1. Packages
  2. Zscaler Internet Access (ZIA)
  3. API Docs
  4. FirewallDNSRule
Viewing docs for pulumi-resource-zia v1.3.8
published on Friday, Mar 13, 2026 by Zscaler
Schema (JSON)
zscaler/pulumi-zia

zia.FirewallDNSRule

zia logo
Viewing docs for pulumi-resource-zia v1.3.8
published on Friday, Mar 13, 2026 by Zscaler
Schema (JSON)
zscaler/pulumi-zia

    The zia_firewall_dns_rule resource manages firewall DNS control rules in the Zscaler Internet Access (ZIA) cloud service. DNS control rules allow you to control DNS traffic by allowing, blocking, or redirecting DNS requests based on various criteria such as source, destination, applications, and DNS request types.

    For more information, see the ZIA DNS Control Policies documentation.

    Example Usage

    Basic Firewall DNS Rule

    Example coming soon!

    import (
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
	zia "github.com/zscaler/pulumi-zia/sdk/go/pulumi-zia"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := zia.NewFirewallDNSRule(ctx, "example", &zia.FirewallDNSRuleArgs{
			Name:        pulumi.String("Example DNS Rule"),
			Description: pulumi.StringRef("Block malicious DNS requests"),
			Order:       pulumi.Int(1),
			State:       pulumi.StringRef("ENABLED"),
			Action:      pulumi.StringRef("BLOCK_DROP"),
		})
		return err
	})
}

    Example coming soon!

    import * as zia from "@bdzscaler/pulumi-zia";

const example = new zia.FirewallDNSRule("example", {
    name: "Example DNS Rule",
    description: "Block malicious DNS requests",
    order: 1,
    state: "ENABLED",
    action: "BLOCK_DROP",
});

    import zscaler_pulumi_zia as zia

example = zia.FirewallDNSRule("example",
    name="Example DNS Rule",
    description="Block malicious DNS requests",
    order=1,
    state="ENABLED",
    action="BLOCK_DROP",
)

    resources:
  example:
    type: zia:FirewallDNSRule
    properties:
      name: Example DNS Rule
      description: Block malicious DNS requests
      order: 1
      state: ENABLED
      action: BLOCK_DROP

    Create FirewallDNSRule Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new FirewallDNSRule(name: string, args: FirewallDNSRuleArgs, opts?: CustomResourceOptions);
    @overload
def FirewallDNSRule(resource_name: str,
                    args: FirewallDNSRuleArgs,
                    opts: Optional[ResourceOptions] = None)

@overload
def FirewallDNSRule(resource_name: str,
                    opts: Optional[ResourceOptions] = None,
                    name: Optional[str] = None,
                    order: Optional[int] = None,
                    is_web_eun_enabled: Optional[bool] = None,
                    labels: Optional[Sequence[int]] = None,
                    default_rule: Optional[bool] = None,
                    departments: Optional[Sequence[int]] = None,
                    description: Optional[str] = None,
                    dest_addresses: Optional[Sequence[str]] = None,
                    dest_countries: Optional[Sequence[str]] = None,
                    dest_ip_categories: Optional[Sequence[str]] = None,
                    dest_ip_groups: Optional[Sequence[int]] = None,
                    dest_ipv6_groups: Optional[Sequence[int]] = None,
                    device_groups: Optional[Sequence[int]] = None,
                    devices: Optional[Sequence[int]] = None,
                    dns_gateway: Optional[int] = None,
                    dns_rule_request_types: Optional[Sequence[str]] = None,
                    edns_ecs_object: Optional[int] = None,
                    groups: Optional[Sequence[int]] = None,
                    capture_pcap: Optional[bool] = None,
                    action: Optional[str] = None,
                    location_groups: Optional[Sequence[int]] = None,
                    locations: Optional[Sequence[int]] = None,
                    block_response_code: Optional[str] = None,
                    applications: Optional[Sequence[str]] = None,
                    predefined: Optional[bool] = None,
                    protocols: Optional[Sequence[str]] = None,
                    rank: Optional[int] = None,
                    redirect_ip: Optional[str] = None,
                    res_categories: Optional[Sequence[str]] = None,
                    source_countries: Optional[Sequence[str]] = None,
                    src_ip_groups: Optional[Sequence[int]] = None,
                    src_ips: Optional[Sequence[str]] = None,
                    src_ipv6_groups: Optional[Sequence[int]] = None,
                    state: Optional[str] = None,
                    time_windows: Optional[Sequence[int]] = None,
                    users: Optional[Sequence[int]] = None,
                    zpa_ip_group: Optional[int] = None)
    func NewFirewallDNSRule(ctx *Context, name string, args FirewallDNSRuleArgs, opts ...ResourceOption) (*FirewallDNSRule, error)
    public FirewallDNSRule(string name, FirewallDNSRuleArgs args, CustomResourceOptions? opts = null)
    public FirewallDNSRule(String name, FirewallDNSRuleArgs args)
public FirewallDNSRule(String name, FirewallDNSRuleArgs args, CustomResourceOptions options)

