Docs Home Pulumi IaC Pulumi ESC Pulumi Insights Pulumi IDP Pulumi Cloud Packages Tutorials
  1. Packages
  2. Zscaler Internet Access (ZIA)
  3. API Docs
  4. CloudAppControlRule
Zscaler Internet Access v1.0.1 published on Friday, Jun 6, 2025 by Zscaler
zscaler/pulumi-zia

zia.CloudAppControlRule

Explore with Pulumi AI

zia logo
Zscaler Internet Access v1.0.1 published on Friday, Jun 6, 2025 by Zscaler
zscaler/pulumi-zia

    The zia_cloud_app_control_rule resource allows the creation and management of ZIA Cloud Application Control rules in the Zscaler Internet Access.

    NOTE Resources or DataSources to retrieve Tenant Profile or Cloud Application Risk Profile ID information are not currently available.

    Example Usage

    Basic Rule Configuration

    resource "zia_cloud_app_control_rule" "this" {
    name                         = "Example_WebMail_Rule"
    description                  = "Example_WebMail_Rule"
    order                        = 1
    rank                         = 7
    state                        = "ENABLED"
    type                         = "WEBMAIL"
    actions                      = [
        "ALLOW_WEBMAIL_VIEW",
        "ALLOW_WEBMAIL_ATTACHMENT_SEND",
        "ALLOW_WEBMAIL_SEND",
    ]
    applications          = [
        "GOOGLE_WEBMAIL",
        "YAHOO_WEBMAIL",
    ]
    device_trust_levels   = ["UNKNOWN_DEVICETRUSTLEVEL", "LOW_TRUST", "MEDIUM_TRUST", "HIGH_TRUST"]
    user_agent_types      = ["OPERA", "FIREFOX", "MSIE", "MSEDGE", "CHROME", "SAFARI", "MSCHREDGE"]
}

    With Cloud Risk Profile Configuration

    resource "zia_cloud_app_control_rule" "this" {
    name                         = "Example_WebMail_Rule"
    description                  = "Example_WebMail_Rule"
    order                        = 1
    rank                         = 7
    state                        = "ENABLED"
    type                         = "WEBMAIL"
    actions                      = [
        "ALLOW_WEBMAIL_VIEW",
        "ALLOW_WEBMAIL_ATTACHMENT_SEND",
        "ALLOW_WEBMAIL_SEND",
    ]
    applications          = [
        "GOOGLE_WEBMAIL",
        "YAHOO_WEBMAIL",
    ]
    cloud_app_risk_profile {
      id = 318
    }
}

    With Tenant Profile Configuration

    NOTE Tenant profile is supported only for specific applications depending on the type

    resource "zia_cloud_app_control_rule" "this" {
    name                         = "Example_WebMail_Rule"
    description                  = "Example_WebMail_Rule"
    order                        = 1
    rank                         = 7
    state                        = "ENABLED"
    type                         = "WEBMAIL"
    actions                      = [
        "ALLOW_WEBMAIL_VIEW",
        "ALLOW_WEBMAIL_ATTACHMENT_SEND",
        "ALLOW_WEBMAIL_SEND",
    ]
    applications          = [
        "GOOGLE_WEBMAIL",
        "YAHOO_WEBMAIL",
    ]
    tenancy_profile_ids {
        id = [ 19016237 ]
    }
}

    With ISOLATE ACTION

    ⚠️ WARNING 1:: Creating a Cloud Application Control Rule with the actions containing ISOLATE_ Cloud Browser Isolation subscription is required. See the “Cloud Application Control - Rule Types vs Actions Matrix” below. To learn more, contact Zscaler Support or your local account team.

    data "zia_cloud_browser_isolation_profile" "this" {
    name = "BD_SA_Profile1_ZIA"
}

resource "zia_cloud_app_control_rule" "this" {
    name                         = "Example"
    description                  = "Example"
    state                        = "ENABLED"
    type                         = "WEBMAIL"
    actions                      = [
        "ALLOW_WEBMAIL_VIEW",
        "ALLOW_WEBMAIL_ATTACHMENT_SEND",
        "ALLOW_WEBMAIL_SEND",
    ]
    applications          = [
        "GOOGLE_WEBMAIL",
        "YAHOO_WEBMAIL",
    ]
    order                 = 1
    enforce_time_validity = true
    validity_start_time   = "Mon, 17 Jun 2024 23:30:00 UTC"
    validity_end_time     = "Tue, 17 Jun 2025 23:00:00 UTC"
    validity_time_zone_id = "US/Pacific"
    time_quota            = 15
    size_quota            = 10
    device_trust_levels   = ["UNKNOWN_DEVICETRUSTLEVEL", "LOW_TRUST", "MEDIUM_TRUST", "HIGH_TRUST"]
    cbi_profile {
        id = data.zia_cloud_browser_isolation_profile.this.id
        name = data.zia_cloud_browser_isolation_profile.this.name
        url = data.zia_cloud_browser_isolation_profile.this.url
    }
    user_agent_types = [ "OPERA", "FIREFOX", "MSIE", "MSEDGE", "CHROME", "SAFARI", "MSCHREDGE" ]
}

    Cloud Application Control - Rule Types vs Actions Matrix

    Note: Refer to this matrix when configuring types vs actions for each specific rules

