressed by this rule.
- id Number
- Backend auto-allocated unique rule ID within the valid 1-99999 threshold.
AlbWafCustomRuleGroupRuleBehavior, AlbWafCustomRuleGroupRuleBehaviorArgs
- Action string
- The protective stance action. ACTION_DENY forces a 403 status response code.
- Log bool
- Determines whether an entry should be generated in the security ledger upon a rule hit.
- Log
Msg string - Custom notification message string mapped to underlying logdata contexts. Required if log is true.
- Severity string
- Severity classification metric used by internal analytics graphs.
- Action string
- The protective stance action. ACTION_DENY forces a 403 status response code.
- Log bool
- Determines whether an entry should be generated in the security ledger upon a rule hit.
- Log
Msg string - Custom notification message string mapped to underlying logdata contexts. Required if log is true.
- Severity string
- Severity classification metric used by internal analytics graphs.
- action string
- The protective stance action. ACTION_DENY forces a 403 status response code.
- log bool
- Determines whether an entry should be generated in the security ledger upon a rule hit.
- log_
msg string - Custom notification message string mapped to underlying logdata contexts. Required if log is true.
- severity string
- Severity classification metric used by internal analytics graphs.
- action String
- The protective stance action. ACTION_DENY forces a 403 status response code.
- log Boolean
- Determines whether an entry should be generated in the security ledger upon a rule hit.
- log
Msg String - Custom notification message string mapped to underlying logdata contexts. Required if log is true.
- severity String
- Severity classification metric used by internal analytics graphs.
- action string
- The protective stance action. ACTION_DENY forces a 403 status response code.
- log boolean
- Determines whether an entry should be generated in the security ledger upon a rule hit.
- log
Msg string - Custom notification message string mapped to underlying logdata contexts. Required if log is true.
- severity string
- Severity classification metric used by internal analytics graphs.
- action str
- The protective stance action. ACTION_DENY forces a 403 status response code.
- log bool
- Determines whether an entry should be generated in the security ledger upon a rule hit.
- log_
msg str - Custom notification message string mapped to underlying logdata contexts. Required if log is true.
- severity str
- Severity classification metric used by internal analytics graphs.
- action String
- The protective stance action. ACTION_DENY forces a 403 status response code.
- log Boolean
- Determines whether an entry should be generated in the security ledger upon a rule hit.
- log
Msg String - Custom notification message string mapped to underlying logdata contexts. Required if log is true.
- severity String
- Severity classification metric used by internal analytics graphs.
AlbWafCustomRuleGroupRuleCondition, AlbWafCustomRuleGroupRuleConditionArgs
- Operator
Alb
Waf Custom Rule Group Rule Condition Operator - The comparison logic executed against the transformed variable.
- Variable
Alb
Waf Custom Rule Group Rule Condition Variable - The part of the HTTP transaction to inspect.
- Transformations List<string>
- Ordered normalization steps applied before the operator runs.
- Operator
Alb
Waf Custom Rule Group Rule Condition Operator - The comparison logic executed against the transformed variable.
- Variable
Alb
Waf Custom Rule Group Rule Condition Variable - The part of the HTTP transaction to inspect.
- Transformations []string
- Ordered normalization steps applied before the operator runs.
- operator object
- The comparison logic executed against the transformed variable.
- variable object
- The part of the HTTP transaction to inspect.
- transformations list(string)
- Ordered normalization steps applied before the operator runs.
- operator
Alb
Waf Custom Rule Group Rule Condition Operator - The comparison logic executed against the transformed variable.
- variable
Alb
Waf Custom Rule Group Rule Condition Variable - The part of the HTTP transaction to inspect.
- transformations List<String>
- Ordered normalization steps applied before the operator runs.
- operator
Alb
Waf Custom Rule Group Rule Condition Operator - The comparison logic executed against the transformed variable.
- variable
Alb
Waf Custom Rule Group Rule Condition Variable - The part of the HTTP transaction to inspect.
- transformations string[]
- Ordered normalization steps applied before the operator runs.
- operator
Alb
Waf Custom Rule Group Rule Condition Operator - The comparison logic executed against the transformed variable.
- variable
Alb
Waf Custom Rule Group Rule Condition Variable - The part of the HTTP transaction to inspect.
- transformations Sequence[str]
- Ordered normalization steps applied before the operator runs.
- operator Property Map
- The comparison logic executed against the transformed variable.
- variable Property Map
- The part of the HTTP transaction to inspect.
- transformations List<String>
- Ordered normalization steps applied before the operator runs.
AlbWafCustomRuleGroupRuleConditionOperator, AlbWafCustomRuleGroupRuleConditionOperatorArgs
AlbWafCustomRuleGroupRuleConditionVariable, AlbWafCustomRuleGroupRuleConditionVariableArgs
Package Details
- Repository
- stackit stackitcloud/pulumi-stackit
- License
- Apache-2.0
- Notes
- This Pulumi package is based on the
stackitTerraform Provider.
published on Monday, Aug 17, 2026 by stackitcloud