    type: zia:FirewallDNSRule
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

    Parameters

    name string
    The unique name of the resource.
    args FirewallDNSRuleArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args FirewallDNSRuleArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args FirewallDNSRuleArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args FirewallDNSRuleArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args FirewallDNSRuleArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var firewallDNSRuleResource = new Zia.FirewallDNSRule("firewallDNSRuleResource", new()
{
    Name = "string",
    Order = 0,
    IsWebEunEnabled = false,
    Labels = new[]
    {
        0,
    },
    DefaultRule = false,
    Departments = new[]
    {
        0,
    },
    Description = "string",
    DestAddresses = new[]
    {
        "string",
    },
    DestCountries = new[]
    {
        "string",
    },
    DestIpCategories = new[]
    {
        "string",
    },
    DestIpGroups = new[]
    {
        0,
    },
    DestIpv6Groups = new[]
    {
        0,
    },
    DeviceGroups = new[]
    {
        0,
    },
    Devices = new[]
    {
        0,
    },
    DnsGateway = 0,
    DnsRuleRequestTypes = new[]
    {
        "string",
    },
    EdnsEcsObject = 0,
    Groups = new[]
    {
        0,
    },
    CapturePcap = false,
    Action = "string",
    LocationGroups = new[]
    {
        0,
    },
    Locations = new[]
    {
        0,
    },
    BlockResponseCode = "string",
    Applications = new[]
    {
        "string",
    },
    Predefined = false,
    Protocols = new[]
    {
        "string",
    },
    Rank = 0,
    RedirectIp = "string",
    ResCategories = new[]
    {
        "string",
    },
    SourceCountries = new[]
    {
        "string",
    },
    SrcIpGroups = new[]
    {
        0,
    },
    SrcIps = new[]
    {
        "string",
    },
    SrcIpv6Groups = new[]
    {
        0,
    },
    State = "string",
    TimeWindows = new[]
    {
        0,
    },
    Users = new[]
    {
        0,
    },
    ZpaIpGroup = 0,
});