    TypesActions
    —————————————————————–
    AI_MLDENY_AI_ML_WEB_USE, ALLOW_AI_ML_WEB_USE, ISOLATE_AI_ML_WEB_USE,
    AI_MLCAUTION_AI_ML_WEB_USE, DENY_AI_ML_UPLOAD, ALLOW_AI_ML_UPLOAD,
    AI_MLDENY_AI_ML_SHARE, ALLOW_AI_ML_SHARE, DENY_AI_ML_DOWNLOAD,
    AI_MLALLOW_AI_ML_DOWNLOAD, DENY_AI_ML_DELETE,ALLOW_AI_ML_DELETE,
    AI_MLDENY_AI_ML_INVITE, ALLOW_AI_ML_INVITE, DENY_AI_ML_CHAT,
    AI_MLALLOW_AI_ML_CHAT, DENY_AI_ML_CREATE, ALLOW_AI_ML_CREATE,
    AI_MLDENY_AI_ML_RENAME, ALLOW_AI_ML_RENAME
    ————————-——————————————————–
    BUSINESS_PRODUCTIVITYALLOW_BUSINESS_PRODUCTIVITY_APPS, BLOCK_BUSINESS_PRODUCTIVITY_APPS
    BUSINESS_PRODUCTIVITYCAUTION_BUSINESS_PRODUCTIVITY_APPS, ISOLATE_BUSINESS_PRODUCTIVITY_APPS
    ———————————————————————————
    CONSUMERALLOW_CONSUMER_APPS, BLOCK_CONSUMER_APPS
    CONSUMERCAUTION_CONSUMER_APPS, ISOLATE_CONSUMER_APPS
    ————————–———————————————————
    CUSTOM_CAPPBLOCK_CUSTOM_CAPP_USE, ALLOW_CUSTOM_CAPP_USE
    CUSTOM_CAPPISOLATE_CUSTOM_CAPP_USE, CAUTION_CUSTOM_CAPP_USE
    ————————–———————————————————
    DNS_OVER_HTTPSALLOW_DNS_OVER_HTTPS_USE
    DNS_OVER_HTTPSDENY_DNS_OVER_HTTPS_USE
    ————————-———————————————————
    ENTERPRISE_COLLABORATIONALLOW_ENTERPRISE_COLLABORATION_APPS, ALLOW_ENTERPRISE_COLLABORATION_CHAT,
    ENTERPRISE_COLLABORATIONALLOW_ENTERPRISE_COLLABORATION_UPLOAD, ALLOW_ENTERPRISE_COLLABORATION_SHARE,
    ENTERPRISE_COLLABORATIONBLOCK_ENTERPRISE_COLLABORATION_APPS, ALLOW_ENTERPRISE_COLLABORATION_EDIT,
    ENTERPRISE_COLLABORATIONALLOW_ENTERPRISE_COLLABORATION_RENAME, ALLOW_ENTERPRISE_COLLABORATION_CREATE,
    ENTERPRISE_COLLABORATIONALLOW_ENTERPRISE_COLLABORATION_DOWNLOAD, ALLOW_ENTERPRISE_COLLABORATION_HUDDLE,
    ENTERPRISE_COLLABORATIONALLOW_ENTERPRISE_COLLABORATION_INVITE, ALLOW_ENTERPRISE_COLLABORATION_MEETING,
    ENTERPRISE_COLLABORATIONALLOW_ENTERPRISE_COLLABORATION_DELETE, ALLOW_ENTERPRISE_COLLABORATION_SCREEN_SHARE,
    ENTERPRISE_COLLABORATIONBLOCK_ENTERPRISE_COLLABORATION_CHAT, BLOCK_ENTERPRISE_COLLABORATION_UPLOAD,
    ENTERPRISE_COLLABORATIONBLOCK_ENTERPRISE_COLLABORATION_SHARE, BLOCK_ENTERPRISE_COLLABORATION_EDIT,
    ENTERPRISE_COLLABORATIONBLOCK_ENTERPRISE_COLLABORATION_RENAME, BLOCK_ENTERPRISE_COLLABORATION_CREATE,
    ENTERPRISE_COLLABORATIONBLOCK_ENTERPRISE_COLLABORATION_DO WNLOAD, BLOCK_ENTERPRISE_COLLABORATION_DELETE,
    ENTERPRISE_COLLABORATIONBLOCK_ENTERPRISE_COLLABORATION_HUDDLE, BLOCK_ENTERPRISE_COLLABORATION_INVITE,
    ENTERPRISE_COLLABORATIONBLOCK_ENTERPRISE_COLLABORATION_MEETING, BLOCK_ENTERPRISE_COLLABORATION_SCREEN_SHARE,
    ENTERPRISE_COLLABORATIONISOLATE_ENTERPRISE_COLLABORATION_APPS, CAUTION_ENTERPRISE_COLLABORATION_APPS,
    ————————–————————————————-
    FILE_SHAREDENY_FILE_SHARE_VIEW, ALLOW_FILE_SHARE_VIEW, CAUTION_FILE_SHARE_VIEW,
    FILE_SHAREDENY_FILE_SHARE_UPLOAD, ALLOW_FILE_SHARE_UPLOAD, ISOLATE_FILE_SHARE_VIEW,
    FILE_SHAREDENY_FILE_SHARE_SHARE, ALLOW_FILE_SHARE_SHARE, DENY_FILE_SHARE_EDIT,
    FILE_SHAREALLOW_FILE_SHARE_EDIT, DENY_FILE_SHARE_RENAME, ALLOW_FILE_SHARE_RENAME,
    FILE_SHAREDENY_FILE_SHARE_CREATE, ALLOW_FILE_SHARE_CREATE, DENY_FILE_SHARE_DOWNLOAD,
    FILE_SHAREALLOW_FILE_SHARE_DOWNLOAD, DENY_FILE_SHARE_DELETE, ALLOW_FILE_SHARE_DELETE,
    FILE_SHAREDENY_FILE_SHARE_FORM_SHARE, ALLOW_FILE_SHARE_FORM_SHARE, DENY_FILE_SHARE_INVITE,
    FILE_SHAREALLOW_FILE_SHARE_INVITE
    ————————-————————————————-
    FINANCEALLOW_FINANCE_USE, CAUTION_FINANCE_USE
    FINANCEDENY_FINANCE_USE, ISOLATE_FINANCE_USE
    ————————–————————————————-
    HEALTH_CAREALLOW_HEALTH_CARE_USE, CAUTION_HEALTH_CARE_USE
    HEALTH_CAREDENY_HEALTH_CARE_USE, ISOLATE_HEALTH_CARE_USE
    ————————-————————————————-
    HOSTING_PROVIDERALLOW_HOSTING_PROVIDER_DELETE, DENY_HOSTING_PROVIDER_EDIT, ALLOW_HOSTING_PROVIDER_EDIT,
    HOSTING_PROVIDERALLOW_HOSTING_PROVIDER_CREATE, DENY_HOSTING_PROVIDER_CREATE,DENY_HOSTING_PROVIDER_DELETE,
    HOSTING_PROVIDERALLOW_HOSTING_PROVIDER_USE, DENY_HOSTING_PROVIDER_USE,
    HOSTING_PROVIDERALLOW_HOSTING_PROVIDER_DOWNLOAD, DENY_HOSTING_PROVIDER_DOWNLOAD,
    HOSTING_PROVIDERALLOW_HOSTING_PROVIDER_MOVE, DENY_HOSTING_PROVIDER_MOVE,
    HOSTING_PROVIDERISOLATE_HOSTING_PROVIDER_USE, CAUTION_HOSTING_PROVIDER_USE,
    ————————–————————————————-
    HUMAN_RESOURCESALLOW_HUMAN_RESOURCES_USE, CAUTION_HUMAN_RESOURCES_USE,
    HUMAN_RESOURCESDENY_HUMAN_RESOURCES_USE, ISOLATE_HUMAN_RESOURCES_USE,
    ————————–————————————————-
    INSTANT_MESSAGINGALLOW_CHAT, ALLOW_FILE_TRANSFER_IN_CHAT,
    INSTANT_MESSAGINGALLOW_FILE_TRANSFER_IN_CHAT, BLOCK_CHAT,
    INSTANT_MESSAGINGBLOCK_FILE_TRANSFER_IN_CHAT, CAUTION_CHAT,
    INSTANT_MESSAGINGCAUTION_FILE_TRANSFER_IN_CHAT, ISOLATE_CHAT
    ————————–————————————————-
    IT_SERVICESALLOW_IT_SERVICES_USE, CAUTION_LEGAL_USE,
    IT_SERVICESDENY_IT_SERVICES_USE, ISOLATE_IT_SERVICES_USE
    ————————-————————————————-
    LEGALALLOW_LEGAL_USE, DENY_DNS_OVER_HTTPS_USE,
    LEGALDENY_LEGAL_USE, ISOLATE_LEGAL_USE
    ————————-————————————————-
    SALES_AND_MARKETINGALLOW_SALES_MARKETING_APPS, BLOCK_SALES_MARKETING_APPS,
    SALES_AND_MARKETINGCAUTION_SALES_MARKETING_APPS, ISOLATE_SALES_MARKETING_APPS
    ————————-————————————————-
    STREAMING_MEDIABLOCK_STREAMING_VIEW_LISTEN, ALLOW_STREAMING_VIEW_LISTEN,
    STREAMING_MEDIACAUTION_STREAMING_VIEW_LISTEN, BLOCK_STREAMING_UPLOAD,
    STREAMING_MEDIAALLOW_STREAMING_UPLOAD, ISOLATE_STREAMING_VIEW_LISTEN
    ———————–————————————————-
    SOCIAL_NETWORKINGALLOW_SOCIAL_NETWORKING_CHAT, ALLOW_SOCIAL_NETWORKING_COMMENT,
    SOCIAL_NETWORKINGALLOW_SOCIAL_NETWORKING_CREATE, ALLOW_SOCIAL_NETWORKING_EDIT,
    SOCIAL_NETWORKINGALLOW_SOCIAL_NETWORKING_POST, ALLOW_SOCIAL_NETWORKING_SHARE,
    SOCIAL_NETWORKINGALLOW_SOCIAL_NETWORKING_UPLOAD, ALLOW_SOCIAL_NETWORKING_VIEW,
    SOCIAL_NETWORKINGBLOCK_SOCIAL_NETWORKING_CHAT, BLOCK_SOCIAL_NETWORKING_COMMENT,
    SOCIAL_NETWORKINGBLOCK_SOCIAL_NETWORKING_CREATE, BLOCK_SOCIAL_NETWORKING_EDIT,
    SOCIAL_NETWORKINGBLOCK_SOCIAL_NETWORKING_POST,BLOCK_SOCIAL_NETWORKING_SHARE,
    SOCIAL_NETWORKINGBLOCK_SOCIAL_NETWORKING_UPLOAD, BLOCK_SOCIAL_NETWORKING_VIEW,
    SOCIAL_NETWORKINGCAUTION_SOCIAL_NETWORKING_POST, CAUTION_SOCIAL_NETWORKING_VIEW,
    SOCIAL_NETWORKINGISOLATE_SOCIAL_NETWORKING_VIEW,
    ————————-————————————————-
    SYSTEM_AND_DEVELOPMENTBLOCK_SYSTEM_DEVELOPMENT_APPS, ALLOW_SYSTEM_DEVELOPMENT_APPS,
    SYSTEM_AND_DEVELOPMENTISOLATE_SYSTEM_DEVELOPMENT_APPS, BLOCK_SYSTEM_DEVELOPMENT_UPLOAD,
    SYSTEM_AND_DEVELOPMENTALLOW_SYSTEM_DEVELOPMENT_UPLOAD,CAUTION_SYSTEM_DEVELOPMENT_APPS,
    SYSTEM_AND_DEVELOPMENTBLOCK_SYSTEM_DEVELOPMENT_CREATE, ALLOW_SYSTEM_DEVELOPMENT_CREATE,
    SYSTEM_AND_DEVELOPMENTBLOCK_SYSTEM_DEVELOPMENT_EDIT, ALLOW_SYSTEM_DEVELOPMENT_EDIT,
    SYSTEM_AND_DEVELOPMENTBLOCK_SYSTEM_DEVELOPMENT_SHARE, ALLOW_SYSTEM_DEVELOPMENT_SHARE,
    SYSTEM_AND_DEVELOPMENTBLOCK_SYSTEM_DEVELOPMENT_COMMENT, ALLOW_SYSTEM_DEVELOPMENT_COMMENT,
    SYSTEM_AND_DEVELOPMENTBLOCK_SYSTEM_DEVELOPMENT_REACTION,ALLOW_SYSTEM_DEVELOPMENT_REACTION
    ————————–————————————————-
    WEBMAILALLOW_WEBMAIL_VIEW, ALLOW_WEBMAIL_ATTACHMENT_SEND
    WEBMAILALLOW_WEBMAIL_SEND, CAUTION_WEBMAIL_VIEW
    WEBMAILBLOCK_WEBMAIL_VIEW, BLOCK_WEBMAIL_ATTACHMENT_SEND
    WEBMAILBLOCK_WEBMAIL_SEND, ISOLATE_WEBMAIL_VIEW
    ————————-————————————————-

    Cloud Application Control - Rule Types vs Tenant Profile Support

    Note: Refer to this matrix when configuring a Cloud App Control rule with Tenant Profile

    Reference

    TypeApplicationstenancy_profile_ids
    ———————————-——————————-———————
    BUSINESS_PRODUCTIVITY"GOOGLEANALYTICS"✅
    ———————————-——————————-———————
    ENTERPRISE_COLLABORATION"GOOGLECALENDAR"✅
    ENTERPRISE_COLLABORATION"GOOGLEKEEP"✅
    ENTERPRISE_COLLABORATION"GOOGLEMEET"✅
    ENTERPRISE_COLLABORATION"GOOGLESITES"✅
    ENTERPRISE_COLLABORATION"WEBEX"✅
    ENTERPRISE_COLLABORATION"SLACK"✅
    ENTERPRISE_COLLABORATION"WEBEX_TEAMS"✅
    ENTERPRISE_COLLABORATION"ZOOM"✅
    ———————————-——————————-———————
    FILE_SHARE"DROPBOX"✅
    FILE_SHARE"GDRIVE"✅
    FILE_SHARE"GPHOTOS"✅
    ———————————-——————————-———————
    HOSTING_PROVIDER"GCLOUDCOMPUTE"✅
    HOSTING_PROVIDER"AWS"✅
    HOSTING_PROVIDER"IBMSMARTCLOUD"✅
    HOSTING_PROVIDER"GAPPENGINE"✅
    HOSTING_PROVIDER"GOOGLE_CLOUD_PLATFORM"✅
    ———————————-——————————-———————
    IT_SERVICES"MSLOGINSERVICES"✅
    IT_SERVICES"GOOGLOGINSERVICE"✅
    IT_SERVICES"WEBEX_LOGIN_SERVICES"✅
    IT_SERVICES"ZOHO_LOGIN_SERVICES"✅
    ———————————-——————————-———————
    SOCIAL_NETWORKING"GOOGLE_GROUPS"✅
    SOCIAL_NETWORKING"GOOGLE_PLUS"✅
    ———————————-——————————-———————
    STREAMING_MEDIA"YOUTUBE"✅
    STREAMING_MEDIA"GOOGLE_STREAMING"✅
    ———————————-——————————-———————
    SYSTEM_AND_DEVELOPMENT"GOOGLE_DEVELOPERS"✅
    SYSTEM_AND_DEVELOPMENT"GOOGLEAPPMAKER"✅
    ———————————-——————————-———————
    WEBMAIL"GOOGLE_WEBMAIL"✅
    ———————————-——————————-———————