    example, err := zia.NewFirewallDNSRule(ctx, "firewallDNSRuleResource", &zia.FirewallDNSRuleArgs{
	Name:            pulumi.String("string"),
	Order:           pulumi.Int(0),
	IsWebEunEnabled: pulumi.Bool(false),
	Labels: pulumi.IntArray{
		pulumi.Int(0),
	},
	DefaultRule: pulumi.Bool(false),
	Departments: pulumi.IntArray{
		pulumi.Int(0),
	},
	Description: pulumi.String("string"),
	DestAddresses: pulumi.StringArray{
		pulumi.String("string"),
	},
	DestCountries: pulumi.StringArray{
		pulumi.String("string"),
	},
	DestIpCategories: pulumi.StringArray{
		pulumi.String("string"),
	},
	DestIpGroups: pulumi.IntArray{
		pulumi.Int(0),
	},
	DestIpv6Groups: pulumi.IntArray{
		pulumi.Int(0),
	},
	DeviceGroups: pulumi.IntArray{
		pulumi.Int(0),
	},
	Devices: pulumi.IntArray{
		pulumi.Int(0),
	},
	DnsGateway: pulumi.Int(0),
	DnsRuleRequestTypes: pulumi.StringArray{
		pulumi.String("string"),
	},
	EdnsEcsObject: pulumi.Int(0),
	Groups: pulumi.IntArray{
		pulumi.Int(0),
	},
	CapturePcap: pulumi.Bool(false),
	Action:      pulumi.String("string"),
	LocationGroups: pulumi.IntArray{
		pulumi.Int(0),
	},
	Locations: pulumi.IntArray{
		pulumi.Int(0),
	},
	BlockResponseCode: pulumi.String("string"),
	Applications: pulumi.StringArray{
		pulumi.String("string"),
	},
	Predefined: pulumi.Bool(false),
	Protocols: pulumi.StringArray{
		pulumi.String("string"),
	},
	Rank:       pulumi.Int(0),
	RedirectIp: pulumi.String("string"),
	ResCategories: pulumi.StringArray{
		pulumi.String("string"),
	},
	SourceCountries: pulumi.StringArray{
		pulumi.String("string"),
	},
	SrcIpGroups: pulumi.IntArray{
		pulumi.Int(0),
	},
	SrcIps: pulumi.StringArray{
		pulumi.String("string"),
	},
	SrcIpv6Groups: pulumi.IntArray{
		pulumi.Int(0),
	},
	State: pulumi.String("string"),
	TimeWindows: pulumi.IntArray{
		pulumi.Int(0),
	},
	Users: pulumi.IntArray{
		pulumi.Int(0),
	},
	ZpaIpGroup: pulumi.Int(0),
})

    var firewallDNSRuleResource = new FirewallDNSRule("firewallDNSRuleResource", FirewallDNSRuleArgs.builder()
    .name("string")
    .order(0)
    .isWebEunEnabled(false)
    .labels(0)
    .defaultRule(false)
    .departments(0)
    .description("string")
    .destAddresses("string")
    .destCountries("string")
    .destIpCategories("string")
    .destIpGroups(0)
    .destIpv6Groups(0)
    .deviceGroups(0)
    .devices(0)
    .dnsGateway(0)
    .dnsRuleRequestTypes("string")
    .ednsEcsObject(0)
    .groups(0)
    .capturePcap(false)
    .action("string")
    .locationGroups(0)
    .locations(0)
    .blockResponseCode("string")
    .applications("string")
    .predefined(false)
    .protocols("string")
    .rank(0)
    .redirectIp("string")
    .resCategories("string")
    .sourceCountries("string")
    .srcIpGroups(0)
    .srcIps("string")
    .srcIpv6Groups(0)
    .state("string")
    .timeWindows(0)
    .users(0)
    .zpaIpGroup(0)
    .build());

    firewall_dns_rule_resource = zia.FirewallDNSRule("firewallDNSRuleResource",
    name="string",
    order=0,
    is_web_eun_enabled=False,
    labels=[0],
    default_rule=False,
    departments=[0],
    description="string",
    dest_addresses=["string"],
    dest_countries=["string"],
    dest_ip_categories=["string"],
    dest_ip_groups=[0],
    dest_ipv6_groups=[0],
    device_groups=[0],
    devices=[0],
    dns_gateway=0,
    dns_rule_request_types=["string"],
    edns_ecs_object=0,
    groups=[0],
    capture_pcap=False,
    action="string",
    location_groups=[0],
    locations=[0],
    block_response_code="string",
    applications=["string"],
    predefined=False,
    protocols=["string"],
    rank=0,
    redirect_ip="string",
    res_categories=["string"],
    source_countries=["string"],
    src_ip_groups=[0],
    src_ips=["string"],
    src_ipv6_groups=[0],
    state="string",
    time_windows=[0],
    users=[0],
    zpa_ip_group=0)

    const firewallDNSRuleResource = new zia.FirewallDNSRule("firewallDNSRuleResource", {
    name: "string",
    order: 0,
    isWebEunEnabled: false,
    labels: [0],
    defaultRule: false,
    departments: [0],
    description: "string",
    destAddresses: ["string"],
    destCountries: ["string"],
    destIpCategories: ["string"],
    destIpGroups: [0],
    destIpv6Groups: [0],
    deviceGroups: [0],
    devices: [0],
    dnsGateway: 0,
    dnsRuleRequestTypes: ["string"],
    ednsEcsObject: 0,
    groups: [0],
    capturePcap: false,
    action: "string",
    locationGroups: [0],
    locations: [0],
    blockResponseCode: "string",
    applications: ["string"],
    predefined: false,
    protocols: ["string"],
    rank: 0,
    redirectIp: "string",
    resCategories: ["string"],
    sourceCountries: ["string"],
    srcIpGroups: [0],
    srcIps: ["string"],
    srcIpv6Groups: [0],
    state: "string",
    timeWindows: [0],
    users: [0],
    zpaIpGroup: 0,
});

    type: zia:FirewallDNSRule
properties:
    action: string
    applications:
        - string
    blockResponseCode: string
    capturePcap: false
    defaultRule: false
    departments:
        - 0
    description: string
    destAddresses:
        - string
    destCountries:
        - string
    destIpCategories:
        - string
    destIpGroups:
        - 0
    destIpv6Groups:
        - 0
    deviceGroups:
        - 0
    devices:
        - 0
    dnsGateway: 0
    dnsRuleRequestTypes:
        - string
    ednsEcsObject: 0
    groups:
        - 0
    isWebEunEnabled: false
    labels:
        - 0
    locationGroups:
        - 0
    locations:
        - 0
    name: string
    order: 0
    predefined: false
    protocols:
        - string
    rank: 0
    redirectIp: string
    resCategories:
        - string
    sourceCountries:
        - string
    srcIpGroups:
        - 0
    srcIps:
        - string
    srcIpv6Groups:
        - 0
    state: string
    timeWindows:
        - 0
    users:
        - 0
    zpaIpGroup: 0

    FirewallDNSRule Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The FirewallDNSRule resource accepts the following input properties:

    Name string
    The name of the firewall DNS rule. Must be unique.
    Order int
    The order of execution of the rule with respect to other firewall DNS rules.
    Action string
    The action the rule takes when traffic matches. Valid values: ALLOW, BLOCK_DROP, BLOCK_RESET, BLOCK_ICMP, REDIR_REQ.
    Applications List<string>
    DNS application values to which the rule applies.
    BlockResponseCode string
    The DNS response code to return when blocking. Valid values: ANY, NONE, FORMERR, SERVFAIL, NXDOMAIN, NOTIMP, REFUSED, NOTAUTH, NXRRSET.
    CapturePcap bool
    If set to true, enables packet capture (PCAP) for the rule.
    DefaultRule bool
    Indicates whether this is the default firewall DNS rule.
    Departments List<int>
    IDs of departments to which the rule must be applied.
    Description string
    Additional information about the firewall DNS rule.
    DestAddresses List<string>
    Destination IP addresses, FQDNs, or wildcard FQDNs for the rule.
    DestCountries List<string>
    Destination countries (ISO 3166-1 alpha-2 codes) for the rule.
    DestIpCategories List<string>
    Destination IP address URL categories for the rule.
    DestIpGroups List<int>
    IDs of destination IP address groups for the rule.
    DestIpv6Groups List<int>
    IDs of destination IPv6 address groups for the rule.
    DeviceGroups List<int>
    IDs of device groups for which the rule must be applied. Applicable for devices managed using Zscaler Client Connector.
    Devices List<int>
    IDs of devices for which the rule must be applied.
    DnsGateway int
    The ID of the DNS gateway associated with the rule.
    DnsRuleRequestTypes List<string>
    DNS request types to which the rule applies. Valid values: A, AAAA, CNAME, MX, NS, SOA, TXT, SRV, PTR, ANY.
    EdnsEcsObject int
    The ID of the EDNS ECS object associated with the rule.
    Groups List<int>
    IDs of groups to which the rule must be applied.
    IsWebEunEnabled bool
    If set to true, enables web end user notification for the rule.
    Labels List<int>
    IDs of labels associated with the rule.
    LocationGroups List<int>
    IDs of location groups to which the rule must be applied.
    Locations List<int>
    IDs of locations to which the rule must be applied.
    Predefined bool
    Indicates whether this is a predefined rule.
    Protocols List<string>
    Protocols to which the rule applies. Valid values: ANY_RULE, TCP_RULE, UDP_RULE.
    Rank int
    Admin rank of the firewall DNS policy rule. Valid values: 0-7. Default: 7.
    RedirectIp string
    The IP address to redirect DNS requests to. Required when action is REDIR_REQ.
    ResCategories List<string>
    URL categories that apply to the response for the rule.
    SourceCountries List<string>
    Source countries (ISO 3166-1 alpha-2 codes) for the rule.
    SrcIpGroups List<int>
    IDs of source IP address groups for the rule.
    SrcIps List<string>
    Source IP addresses or CIDR ranges for the rule.
    SrcIpv6Groups List<int>
    IDs of source IPv6 address groups for the rule.
    State string
    Rule state. Valid values: ENABLED, DISABLED.
    TimeWindows List<int>
    IDs of time intervals during which the rule must be enforced.
    Users List<int>
    IDs of users to which the rule must be applied.
    ZpaIpGroup int
    The ID of the ZPA IP group associated with the rule.
    Name string
    The name of the firewall DNS rule. Must be unique.
    Order int
    The order of execution of the rule with respect to other firewall DNS rules.
    Action string
    The action the rule takes when traffic matches. Valid values: ALLOW, BLOCK_DROP, BLOCK_RESET, BLOCK_ICMP, REDIR_REQ.
    Applications []string
    DNS application values to which the rule applies.
    BlockResponseCode string
    The DNS response code to return when blocking. Valid values: ANY, NONE, FORMERR, SERVFAIL, NXDOMAIN, NOTIMP, REFUSED, NOTAUTH, NXRRSET.
    CapturePcap bool
    If set to true, enables packet capture (PCAP) for the rule.
    DefaultRule bool
    Indicates whether this is the default firewall DNS rule.
    Departments []int
    IDs of departments to which the rule must be applied.
    Description string
    Additional information about the firewall DNS rule.
    DestAddresses []string