    Create CloudAppControlRule Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new CloudAppControlRule(name: string, args: CloudAppControlRuleArgs, opts?: CustomResourceOptions);
    @overload
def CloudAppControlRule(resource_name: str,
                        args: CloudAppControlRuleArgs,
                        opts: Optional[ResourceOptions] = None)

@overload
def CloudAppControlRule(resource_name: str,
                        opts: Optional[ResourceOptions] = None,
                        order: Optional[int] = None,
                        locations: Optional[CloudAppControlRuleLocationsArgs] = None,
                        tenancy_profile_ids: Optional[CloudAppControlRuleTenancyProfileIdsArgs] = None,
                        cbi_profiles: Optional[Sequence[CloudAppControlRuleCbiProfileArgs]] = None,
                        cloud_app_risk_profiles: Optional[Sequence[CloudAppControlRuleCloudAppRiskProfileArgs]] = None,
                        departments: Optional[CloudAppControlRuleDepartmentsArgs] = None,
                        description: Optional[str] = None,
                        device_groups: Optional[CloudAppControlRuleDeviceGroupsArgs] = None,
                        device_trust_levels: Optional[Sequence[str]] = None,
                        devices: Optional[CloudAppControlRuleDevicesArgs] = None,
                        enforce_time_validity: Optional[bool] = None,
                        groups: Optional[CloudAppControlRuleGroupsArgs] = None,
                        labels: Optional[CloudAppControlRuleLabelsArgs] = None,
                        location_groups: Optional[CloudAppControlRuleLocationGroupsArgs] = None,
                        actions: Optional[Sequence[str]] = None,
                        cascading_enabled: Optional[bool] = None,
                        rank: Optional[int] = None,
                        name: Optional[str] = None,
                        size_quota: Optional[int] = None,
                        state: Optional[str] = None,
                        applications: Optional[Sequence[str]] = None,
                        time_quota: Optional[int] = None,
                        time_windows: Optional[CloudAppControlRuleTimeWindowsArgs] = None,
                        type: Optional[str] = None,
                        user_agent_types: Optional[Sequence[str]] = None,
                        user_risk_score_levels: Optional[Sequence[str]] = None,
                        users: Optional[CloudAppControlRuleUsersArgs] = None,
                        validity_end_time: Optional[str] = None,
                        validity_start_time: Optional[str] = None,
                        validity_time_zone_id: Optional[str] = None)
    func NewCloudAppControlRule(ctx *Context, name string, args CloudAppControlRuleArgs, opts ...ResourceOption) (*CloudAppControlRule, error)
    public CloudAppControlRule(string name, CloudAppControlRuleArgs args, CustomResourceOptions? opts = null)
    public CloudAppControlRule(String name, CloudAppControlRuleArgs args)
public CloudAppControlRule(String name, CloudAppControlRuleArgs args, CustomResourceOptions options)

    type: zia:CloudAppControlRule
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

    Parameters

    name string
    The unique name of the resource.
    args CloudAppControlRuleArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args CloudAppControlRuleArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args CloudAppControlRuleArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args CloudAppControlRuleArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args CloudAppControlRuleArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var cloudAppControlRuleResource = new Zia.CloudAppControlRule("cloudAppControlRuleResource", new()
{
    Order = 0,
    Locations = new Zia.Inputs.CloudAppControlRuleLocationsArgs
    {
        Ids = new[]
        {
            0,
        },
    },
    TenancyProfileIds = new Zia.Inputs.CloudAppControlRuleTenancyProfileIdsArgs
    {
        Ids = new[]
        {
            0,
        },
    },
    CbiProfiles = new[]
    {
        new Zia.Inputs.CloudAppControlRuleCbiProfileArgs
        {
            Id = "string",
            Name = "string",
            Url = "string",
        },
    },
    CloudAppRiskProfiles = new[]
    {
        new Zia.Inputs.CloudAppControlRuleCloudAppRiskProfileArgs
        {
            Id = 0,
        },
    },
    Departments = new Zia.Inputs.CloudAppControlRuleDepartmentsArgs
    {
        Ids = new[]
        {
            0,
        },
    },
    Description = "string",
    DeviceGroups = new Zia.Inputs.CloudAppControlRuleDeviceGroupsArgs
    {
        Ids = new[]
        {
            0,
        },
    },
    DeviceTrustLevels = new[]
    {
        "string",
    },
    Devices = new Zia.Inputs.CloudAppControlRuleDevicesArgs
    {
        Ids = new[]
        {
            0,
        },
    },
    EnforceTimeValidity = false,
    Groups = new Zia.Inputs.CloudAppControlRuleGroupsArgs
    {
        Ids = new[]
        {
            0,
        },
    },
    Labels = new Zia.Inputs.CloudAppControlRuleLabelsArgs
    {
        Ids = new[]
        {
            0,
        },
    },
    LocationGroups = new Zia.Inputs.CloudAppControlRuleLocationGroupsArgs
    {
        Ids = new[]
        {
            0,
        },
    },
    Actions = new[]
    {
        "string",
    },
    CascadingEnabled = false,
    Rank = 0,
    Name = "string",
    SizeQuota = 0,
    State = "string",
    Applications = new[]
    {
        "string",
    },
    TimeQuota = 0,
    TimeWindows = new Zia.Inputs.CloudAppControlRuleTimeWindowsArgs
    {
        Ids = new[]
        {
            0,
        },
    },
    Type = "string",
    UserAgentTypes = new[]
    {
        "string",
    },
    UserRiskScoreLevels = new[]
    {
        "string",
    },
    Users = new Zia.Inputs.CloudAppControlRuleUsersArgs
    {
        Ids = new[]
        {
            0,
        },
    },
    ValidityEndTime = "string",
    ValidityStartTime = "string",
    ValidityTimeZoneId = "string",
});

    example, err := zia.NewCloudAppControlRule(ctx, "cloudAppControlRuleResource", &zia.CloudAppControlRuleArgs{
	Order: pulumi.Int(0),
	Locations: &zia.CloudAppControlRuleLocationsArgs{
		Ids: pulumi.IntArray{
			pulumi.Int(0),
		},
	},
	TenancyProfileIds: &zia.CloudAppControlRuleTenancyProfileIdsArgs{
		Ids: pulumi.IntArray{
			pulumi.Int(0),
		},
	},
	CbiProfiles: zia.CloudAppControlRuleCbiProfileArray{
		&zia.CloudAppControlRuleCbiProfileArgs{
			Id:   pulumi.String("string"),
			Name: pulumi.String("string"),
			Url:  pulumi.String("string"),
		},
	},
	CloudAppRiskProfiles: zia.CloudAppControlRuleCloudAppRiskProfileArray{
		&zia.CloudAppControlRuleCloudAppRiskProfileArgs{
			Id: pulumi.Int(0),
		},
	},
	Departments: &zia.CloudAppControlRuleDepartmentsArgs{
		Ids: pulumi.IntArray{
			pulumi.Int(0),
		},
	},
	Description: pulumi.String("string"),
	DeviceGroups: &zia.CloudAppControlRuleDeviceGroupsArgs{
		Ids: pulumi.IntArray{
			pulumi.Int(0),
		},
	},
	DeviceTrustLevels: pulumi.StringArray{
		pulumi.String("string"),
	},
	Devices: &zia.CloudAppControlRuleDevicesArgs{
		Ids: pulumi.IntArray{
			pulumi.Int(0),
		},
	},
	EnforceTimeValidity: pulumi.Bool(false),
	Groups: &zia.CloudAppControlRuleGroupsArgs{
		Ids: pulumi.IntArray{
			pulumi.Int(0),
		},
	},
	Labels: &zia.CloudAppControlRuleLabelsArgs{
		Ids: pulumi.IntArray{
			pulumi.Int(0),
		},
	},
	LocationGroups: &zia.CloudAppControlRuleLocationGroupsArgs{
		Ids: pulumi.IntArray{
			pulumi.Int(0),
		},
	},
	Actions: pulumi.StringArray{
		pulumi.String("string"),
	},
	CascadingEnabled: pulumi.Bool(false),
	Rank:             pulumi.Int(0),
	Name:             pulumi.String("string"),
	SizeQuota:        pulumi.Int(0),
	State:            pulumi.String("string"),
	Applications: pulumi.StringArray{
		pulumi.String("string"),
	},
	TimeQuota: pulumi.Int(0),
	TimeWindows: &zia.CloudAppControlRuleTimeWindowsArgs{
		Ids: pulumi.IntArray{
			pulumi.Int(0),
		},
	},
	Type: pulumi.String("string"),
	UserAgentTypes: pulumi.StringArray{
		pulumi.String("string"),
	},
	UserRiskScoreLevels: pulumi.StringArray{
		pulumi.String("string"),
	},
	Users: &zia.CloudAppControlRuleUsersArgs{
		Ids: pulumi.IntArray{
			pulumi.Int(0),
		},
	},
	ValidityEndTime:    pulumi.String("string"),
	ValidityStartTime:  pulumi.String("string"),
	ValidityTimeZoneId: pulumi.String("string"),
})