    Destination IP addresses, FQDNs, or wildcard FQDNs for the rule.
    DestCountries []string
    Destination countries (ISO 3166-1 alpha-2 codes) for the rule.
    DestIpCategories []string
    Destination IP address URL categories for the rule.
    DestIpGroups []int
    IDs of destination IP address groups for the rule.
    DestIpv6Groups []int
    IDs of destination IPv6 address groups for the rule.
    DeviceGroups []int
    IDs of device groups for which the rule must be applied. Applicable for devices managed using Zscaler Client Connector.
    Devices []int
    IDs of devices for which the rule must be applied.
    DnsGateway int
    The ID of the DNS gateway associated with the rule.
    DnsRuleRequestTypes []string
    DNS request types to which the rule applies. Valid values: A, AAAA, CNAME, MX, NS, SOA, TXT, SRV, PTR, ANY.
    EdnsEcsObject int
    The ID of the EDNS ECS object associated with the rule.
    Groups []int
    IDs of groups to which the rule must be applied.
    IsWebEunEnabled bool
    If set to true, enables web end user notification for the rule.
    Labels []int
    IDs of labels associated with the rule.
    LocationGroups []int
    IDs of location groups to which the rule must be applied.
    Locations []int
    IDs of locations to which the rule must be applied.
    Predefined bool
    Indicates whether this is a predefined rule.
    Protocols []string
    Protocols to which the rule applies. Valid values: ANY_RULE, TCP_RULE, UDP_RULE.
    Rank int
    Admin rank of the firewall DNS policy rule. Valid values: 0-7. Default: 7.
    RedirectIp string
    The IP address to redirect DNS requests to. Required when action is REDIR_REQ.
    ResCategories []string
    URL categories that apply to the response for the rule.
    SourceCountries []string
    Source countries (ISO 3166-1 alpha-2 codes) for the rule.
    SrcIpGroups []int
    IDs of source IP address groups for the rule.
    SrcIps []string
    Source IP addresses or CIDR ranges for the rule.
    SrcIpv6Groups []int
    IDs of source IPv6 address groups for the rule.
    State string
    Rule state. Valid values: ENABLED, DISABLED.
    TimeWindows []int
    IDs of time intervals during which the rule must be enforced.
    Users []int
    IDs of users to which the rule must be applied.
    ZpaIpGroup int
    The ID of the ZPA IP group associated with the rule.
    name String
    The name of the firewall DNS rule. Must be unique.
    order Integer
    The order of execution of the rule with respect to other firewall DNS rules.
    action String
    The action the rule takes when traffic matches. Valid values: ALLOW, BLOCK_DROP, BLOCK_RESET, BLOCK_ICMP, REDIR_REQ.
    applications List<String>
    DNS application values to which the rule applies.
    blockResponseCode String
    The DNS response code to return when blocking. Valid values: ANY, NONE, FORMERR, SERVFAIL, NXDOMAIN, NOTIMP, REFUSED, NOTAUTH, NXRRSET.
    capturePcap Boolean
    If set to true, enables packet capture (PCAP) for the rule.
    defaultRule Boolean
    Indicates whether this is the default firewall DNS rule.
    departments List<Integer>
    IDs of departments to which the rule must be applied.
    description String
    Additional information about the firewall DNS rule.
    destAddresses List<String>
    Destination IP addresses, FQDNs, or wildcard FQDNs for the rule.
    destCountries List<String>
    Destination countries (ISO 3166-1 alpha-2 codes) for the rule.
    destIpCategories List<String>
    Destination IP address URL categories for the rule.
    destIpGroups List<Integer>
    IDs of destination IP address groups for the rule.
    destIpv6Groups List<Integer>
    IDs of destination IPv6 address groups for the rule.
    deviceGroups List<Integer>
    IDs of device groups for which the rule must be applied. Applicable for devices managed using Zscaler Client Connector.
    devices List<Integer>
    IDs of devices for which the rule must be applied.
    dnsGateway Integer
    The ID of the DNS gateway associated with the rule.
    dnsRuleRequestTypes List<String>
    DNS request types to which the rule applies. Valid values: A, AAAA, CNAME, MX, NS, SOA, TXT, SRV, PTR, ANY.
    ednsEcsObject Integer
    The ID of the EDNS ECS object associated with the rule.