    var cloudAppControlRuleResource = new CloudAppControlRule("cloudAppControlRuleResource", CloudAppControlRuleArgs.builder()
    .order(0)
    .locations(CloudAppControlRuleLocationsArgs.builder()
        .ids(0)
        .build())
    .tenancyProfileIds(CloudAppControlRuleTenancyProfileIdsArgs.builder()
        .ids(0)
        .build())
    .cbiProfiles(CloudAppControlRuleCbiProfileArgs.builder()
        .id("string")
        .name("string")
        .url("string")
        .build())
    .cloudAppRiskProfiles(CloudAppControlRuleCloudAppRiskProfileArgs.builder()
        .id(0)
        .build())
    .departments(CloudAppControlRuleDepartmentsArgs.builder()
        .ids(0)
        .build())
    .description("string")
    .deviceGroups(CloudAppControlRuleDeviceGroupsArgs.builder()
        .ids(0)
        .build())
    .deviceTrustLevels("string")
    .devices(CloudAppControlRuleDevicesArgs.builder()
        .ids(0)
        .build())
    .enforceTimeValidity(false)
    .groups(CloudAppControlRuleGroupsArgs.builder()
        .ids(0)
        .build())
    .labels(CloudAppControlRuleLabelsArgs.builder()
        .ids(0)
        .build())
    .locationGroups(CloudAppControlRuleLocationGroupsArgs.builder()
        .ids(0)
        .build())
    .actions("string")
    .cascadingEnabled(false)
    .rank(0)
    .name("string")
    .sizeQuota(0)
    .state("string")
    .applications("string")
    .timeQuota(0)
    .timeWindows(CloudAppControlRuleTimeWindowsArgs.builder()
        .ids(0)
        .build())
    .type("string")
    .userAgentTypes("string")
    .userRiskScoreLevels("string")
    .users(CloudAppControlRuleUsersArgs.builder()
        .ids(0)
        .build())
    .validityEndTime("string")
    .validityStartTime("string")
    .validityTimeZoneId("string")
    .build());

    cloud_app_control_rule_resource = zia.CloudAppControlRule("cloudAppControlRuleResource",
    order=0,
    locations={
        "ids": [0],
    },
    tenancy_profile_ids={
        "ids": [0],
    },
    cbi_profiles=[{
        "id": "string",
        "name": "string",
        "url": "string",
    }],
    cloud_app_risk_profiles=[{
        "id": 0,
    }],
    departments={
        "ids": [0],
    },
    description="string",
    device_groups={
        "ids": [0],
    },
    device_trust_levels=["string"],
    devices={
        "ids": [0],
    },
    enforce_time_validity=False,
    groups={
        "ids": [0],
    },
    labels={
        "ids": [0],
    },
    location_groups={
        "ids": [0],
    },
    actions=["string"],
    cascading_enabled=False,
    rank=0,
    name="string",
    size_quota=0,
    state="string",
    applications=["string"],
    time_quota=0,
    time_windows={
        "ids": [0],
    },
    type="string",
    user_agent_types=["string"],
    user_risk_score_levels=["string"],
    users={
        "ids": [0],
    },
    validity_end_time="string",
    validity_start_time="string",
    validity_time_zone_id="string")

    const cloudAppControlRuleResource = new zia.CloudAppControlRule("cloudAppControlRuleResource", {
    order: 0,
    locations: {
        ids: [0],
    },
    tenancyProfileIds: {
        ids: [0],
    },
    cbiProfiles: [{
        id: "string",
        name: "string",
        url: "string",
    }],
    cloudAppRiskProfiles: [{
        id: 0,
    }],
    departments: {
        ids: [0],
    },
    description: "string",
    deviceGroups: {
        ids: [0],
    },
    deviceTrustLevels: ["string"],
    devices: {
        ids: [0],
    },
    enforceTimeValidity: false,
    groups: {
        ids: [0],
    },
    labels: {
        ids: [0],
    },
    locationGroups: {
        ids: [0],
    },
    actions: ["string"],
    cascadingEnabled: false,
    rank: 0,
    name: "string",
    sizeQuota: 0,
    state: "string",
    applications: ["string"],
    timeQuota: 0,
    timeWindows: {
        ids: [0],
    },
    type: "string",
    userAgentTypes: ["string"],
    userRiskScoreLevels: ["string"],
    users: {
        ids: [0],
    },
    validityEndTime: "string",
    validityStartTime: "string",
    validityTimeZoneId: "string",
});

    type: zia:CloudAppControlRule
properties:
    actions:
        - string
    applications:
        - string
    cascadingEnabled: false
    cbiProfiles:
        - id: string
          name: string
          url: string
    cloudAppRiskProfiles:
        - id: 0
    departments:
        ids:
            - 0
    description: string
    deviceGroups:
        ids:
            - 0
    deviceTrustLevels:
        - string
    devices:
        ids:
            - 0
    enforceTimeValidity: false
    groups:
        ids:
            - 0
    labels:
        ids:
            - 0
    locationGroups:
        ids:
            - 0
    locations:
        ids:
            - 0
    name: string
    order: 0
    rank: 0
    sizeQuota: 0
    state: string
    tenancyProfileIds:
        ids:
            - 0
    timeQuota: 0
    timeWindows:
        ids:
            - 0
    type: string
    userAgentTypes:
        - string
    userRiskScoreLevels:
        - string
    users:
        ids:
            - 0
    validityEndTime: string
    validityStartTime: string
    validityTimeZoneId: string

    CloudAppControlRule Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The CloudAppControlRule resource accepts the following input properties:

    Order int
    The order of execution for the forwarding rule order
    Actions List<string>
    Actions allowed for the specified type.
    Applications List<string>
    List of cloud applications for which rule will be applied
    CascadingEnabled bool
    nforce the URL Filtering policy on a transaction, even after it is explicitly allowed by the Cloud App Control policy.
    CbiProfiles List<zscaler.PulumiPackage.Zia.Inputs.CloudAppControlRuleCbiProfile>
    CloudAppRiskProfiles List<zscaler.PulumiPackage.Zia.Inputs.CloudAppControlRuleCloudAppRiskProfile>
    The DLP server, using ICAP, to which the transaction content is forwarded.
    Departments zscaler.PulumiPackage.Zia.Inputs.CloudAppControlRuleDepartments
    Name-ID pairs of departments for which rule must be applied
    Description string
    Additional information about the forwarding rule
    DeviceGroups zscaler.PulumiPackage.Zia.Inputs.CloudAppControlRuleDeviceGroups
    This field is applicable for devices that are managed using Zscaler Client Connector.
    DeviceTrustLevels List<string>
    List of device trust levels for which the rule must be applied. This field is applicable for devices that are managed using Zscaler Client Connector. The trust levels are assigned to the devices based on your posture configurations in the Zscaler Client Connector Portal. If no value is set, this field is ignored during the policy evaluation.
    Devices zscaler.PulumiPackage.Zia.Inputs.CloudAppControlRuleDevices
    Name-ID pairs of devices for which rule must be applied.
    EnforceTimeValidity bool
    Enforce a set a validity time period for the URL Filtering rule.
    Groups zscaler.PulumiPackage.Zia.Inputs.CloudAppControlRuleGroups
    Name-ID pairs of groups for which rule must be applied
    Labels zscaler.PulumiPackage.Zia.Inputs.CloudAppControlRuleLabels
    The URL Filtering rule's label.
    LocationGroups zscaler.PulumiPackage.Zia.Inputs.CloudAppControlRuleLocationGroups
    Name-ID pairs of the location groups to which the rule must be applied.
    Locations zscaler.PulumiPackage.Zia.Inputs.CloudAppControlRuleLocations
    Name-ID pairs of locations for which rule must be applied
    Name string
    The name of the forwarding rule
    Rank int
    Admin rank assigned to the forwarding rule
    SizeQuota int
    Size quota in KB beyond which the URL Filtering rule is applied. If not set, no quota is enforced. If a policy rule action is set to 'BLOCK', this field is not applicable.
    State string
    Determines whether the Firewall Filtering policy rule is enabled or disabled
    TenancyProfileIds zscaler.PulumiPackage.Zia.Inputs.CloudAppControlRuleTenancyProfileIds
    Name-ID pairs of groups for which rule must be applied
    TimeQuota int
    Time quota in minutes, after which the URL Filtering rule is applied. If not set, no quota is enforced. If a policy rule action is set to 'BLOCK', this field is not applicable.
    TimeWindows zscaler.PulumiPackage.Zia.Inputs.CloudAppControlRuleTimeWindows
    Name-ID pairs of time interval during which rule must be enforced.
    Type string
    Supported App Control Types
    UserAgentTypes List<string>
    Supported User Agent Types
    UserRiskScoreLevels List<string>
    Users zscaler.PulumiPackage.Zia.Inputs.CloudAppControlRuleUsers
    Name-ID pairs of users for which rule must be applied
    ValidityEndTime string
    If enforceTimeValidity is set to true, the URL Filtering rule ceases to be valid on this end date and time.
    ValidityStartTime string
    If enforceTimeValidity is set to true, the URL Filtering rule is valid starting on this date and time.
    ValidityTimeZoneId string
    If enforceTimeValidity is set to true, the URL Filtering rule date and time is valid based on this time zone ID. Use IANA Format TimeZone.
    Order int
    The order of execution for the forwarding rule order
    Actions []string
    Actions allowed for the specified type.
    Applications []string
    List of cloud applications for which rule will be applied
    CascadingEnabled bool
    nforce the URL Filtering policy on a transaction, even after it is explicitly allowed by the Cloud App Control policy.
    CbiProfiles []CloudAppControlRuleCbiProfileArgs
    CloudAppRiskProfiles []CloudAppControlRuleCloudAppRiskProfileArgs
    The DLP server, using ICAP, to which the transaction content is forwarded.
    Departments CloudAppControlRuleDepartmentsArgs
    Name-ID pairs of departments for which rule must be applied
    Description string
    Additional information about the forwarding rule
    DeviceGroups CloudAppControlRuleDeviceGroupsArgs
    This field is applicable for devices that are managed using Zscaler Client Connector.
    DeviceTrustLevels []string
    List of device trust levels for which the rule must be applied. This field is applicable for devices that are managed using Zscaler Client Connector. The trust levels are assigned to the devices based on your posture configurations in the Zscaler Client Connector Portal. If no value is set, this field is ignored during the policy evaluation.
    Devices CloudAppControlRuleDevicesArgs
    Name-ID pairs of devices for which rule must be applied.
    EnforceTimeValidity bool
    Enforce a set a validity time period for the URL Filtering rule.
    Groups CloudAppControlRuleGroupsArgs
    Name-ID pairs of groups for which rule must be applied
    Labels CloudAppControlRuleLabelsArgs
    The URL Filtering rule's label.
    LocationGroups CloudAppControlRuleLocationGroupsArgs
    Name-ID pairs of the location groups to which the rule must be applied.
    Locations CloudAppControlRuleLocationsArgs
    Name-ID pairs of locations for which rule must be applied
    Name string
    The name of the forwarding rule
    Rank int
    Admin rank assigned to the forwarding rule
    SizeQuota int
    Size quota in KB beyond which the URL Filtering rule is applied. If not set, no quota is enforced. If a policy rule action is set to 'BLOCK', this field is not applicable.
    State string
    Determines whether the Firewall Filtering policy rule is enabled or disabled
    TenancyProfileIds CloudAppControlRuleTenancyProfileIdsArgs
    Name-ID pairs of groups for which rule must be applied
    TimeQuota int
    Time quota in minutes, after which the URL Filtering rule is applied. If not set, no quota is enforced. If a policy rule action is set to 'BLOCK', this field is not applicable.
    TimeWindows CloudAppControlRuleTimeWindowsArgs
    Name-ID pairs of time interval during which rule must be enforced.
    Type string
    Supported App Control Types
    UserAgentTypes []string
    Supported User Agent Types
    UserRiskScoreLevels []string
    Users CloudAppControlRuleUsersArgs
    Name-ID pairs of users for which rule must be applied
    ValidityEndTime string
    If enforceTimeValidity is set to true, the URL Filtering rule ceases to be valid on this end date and time.
    ValidityStartTime string
    If enforceTimeValidity is set to true, the URL Filtering rule is valid starting on this date and time.
    ValidityTimeZoneId string
    If enforceTimeValidity is set to true, the URL Filtering rule date and time is valid based on this time zone ID. Use IANA Format TimeZone.
    order Integer
    The order of execution for the forwarding rule order
    actions List<String>
    Actions allowed for the specified type.
    applications List<String>
    List of cloud applications for which rule will be applied
    cascadingEnabled Boolean
    nforce the URL Filtering policy on a transaction, even after it is explicitly allowed by the Cloud App Control policy.
    cbiProfiles List<CloudAppControlRuleCbiProfile>
    cloudAppRiskProfiles List<CloudAppControlRuleCloudAppRiskProfile>
    The DLP server, using ICAP, to which the transaction content is forwarded.
    departments CloudAppControlRuleDepartments
    Name-ID pairs of departments for which rule must be applied
    description String
    Additional information about the forwarding rule
    deviceGroups CloudAppControlRuleDeviceGroups
    This field is applicable for devices that are managed using Zscaler Client Connector.
    deviceTrustLevels List<String>
    List of device trust levels for which the rule must be applied. This field is applicable for devices that are managed using Zscaler Client Connector. The trust levels are assigned to the devices based on your posture configurations in the Zscaler Client Connector Portal. If no value is set, this field is ignored during the policy evaluation.
    devices CloudAppControlRuleDevices
    Name-ID pairs of devices for which rule must be applied.
    enforceTimeValidity Boolean
    Enforce a set a validity time period for the URL Filtering rule.
    groups CloudAppControlRuleGroups
    Name-ID pairs of groups for which rule must be applied
    labels CloudAppControlRuleLabels
    The URL Filtering rule's label.
    locationGroups CloudAppControlRuleLocationGroups
    Name-ID pairs of the location groups to which the rule must be applied.
    locations CloudAppControlRuleLocations
    Name-ID pairs of locations for which rule must be applied
    name String
    The name of the forwarding rule
    rank Integer
    Admin rank assigned to the forwarding rule
    sizeQuota Integer
    Size quota in KB beyond which the URL Filtering rule is applied. If not set, no quota is enforced. If a policy rule action is set to 'BLOCK', this field is not applicable.
    state String
    Determines whether the Firewall Filtering policy rule is enabled or disabled
    tenancyProfileIds CloudAppControlRuleTenancyProfileIds
    Name-ID pairs of groups for which rule must be applied
    timeQuota Integer
    Time quota in minutes, after which the URL Filtering rule is applied. If not set, no quota is enforced. If a policy rule action is set to 'BLOCK', this field is not applicable.
    timeWindows CloudAppControlRuleTimeWindows
    Name-ID pairs of time interval during which rule must be enforced.
    type String
    Supported App Control Types
    userAgentTypes List<String>
    Supported User Agent Types
    userRiskScoreLevels List<String>
    users CloudAppControlRuleUsers
    Name-ID pairs of users for which rule must be applied
    validityEndTime String
    If enforceTimeValidity is set to true, the URL Filtering rule ceases to be valid on this end date and time.
    validityStartTime String
    If enforceTimeValidity is set to true, the URL Filtering rule is valid starting on this date and time.
    validityTimeZoneId String
    If enforceTimeValidity is set to true, the URL Filtering rule date and time is valid based on this time zone ID. Use IANA Format TimeZone.
    order number
    The order of execution for the forwarding rule order
    actions string[]
    Actions allowed for the specified type.
    applications string[]
    List of cloud applications for which rule will be applied
    cascadingEnabled boolean
    nforce the URL Filtering policy on a transaction, even after it is explicitly allowed by the Cloud App Control policy.
    cbiProfiles CloudAppControlRuleCbiProfile[]
    cloudAppRiskProfiles CloudAppControlRuleCloudAppRiskProfile[]
    The DLP server, using ICAP, to which the transaction content is forwarded.
    departments CloudAppControlRuleDepartments
    Name-ID pairs of departments for which rule must be applied
    description string
    Additional information about the forwarding rule
    deviceGroups CloudAppControlRuleDeviceGroups
    This field is applicable for devices that are managed using Zscaler Client Connector.
    deviceTrustLevels string[]
    List of device trust levels for which the rule must be applied. This field is applicable for devices that are managed using Zscaler Client Connector. The trust levels are assigned to the devices based on your posture configurations in the Zscaler Client Connector Portal. If no value is set, this field is ignored during the policy evaluation.
    devices CloudAppControlRuleDevices
    Name-ID pairs of devices for which rule must be applied.
    enforceTimeValidity boolean
    Enforce a set a validity time period for the URL Filtering rule.
    groups CloudAppControlRuleGroups
    Name-ID pairs of groups for which rule must be applied
    labels CloudAppControlRuleLabels
    The URL Filtering rule's label.
    locationGroups CloudAppControlRuleLocationGroups
    Name-ID pairs of the location groups to which the rule must be applied.
    locations CloudAppControlRuleLocations
    Name-ID pairs of locations for which rule must be applied
    name string
    The name of the forwarding rule
    rank number
    Admin rank assigned to the forwarding rule
    sizeQuota number
    Size quota in KB beyond which the URL Filtering rule is applied. If not set, no quota is enforced. If a policy rule action is set to 'BLOCK', this field is not applicable.
    state string
    Determines whether the Firewall Filtering policy rule is enabled or disabled
    tenancyProfileIds CloudAppControlRuleTenancyProfileIds
    Name-ID pairs of groups for which rule must be applied
    timeQuota number
    Time quota in minutes, after which the URL Filtering rule is applied. If not set, no quota is enforced. If a policy rule action is set to 'BLOCK', this field is not applicable.
    timeWindows CloudAppControlRuleTimeWindows
    Name-ID pairs of time interval during which rule must be enforced.
    type string
    Supported App Control Types
    userAgentTypes string[]
    Supported User Agent Types
    userRiskScoreLevels string[]
    users CloudAppControlRuleUsers
    Name-ID pairs of users for which rule must be applied
    validityEndTime string
    If enforceTimeValidity is set to true, the URL Filtering rule ceases to be valid on this end date and time.
    validityStartTime string
    If enforceTimeValidity is set to true, the URL Filtering rule is valid starting on this date and time.
    validityTimeZoneId string
    If enforceTimeValidity is set to true, the URL Filtering rule date and time is valid based on this time zone ID. Use IANA Format TimeZone.
    order int
    The order of execution for the forwarding rule order
    actions Sequence[str]
    Actions allowed for the specified type.
    applications Sequence[str]
    List of cloud applications for which rule will be applied
    cascading_enabled bool
    nforce the URL Filtering policy on a transaction, even after it is explicitly allowed by the Cloud App Control policy.
    cbi_profiles Sequence[CloudAppControlRuleCbiProfileArgs]
    cloud_app_risk_profiles Sequence[CloudAppControlRuleCloudAppRiskProfileArgs]
    The DLP server, using ICAP, to which the transaction content is forwarded.
    departments CloudAppControlRuleDepartmentsArgs
    Name-ID pairs of departments for which rule must be applied
    description str
    Additional information about the forwarding rule
    device_groups CloudAppControlRuleDeviceGroupsArgs
    This field is applicable for devices that are managed using Zscaler Client Connector.
    device_trust_levels Sequence[str]
    List of device trust levels for which the rule must be applied. This field is applicable for devices that are managed using Zscaler Client Connector. The trust levels are assigned to the devices based on your posture configurations in the Zscaler Client Connector Portal. If no value is set, this field is ignored during the policy evaluation.
    devices CloudAppControlRuleDevicesArgs
    Name-ID pairs of devices for which rule must be applied.
    enforce_time_validity bool
    Enforce a set a validity time period for the URL Filtering rule.
    groups CloudAppControlRuleGroupsArgs
    Name-ID pairs of groups for which rule must be applied
    labels CloudAppControlRuleLabelsArgs
    The URL Filtering rule's label.
    location_groups CloudAppControlRuleLocationGroupsArgs
    Name-ID pairs of the location groups to which the rule must be applied.
    locations CloudAppControlRuleLocationsArgs
    Name-ID pairs of locations for which rule must be applied
    name str
    The name of the forwarding rule
    rank int
    Admin rank assigned to the forwarding rule
    size_quota int
    Size quota in KB beyond which the URL Filtering rule is applied. If not set, no quota is enforced. If a policy rule action is set to 'BLOCK', this field is not applicable.
    state str
    Determines whether the Firewall Filtering policy rule is enabled or disabled
    tenancy_profile_ids CloudAppControlRuleTenancyProfileIdsArgs
    Name-ID pairs of groups for which rule must be applied
    time_quota int
    Time quota in minutes, after which the URL Filtering rule is applied. If not set, no quota is enforced. If a policy rule action is set to 'BLOCK', this field is not applicable.
    time_windows CloudAppControlRuleTimeWindowsArgs
    Name-ID pairs of time interval during which rule must be enforced.
    type str
    Supported App Control Types
    user_agent_types Sequence[str]
    Supported User Agent Types
    user_risk_score_levels Sequence[str]
    users CloudAppControlRuleUsersArgs
    Name-ID pairs of users for which rule must be applied
    validity_end_time str
    If enforceTimeValidity is set to true, the URL Filtering rule ceases to be valid on this end date and time.
    validity_start_time str
    If enforceTimeValidity is set to true, the URL Filtering rule is valid starting on this date and time.
    validity_time_zone_id str
    If enforceTimeValidity is set to true, the URL Filtering rule date and time is valid based on this time zone ID. Use IANA Format TimeZone.
    order Number
    The order of execution for the forwarding rule order
    actions List<String>
    Actions allowed for the specified type.
    applications List<String>
    List of cloud applications for which rule will be applied
    cascadingEnabled Boolean
    nforce the URL Filtering policy on a transaction, even after it is explicitly allowed by the Cloud App Control policy.
    cbiProfiles List<Property Map>
    cloudAppRiskProfiles List<Property Map>
    The DLP server, using ICAP, to which the transaction content is forwarded.
    departments Property Map
    Name-ID pairs of departments for which rule must be applied
    description String
    Additional information about the forwarding rule
    deviceGroups Property Map
    This field is applicable for devices that are managed using Zscaler Client Connector.
    deviceTrustLevels List<String>
    List of device trust levels for which the rule must be applied. This field is applicable for devices that are managed using Zscaler Client Connector. The trust levels are assigned to the devices based on your posture configurations in the Zscaler Client Connector Portal. If no value is set, this field is ignored during the policy evaluation.
    devices Property Map
    Name-ID pairs of devices for which rule must be applied.
    enforceTimeValidity Boolean
    Enforce a set a validity time period for the URL Filtering rule.
    groups Property Map
    Name-ID pairs of groups for which rule must be applied
    labels Property Map
    The URL Filtering rule's label.
    locationGroups Property Map
    Name-ID pairs of the location groups to which the rule must be applied.
    locations Property Map
    Name-ID pairs of locations for which rule must be applied
    name String
    The name of the forwarding rule
    rank Number
    Admin rank assigned to the forwarding rule
    sizeQuota Number
    Size quota in KB beyond which the URL Filtering rule is applied. If not set, no quota is enforced. If a policy rule action is set to 'BLOCK', this field is not applicable.
    state String
    Determines whether the Firewall Filtering policy rule is enabled or disabled
    tenancyProfileIds Property Map
    Name-ID pairs of groups for which rule must be applied
    timeQuota Number
    Time quota in minutes, after which the URL Filtering rule is applied. If not set, no quota is enforced. If a policy rule action is set to 'BLOCK', this field is not applicable.
    timeWindows Property Map
    Name-ID pairs of time interval during which rule must be enforced.
    type String
    Supported App Control Types
    userAgentTypes List<String>
    Supported User Agent Types
    userRiskScoreLevels List<String>
    users Property Map
    Name-ID pairs of users for which rule must be applied
    validityEndTime String
    If enforceTimeValidity is set to true, the URL Filtering rule ceases to be valid on this end date and time.
    validityStartTime String
    If enforceTimeValidity is set to true, the URL Filtering rule is valid starting on this date and time.
    validityTimeZoneId String
    If enforceTimeValidity is set to true, the URL Filtering rule date and time is valid based on this time zone ID. Use IANA Format TimeZone.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the CloudAppControlRule resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    RuleId int
    A unique identifier assigned to the forwarding rule
    Id string
    The provider-assigned unique ID for this managed resource.
    RuleId int
    A unique identifier assigned to the forwarding rule
    id String
    The provider-assigned unique ID for this managed resource.
    ruleId Integer
    A unique identifier assigned to the forwarding rule
    id string
    The provider-assigned unique ID for this managed resource.
    ruleId number
    A unique identifier assigned to the forwarding rule
    id str
    The provider-assigned unique ID for this managed resource.
    rule_id int
    A unique identifier assigned to the forwarding rule
    id String
    The provider-assigned unique ID for this managed resource.
    ruleId Number
    A unique identifier assigned to the forwarding rule