    groups List<Integer>
    IDs of groups to which the rule must be applied.
    isWebEunEnabled Boolean
    If set to true, enables web end user notification for the rule.
    labels List<Integer>
    IDs of labels associated with the rule.
    locationGroups List<Integer>
    IDs of location groups to which the rule must be applied.
    locations List<Integer>
    IDs of locations to which the rule must be applied.
    predefined Boolean
    Indicates whether this is a predefined rule.
    protocols List<String>
    Protocols to which the rule applies. Valid values: ANY_RULE, TCP_RULE, UDP_RULE.
    rank Integer
    Admin rank of the firewall DNS policy rule. Valid values: 0-7. Default: 7.
    redirectIp String
    The IP address to redirect DNS requests to. Required when action is REDIR_REQ.
    resCategories List<String>
    URL categories that apply to the response for the rule.
    sourceCountries List<String>
    Source countries (ISO 3166-1 alpha-2 codes) for the rule.
    srcIpGroups List<Integer>
    IDs of source IP address groups for the rule.
    srcIps List<String>
    Source IP addresses or CIDR ranges for the rule.
    srcIpv6Groups List<Integer>
    IDs of source IPv6 address groups for the rule.
    state String
    Rule state. Valid values: ENABLED, DISABLED.
    timeWindows List<Integer>
    IDs of time intervals during which the rule must be enforced.
    users List<Integer>
    IDs of users to which the rule must be applied.
    zpaIpGroup Integer
    The ID of the ZPA IP group associated with the rule.
    name string
    The name of the firewall DNS rule. Must be unique.
    order number
    The order of execution of the rule with respect to other firewall DNS rules.
    action string
    The action the rule takes when traffic matches. Valid values: ALLOW, BLOCK_DROP, BLOCK_RESET, BLOCK_ICMP, REDIR_REQ.
    applications string[]
    DNS application values to which the rule applies.
    blockResponseCode string
    The DNS response code to return when blocking. Valid values: ANY, NONE, FORMERR, SERVFAIL, NXDOMAIN, NOTIMP, REFUSED, NOTAUTH, NXRRSET.
    capturePcap boolean
    If set to true, enables packet capture (PCAP) for the rule.
    defaultRule boolean
    Indicates whether this is the default firewall DNS rule.
    departments number[]
    IDs of departments to which the rule must be applied.
    description string
    Additional information about the firewall DNS rule.
    destAddresses string[]
    Destination IP addresses, FQDNs, or wildcard FQDNs for the rule.
    destCountries string[]
    Destination countries (ISO 3166-1 alpha-2 codes) for the rule.
    destIpCategories string[]
    Destination IP address URL categories for the rule.
    destIpGroups number[]
    IDs of destination IP address groups for the rule.
    destIpv6Groups number[]
    IDs of destination IPv6 address groups for the rule.
    deviceGroups number[]
    IDs of device groups for which the rule must be applied. Applicable for devices managed using Zscaler Client Connector.
    devices number[]
    IDs of devices for which the rule must be applied.
    dnsGateway number
    The ID of the DNS gateway associated with the rule.
    dnsRuleRequestTypes string[]
    DNS request types to which the rule applies. Valid values: A, AAAA, CNAME, MX, NS, SOA, TXT, SRV, PTR, ANY.
    ednsEcsObject number
    The ID of the EDNS ECS object associated with the rule.
    groups number[]
    IDs of groups to which the rule must be applied.
    isWebEunEnabled boolean
    If set to true, enables web end user notification for the rule.
    labels number[]
    IDs of labels associated with the rule.
    locationGroups number[]
    IDs of location groups to which the rule must be applied.
    locations number[]
    IDs of locations to which the rule must be applied.
    predefined boolean
    Indicates whether this is a predefined rule.
    protocols string[]
    Protocols to which the rule applies. Valid values: ANY_RULE, TCP_RULE, UDP_RULE.
    rank number
    Admin rank of the firewall DNS policy rule. Valid values: 0-7. Default: 7.
    redirectIp string
    The IP address to redirect DNS requests to. Required when action is REDIR_REQ.
    resCategories string[]
    URL categories that apply to the response for the rule.