    Look up Existing CloudAppControlRule Resource

    Get an existing CloudAppControlRule resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: CloudAppControlRuleState, opts?: CustomResourceOptions): CloudAppControlRule
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        actions: Optional[Sequence[str]] = None,
        applications: Optional[Sequence[str]] = None,
        cascading_enabled: Optional[bool] = None,
        cbi_profiles: Optional[Sequence[CloudAppControlRuleCbiProfileArgs]] = None,
        cloud_app_risk_profiles: Optional[Sequence[CloudAppControlRuleCloudAppRiskProfileArgs]] = None,
        departments: Optional[CloudAppControlRuleDepartmentsArgs] = None,
        description: Optional[str] = None,
        device_groups: Optional[CloudAppControlRuleDeviceGroupsArgs] = None,
        device_trust_levels: Optional[Sequence[str]] = None,
        devices: Optional[CloudAppControlRuleDevicesArgs] = None,
        enforce_time_validity: Optional[bool] = None,
        groups: Optional[CloudAppControlRuleGroupsArgs] = None,
        labels: Optional[CloudAppControlRuleLabelsArgs] = None,
        location_groups: Optional[CloudAppControlRuleLocationGroupsArgs] = None,
        locations: Optional[CloudAppControlRuleLocationsArgs] = None,
        name: Optional[str] = None,
        order: Optional[int] = None,
        rank: Optional[int] = None,
        rule_id: Optional[int] = None,
        size_quota: Optional[int] = None,
        state: Optional[str] = None,
        tenancy_profile_ids: Optional[CloudAppControlRuleTenancyProfileIdsArgs] = None,
        time_quota: Optional[int] = None,
        time_windows: Optional[CloudAppControlRuleTimeWindowsArgs] = None,
        type: Optional[str] = None,
        user_agent_types: Optional[Sequence[str]] = None,
        user_risk_score_levels: Optional[Sequence[str]] = None,
        users: Optional[CloudAppControlRuleUsersArgs] = None,
        validity_end_time: Optional[str] = None,
        validity_start_time: Optional[str] = None,
        validity_time_zone_id: Optional[str] = None) -> CloudAppControlRule
    func GetCloudAppControlRule(ctx *Context, name string, id IDInput, state *CloudAppControlRuleState, opts ...ResourceOption) (*CloudAppControlRule, error)
    public static CloudAppControlRule Get(string name, Input<string> id, CloudAppControlRuleState? state, CustomResourceOptions? opts = null)
    public static CloudAppControlRule get(String name, Output<String> id, CloudAppControlRuleState state, CustomResourceOptions options)
    resources:  _:    type: zia:CloudAppControlRule    get:      id: ${id}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    Actions List<string>
    Actions allowed for the specified type.
    Applications List<string>
    List of cloud applications for which rule will be applied
    CascadingEnabled bool
    nforce the URL Filtering policy on a transaction, even after it is explicitly allowed by the Cloud App Control policy.
    CbiProfiles List<zscaler.PulumiPackage.Zia.Inputs.CloudAppControlRuleCbiProfile>
    CloudAppRiskProfiles List<zscaler.PulumiPackage.Zia.Inputs.CloudAppControlRuleCloudAppRiskProfile>
    The DLP server, using ICAP, to which the transaction content is forwarded.
    Departments zscaler.PulumiPackage.Zia.Inputs.CloudAppControlRuleDepartments
    Name-ID pairs of departments for which rule must be applied
    Description string
    Additional information about the forwarding rule
    DeviceGroups zscaler.PulumiPackage.Zia.Inputs.CloudAppControlRuleDeviceGroups
    This field is applicable for devices that are managed using Zscaler Client Connector.
    DeviceTrustLevels List<string>
    List of device trust levels for which the rule must be applied. This field is applicable for devices that are managed using Zscaler Client Connector. The trust levels are assigned to the devices based on your posture configurations in the Zscaler Client Connector Portal. If no value is set, this field is ignored during the policy evaluation.
    Devices zscaler.PulumiPackage.Zia.Inputs.CloudAppControlRuleDevices
    Name-ID pairs of devices for which rule must be applied.
    EnforceTimeValidity bool
    Enforce a set a validity time period for the URL Filtering rule.
    Groups zscaler.PulumiPackage.Zia.Inputs.CloudAppControlRuleGroups
    Name-ID pairs of groups for which rule must be applied
    Labels zscaler.PulumiPackage.Zia.Inputs.CloudAppControlRuleLabels
    The URL Filtering rule's label.
    LocationGroups zscaler.PulumiPackage.Zia.Inputs.CloudAppControlRuleLocationGroups
    Name-ID pairs of the location groups to which the rule must be applied.
    Locations zscaler.PulumiPackage.Zia.Inputs.CloudAppControlRuleLocations
    Name-ID pairs of locations for which rule must be applied
    Name string
    The name of the forwarding rule
    Order int
    The order of execution for the forwarding rule order
    Rank int
    Admin rank assigned to the forwarding rule
    RuleId int
    A unique identifier assigned to the forwarding rule
    SizeQuota int
    Size quota in KB beyond which the URL Filtering rule is applied. If not set, no quota is enforced. If a policy rule action is set to 'BLOCK', this field is not applicable.
    State string
    Determines whether the Firewall Filtering policy rule is enabled or disabled
    TenancyProfileIds zscaler.PulumiPackage.Zia.Inputs.CloudAppControlRuleTenancyProfileIds
    Name-ID pairs of groups for which rule must be applied
    TimeQuota int
    Time quota in minutes, after which the URL Filtering rule is applied. If not set, no quota is enforced. If a policy rule action is set to 'BLOCK', this field is not applicable.
    TimeWindows zscaler.PulumiPackage.Zia.Inputs.CloudAppControlRuleTimeWindows
    Name-ID pairs of time interval during which rule must be enforced.
    Type string
    Supported App Control Types
    UserAgentTypes List<string>
    Supported User Agent Types
    UserRiskScoreLevels List<string>
    Users zscaler.PulumiPackage.Zia.Inputs.CloudAppControlRuleUsers
    Name-ID pairs of users for which rule must be applied
    ValidityEndTime string
    If enforceTimeValidity is set to true, the URL Filtering rule ceases to be valid on this end date and time.
    ValidityStartTime string
    If enforceTimeValidity is set to true, the URL Filtering rule is valid starting on this date and time.
    ValidityTimeZoneId string
    If enforceTimeValidity is set to true, the URL Filtering rule date and time is valid based on this time zone ID. Use IANA Format TimeZone.
    Actions []string
    Actions allowed for the specified type.
    Applications []string
    List of cloud applications for which rule will be applied
    CascadingEnabled bool
    nforce the URL Filtering policy on a transaction, even after it is explicitly allowed by the Cloud App Control policy.
    CbiProfiles []CloudAppControlRuleCbiProfileArgs
    CloudAppRiskProfiles []CloudAppControlRuleCloudAppRiskProfileArgs
    The DLP server, using ICAP, to which the transaction content is forwarded.
    Departments CloudAppControlRuleDepartmentsArgs
    Name-ID pairs of departments for which rule must be applied
    Description string
    Additional information about the forwarding rule
    DeviceGroups CloudAppControlRuleDeviceGroupsArgs
    This field is applicable for devices that are managed using Zscaler Client Connector.
    DeviceTrustLevels []string
    List of device trust levels for which the rule must be applied. This field is applicable for devices that are managed using Zscaler Client Connector. The trust levels are assigned to the devices based on your posture configurations in the Zscaler Client Connector Portal. If no value is set, this field is ignored during the policy evaluation.
    Devices CloudAppControlRuleDevicesArgs
    Name-ID pairs of devices for which rule must be applied.
    EnforceTimeValidity bool
    Enforce a set a validity time period for the URL Filtering rule.
    Groups CloudAppControlRuleGroupsArgs
    Name-ID pairs of groups for which rule must be applied
    Labels CloudAppControlRuleLabelsArgs
    The URL Filtering rule's label.
    LocationGroups CloudAppControlRuleLocationGroupsArgs
    Name-ID pairs of the location groups to which the rule must be applied.
    Locations CloudAppControlRuleLocationsArgs
    Name-ID pairs of locations for which rule must be applied
    Name string
    The name of the forwarding rule
    Order int
    The order of execution for the forwarding rule order
    Rank int
    Admin rank assigned to the forwarding rule
    RuleId int
    A unique identifier assigned to the forwarding rule
    SizeQuota int
    Size quota in KB beyond which the URL Filtering rule is applied. If not set, no quota is enforced. If a policy rule action is set to 'BLOCK', this field is not applicable.
    State string
    Determines whether the Firewall Filtering policy rule is enabled or disabled
    TenancyProfileIds CloudAppControlRuleTenancyProfileIdsArgs
    Name-ID pairs of groups for which rule must be applied
    TimeQuota int
    Time quota in minutes, after which the URL Filtering rule is applied. If not set, no quota is enforced. If a policy rule action is set to 'BLOCK', this field is not applicable.
    TimeWindows CloudAppControlRuleTimeWindowsArgs
    Name-ID pairs of time interval during which rule must be enforced.
    Type string
    Supported App Control Types
    UserAgentTypes []string
    Supported User Agent Types
    UserRiskScoreLevels []string
    Users CloudAppControlRuleUsersArgs
    Name-ID pairs of users for which rule must be applied
    ValidityEndTime string
    If enforceTimeValidity is set to true, the URL Filtering rule ceases to be valid on this end date and time.
    ValidityStartTime string
    If enforceTimeValidity is set to true, the URL Filtering rule is valid starting on this date and time.
    ValidityTimeZoneId string
    If enforceTimeValidity is set to true, the URL Filtering rule date and time is valid based on this time zone ID. Use IANA Format TimeZone.
    actions List<String>
    Actions allowed for the specified type.
    applications List<String>
    List of cloud applications for which rule will be applied
    cascadingEnabled Boolean
    nforce the URL Filtering policy on a transaction, even after it is explicitly allowed by the Cloud App Control policy.
    cbiProfiles List<CloudAppControlRuleCbiProfile>
    cloudAppRiskProfiles List<CloudAppControlRuleCloudAppRiskProfile>
    The DLP server, using ICAP, to which the transaction content is forwarded.
    departments CloudAppControlRuleDepartments
    Name-ID pairs of departments for which rule must be applied
    description String
    Additional information about the forwarding rule
    deviceGroups CloudAppControlRuleDeviceGroups
    This field is applicable for devices that are managed using Zscaler Client Connector.
    deviceTrustLevels List<String>
    List of device trust levels for which the rule must be applied. This field is applicable for devices that are managed using Zscaler Client Connector. The trust levels are assigned to the devices based on your posture configurations in the Zscaler Client Connector Portal. If no value is set, this field is ignored during the policy evaluation.
    devices CloudAppControlRuleDevices
    Name-ID pairs of devices for which rule must be applied.
    enforceTimeValidity Boolean
    Enforce a set a validity time period for the URL Filtering rule.
    groups CloudAppControlRuleGroups
    Name-ID pairs of groups for which rule must be applied
    labels CloudAppControlRuleLabels
    The URL Filtering rule's label.
    locationGroups CloudAppControlRuleLocationGroups
    Name-ID pairs of the location groups to which the rule must be applied.
    locations CloudAppControlRuleLocations
    Name-ID pairs of locations for which rule must be applied
    name String
    The name of the forwarding rule
    order Integer
    The order of execution for the forwarding rule order
    rank Integer
    Admin rank assigned to the forwarding rule
    ruleId Integer
    A unique identifier assigned to the forwarding rule
    sizeQuota Integer
    Size quota in KB beyond which the URL Filtering rule is applied. If not set, no quota is enforced. If a policy rule action is set to 'BLOCK', this field is not applicable.
    state String
    Determines whether the Firewall Filtering policy rule is enabled or disabled
    tenancyProfileIds CloudAppControlRuleTenancyProfileIds
    Name-ID pairs of groups for which rule must be applied
    timeQuota Integer
    Time quota in minutes, after which the URL Filtering rule is applied. If not set, no quota is enforced. If a policy rule action is set to 'BLOCK', this field is not applicable.
    timeWindows CloudAppControlRuleTimeWindows
    Name-ID pairs of time interval during which rule must be enforced.
    type String
    Supported App Control Types
    userAgentTypes List<String>
    Supported User Agent Types
    userRiskScoreLevels List<String>
    users CloudAppControlRuleUsers
    Name-ID pairs of users for which rule must be applied
    validityEndTime String
    If enforceTimeValidity is set to true, the URL Filtering rule ceases to be valid on this end date and time.
    validityStartTime String
    If enforceTimeValidity is set to true, the URL Filtering rule is valid starting on this date and time.
    validityTimeZoneId String
    If enforceTimeValidity is set to true, the URL Filtering rule date and time is valid based on this time zone ID. Use IANA Format TimeZone.
    actions string[]
    Actions allowed for the specified type.
    applications string[]
    List of cloud applications for which rule will be applied
    cascadingEnabled boolean
    nforce the URL Filtering policy on a transaction, even after it is explicitly allowed by the Cloud App Control policy.
    cbiProfiles CloudAppControlRuleCbiProfile[]
    cloudAppRiskProfiles CloudAppControlRuleCloudAppRiskProfile[]
    The DLP server, using ICAP, to which the transaction content is forwarded.
    departments CloudAppControlRuleDepartments
    Name-ID pairs of departments for which rule must be applied
    description string
    Additional information about the forwarding rule
    deviceGroups CloudAppControlRuleDeviceGroups
    This field is applicable for devices that are managed using Zscaler Client Connector.
    deviceTrustLevels string[]
    List of device trust levels for which the rule must be applied. This field is applicable for devices that are managed using Zscaler Client Connector. The trust levels are assigned to the devices based on your posture configurations in the Zscaler Client Connector Portal. If no value is set, this field is ignored during the policy evaluation.
    devices CloudAppControlRuleDevices
    Name-ID pairs of devices for which rule must be applied.
    enforceTimeValidity boolean
    Enforce a set a validity time period for the URL Filtering rule.
    groups CloudAppControlRuleGroups
    Name-ID pairs of groups for which rule must be applied
    labels CloudAppControlRuleLabels
    The URL Filtering rule's label.
    locationGroups CloudAppControlRuleLocationGroups
    Name-ID pairs of the location groups to which the rule must be applied.
    locations CloudAppControlRuleLocations
    Name-ID pairs of locations for which rule must be applied
    name string
    The name of the forwarding rule
    order number
    The order of execution for the forwarding rule order
    rank number
    Admin rank assigned to the forwarding rule
    ruleId number
    A unique identifier assigned to the forwarding rule
    sizeQuota number
    Size quota in KB beyond which the URL Filtering rule is applied. If not set, no quota is enforced. If a policy rule action is set to 'BLOCK', this field is not applicable.
    state string
    Determines whether the Firewall Filtering policy rule is enabled or disabled
    tenancyProfileIds CloudAppControlRuleTenancyProfileIds
    Name-ID pairs of groups for which rule must be applied
    timeQuota number
    Time quota in minutes, after which the URL Filtering rule is applied. If not set, no quota is enforced. If a policy rule action is set to 'BLOCK', this field is not applicable.
    timeWindows CloudAppControlRuleTimeWindows
    Name-ID pairs of time interval during which rule must be enforced.
    type string
    Supported App Control Types
    userAgentTypes string[]
    Supported User Agent Types
    userRiskScoreLevels string[]
    users CloudAppControlRuleUsers
    Name-ID pairs of users for which rule must be applied
    validityEndTime string
    If enforceTimeValidity is set to true, the URL Filtering rule ceases to be valid on this end date and time.
    validityStartTime string
    If enforceTimeValidity is set to true, the URL Filtering rule is valid starting on this date and time.
    validityTimeZoneId string
    If enforceTimeValidity is set to true, the URL Filtering rule date and time is valid based on this time zone ID. Use IANA Format TimeZone.
    actions Sequence[str]
    Actions allowed for the specified type.
    applications Sequence[str]
    List of cloud applications for which rule will be applied
    cascading_enabled bool
    nforce the URL Filtering policy on a transaction, even after it is explicitly allowed by the Cloud App Control policy.
    cbi_profiles Sequence[CloudAppControlRuleCbiProfileArgs]
    cloud_app_risk_profiles Sequence[CloudAppControlRuleCloudAppRiskProfileArgs]
    The DLP server, using ICAP, to which the transaction content is forwarded.
    departments CloudAppControlRuleDepartmentsArgs
    Name-ID pairs of departments for which rule must be applied
    description str
    Additional information about the forwarding rule
    device_groups CloudAppControlRuleDeviceGroupsArgs
    This field is applicable for devices that are managed using Zscaler Client Connector.
    device_trust_levels Sequence[str]
    List of device trust levels for which the rule must be applied. This field is applicable for devices that are managed using Zscaler Client Connector. The trust levels are assigned to the devices based on your posture configurations in the Zscaler Client Connector Portal. If no value is set, this field is ignored during the policy evaluation.
    devices CloudAppControlRuleDevicesArgs
    Name-ID pairs of devices for which rule must be applied.
    enforce_time_validity bool
    Enforce a set a validity time period for the URL Filtering rule.
    groups CloudAppControlRuleGroupsArgs
    Name-ID pairs of groups for which rule must be applied
    labels CloudAppControlRuleLabelsArgs
    The URL Filtering rule's label.
    location_groups CloudAppControlRuleLocationGroupsArgs
    Name-ID pairs of the location groups to which the rule must be applied.
    locations CloudAppControlRuleLocationsArgs
    Name-ID pairs of locations for which rule must be applied
    name str
    The name of the forwarding rule
    order int
    The order of execution for the forwarding rule order
    rank int
    Admin rank assigned to the forwarding rule
    rule_id int
    A unique identifier assigned to the forwarding rule
    size_quota int
    Size quota in KB beyond which the URL Filtering rule is applied. If not set, no quota is enforced. If a policy rule action is set to 'BLOCK', this field is not applicable.
    state str
    Determines whether the Firewall Filtering policy rule is enabled or disabled
    tenancy_profile_ids CloudAppControlRuleTenancyProfileIdsArgs
    Name-ID pairs of groups for which rule must be applied
    time_quota int
    Time quota in minutes, after which the URL Filtering rule is applied. If not set, no quota is enforced. If a policy rule action is set to 'BLOCK', this field is not applicable.
    time_windows CloudAppControlRuleTimeWindowsArgs
    Name-ID pairs of time interval during which rule must be enforced.
    type str
    Supported App Control Types
    user_agent_types Sequence[str]
    Supported User Agent Types
    user_risk_score_levels Sequence[str]
    users CloudAppControlRuleUsersArgs
    Name-ID pairs of users for which rule must be applied
    validity_end_time str
    If enforceTimeValidity is set to true, the URL Filtering rule ceases to be valid on this end date and time.
    validity_start_time str
    If enforceTimeValidity is set to true, the URL Filtering rule is valid starting on this date and time.
    validity_time_zone_id str
    If enforceTimeValidity is set to true, the URL Filtering rule date and time is valid based on this time zone ID. Use IANA Format TimeZone.
    actions List<String>
    Actions allowed for the specified type.
    applications List<String>
    List of cloud applications for which rule will be applied
    cascadingEnabled Boolean
    nforce the URL Filtering policy on a transaction, even after it is explicitly allowed by the Cloud App Control policy.
    cbiProfiles List<Property Map>
    cloudAppRiskProfiles List<Property Map>
    The DLP server, using ICAP, to which the transaction content is forwarded.
    departments Property Map
    Name-ID pairs of departments for which rule must be applied
    description String
    Additional information about the forwarding rule
    deviceGroups Property Map
    This field is applicable for devices that are managed using Zscaler Client Connector.
    deviceTrustLevels List<String>
    List of device trust levels for which the rule must be applied. This field is applicable for devices that are managed using Zscaler Client Connector. The trust levels are assigned to the devices based on your posture configurations in the Zscaler Client Connector Portal. If no value is set, this field is ignored during the policy evaluation.
    devices Property Map
    Name-ID pairs of devices for which rule must be applied.
    enforceTimeValidity Boolean
    Enforce a set a validity time period for the URL Filtering rule.
    groups Property Map
    Name-ID pairs of groups for which rule must be applied
    labels Property Map
    The URL Filtering rule's label.
    locationGroups Property Map
    Name-ID pairs of the location groups to which the rule must be applied.
    locations Property Map
    Name-ID pairs of locations for which rule must be applied
    name String
    The name of the forwarding rule
    order Number
    The order of execution for the forwarding rule order
    rank Number
    Admin rank assigned to the forwarding rule
    ruleId Number
    A unique identifier assigned to the forwarding rule
    sizeQuota Number
    Size quota in KB beyond which the URL Filtering rule is applied. If not set, no quota is enforced. If a policy rule action is set to 'BLOCK', this field is not applicable.
    state String
    Determines whether the Firewall Filtering policy rule is enabled or disabled
    tenancyProfileIds Property Map
    Name-ID pairs of groups for which rule must be applied
    timeQuota Number
    Time quota in minutes, after which the URL Filtering rule is applied. If not set, no quota is enforced. If a policy rule action is set to 'BLOCK', this field is not applicable.
    timeWindows Property Map
    Name-ID pairs of time interval during which rule must be enforced.
    type String
    Supported App Control Types
    userAgentTypes List<String>
    Supported User Agent Types
    userRiskScoreLevels List<String>
    users Property Map
    Name-ID pairs of users for which rule must be applied
    validityEndTime String
    If enforceTimeValidity is set to true, the URL Filtering rule ceases to be valid on this end date and time.
    validityStartTime String
    If enforceTimeValidity is set to true, the URL Filtering rule is valid starting on this date and time.
    validityTimeZoneId String
    If enforceTimeValidity is set to true, the URL Filtering rule date and time is valid based on this time zone ID. Use IANA Format TimeZone.

    Supporting Types

    CloudAppControlRuleCbiProfile, CloudAppControlRuleCbiProfileArgs

    Id string
    Name string
    Url string
    The browser isolation profile URL
    Id string
    Name string
    Url string
    The browser isolation profile URL
    id String
    name String
    url String
    The browser isolation profile URL
    id string
    name string
    url string
    The browser isolation profile URL
    id str
    name str
    url str
    The browser isolation profile URL
    id String
    name String
    url String
    The browser isolation profile URL

    CloudAppControlRuleCloudAppRiskProfile, CloudAppControlRuleCloudAppRiskProfileArgs

    Id int
    Id int
    id Integer
    id number
    id int
    id Number

    CloudAppControlRuleDepartments, CloudAppControlRuleDepartmentsArgs

    Ids List<int>
    Ids []int
    ids List<Integer>
    ids number[]
    ids Sequence[int]
    ids List<Number>

    CloudAppControlRuleDeviceGroups, CloudAppControlRuleDeviceGroupsArgs

    Ids List<int>
    Ids []int
    ids List<Integer>
    ids number[]
    ids Sequence[int]
    ids List<Number>

    CloudAppControlRuleDevices, CloudAppControlRuleDevicesArgs

    Ids List<int>
    Ids []int
    ids List<Integer>
    ids number[]
    ids Sequence[int]
    ids List<Number>

    CloudAppControlRuleGroups, CloudAppControlRuleGroupsArgs

    Ids List<int>
    Ids []int
    ids List<Integer>
    ids number[]
    ids Sequence[int]
    ids List<Number>

    CloudAppControlRuleLabels, CloudAppControlRuleLabelsArgs

    Ids List<int>
    Ids []int
    ids List<Integer>
    ids number[]
    ids Sequence[int]
    ids List<Number>

    CloudAppControlRuleLocationGroups, CloudAppControlRuleLocationGroupsArgs

    Ids List<int>
    Ids []int
    ids List<Integer>
    ids number[]
    ids Sequence[int]
    ids List<Number>

    CloudAppControlRuleLocations, CloudAppControlRuleLocationsArgs

    Ids List<int>
    Ids []int
    ids List<Integer>
    ids number[]
    ids Sequence[int]
    ids List<Number>

    CloudAppControlRuleTenancyProfileIds, CloudAppControlRuleTenancyProfileIdsArgs

    Ids List<int>
    Ids []int
    ids List<Integer>
    ids number[]
    ids Sequence[int]
    ids List<Number>

    CloudAppControlRuleTimeWindows, CloudAppControlRuleTimeWindowsArgs

    Ids List<int>
    Ids []int
    ids List<Integer>
    ids number[]
    ids Sequence[int]
    ids List<Number>

    CloudAppControlRuleUsers, CloudAppControlRuleUsersArgs

    Ids List<int>
    Ids []int
    ids List<Integer>
    ids number[]
    ids Sequence[int]
    ids List<Number>

    Import

    Zscaler offers a dedicated tool called Zscaler-Terraformer to allow the automated import of ZPA configurations into Terraform-compliant HashiCorp Configuration Language.

    Visit

    Policy access rule can be imported by using <RULE_TYPE:RULE_ID> or <RULE_TYPE:RULE_NAME> as the import ID.

    For example:

    $ pulumi import zia:index/cloudAppControlRule:CloudAppControlRule this <rule_type:rule_id>

    $ pulumi import zia:index/cloudAppControlRule:CloudAppControlRule this <"rule_type:rule_name">

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    zia zscaler/pulumi-zia
    License
    MIT
    Notes
    This Pulumi package is based on the zia Terraform Provider.
    zia logo
    Zscaler Internet Access v1.0.1 published on Friday, Jun 6, 2025 by Zscaler
    zscaler/pulumi-zia