    sourceCountries string[]
    Source countries (ISO 3166-1 alpha-2 codes) for the rule.
    srcIpGroups number[]
    IDs of source IP address groups for the rule.
    srcIps string[]
    Source IP addresses or CIDR ranges for the rule.
    srcIpv6Groups number[]
    IDs of source IPv6 address groups for the rule.
    state string
    Rule state. Valid values: ENABLED, DISABLED.
    timeWindows number[]
    IDs of time intervals during which the rule must be enforced.
    users number[]
    IDs of users to which the rule must be applied.
    zpaIpGroup number
    The ID of the ZPA IP group associated with the rule.
    name str
    The name of the firewall DNS rule. Must be unique.
    order int
    The order of execution of the rule with respect to other firewall DNS rules.
    action str
    The action the rule takes when traffic matches. Valid values: ALLOW, BLOCK_DROP, BLOCK_RESET, BLOCK_ICMP, REDIR_REQ.
    applications Sequence[str]
    DNS application values to which the rule applies.
    block_response_code str
    The DNS response code to return when blocking. Valid values: ANY, NONE, FORMERR, SERVFAIL, NXDOMAIN, NOTIMP, REFUSED, NOTAUTH, NXRRSET.
    capture_pcap bool
    If set to true, enables packet capture (PCAP) for the rule.
    default_rule bool
    Indicates whether this is the default firewall DNS rule.
    departments Sequence[int]
    IDs of departments to which the rule must be applied.
    description str
    Additional information about the firewall DNS rule.
    dest_addresses Sequence[str]
    Destination IP addresses, FQDNs, or wildcard FQDNs for the rule.
    dest_countries Sequence[str]
    Destination countries (ISO 3166-1 alpha-2 codes) for the rule.
    dest_ip_categories Sequence[str]
    Destination IP address URL categories for the rule.
    dest_ip_groups Sequence[int]
    IDs of destination IP address groups for the rule.
    dest_ipv6_groups Sequence[int]
    IDs of destination IPv6 address groups for the rule.
    device_groups Sequence[int]
    IDs of device groups for which the rule must be applied. Applicable for devices managed using Zscaler Client Connector.
    devices Sequence[int]
    IDs of devices for which the rule must be applied.
    dns_gateway int
    The ID of the DNS gateway associated with the rule.
    dns_rule_request_types Sequence[str]
    DNS request types to which the rule applies. Valid values: A, AAAA, CNAME, MX, NS, SOA, TXT, SRV, PTR, ANY.
    edns_ecs_object int
    The ID of the EDNS ECS object associated with the rule.
    groups Sequence[int]
    IDs of groups to which the rule must be applied.
    is_web_eun_enabled bool
    If set to true, enables web end user notification for the rule.
    labels Sequence[int]
    IDs of labels associated with the rule.
    location_groups Sequence[int]
    IDs of location groups to which the rule must be applied.
    locations Sequence[int]
    IDs of locations to which the rule must be applied.
    predefined bool
    Indicates whether this is a predefined rule.
    protocols Sequence[str]
    Protocols to which the rule applies. Valid values: ANY_RULE, TCP_RULE, UDP_RULE.
    rank int
    Admin rank of the firewall DNS policy rule. Valid values: 0-7. Default: 7.
    redirect_ip str
    The IP address to redirect DNS requests to. Required when action is REDIR_REQ.
    res_categories Sequence[str]
    URL categories that apply to the response for the rule.
    source_countries Sequence[str]
    Source countries (ISO 3166-1 alpha-2 codes) for the rule.
    src_ip_groups Sequence[int]
    IDs of source IP address groups for the rule.
    src_ips Sequence[str]
    Source IP addresses or CIDR ranges for the rule.
    src_ipv6_groups Sequence[int]
    IDs of source IPv6 address groups for the rule.
    state str
    Rule state. Valid values: ENABLED, DISABLED.
    time_windows Sequence[int]
    IDs of time intervals during which the rule must be enforced.
    users Sequence[int]
    IDs of users to which the rule must be applied.
    zpa_ip_group int
    The ID of the ZPA IP group associated with the rule.
    name String
    The name of the firewall DNS rule. Must be unique.
    order Number
    The order of execution of the rule with respect to other firewall DNS rules.
    action String
    The action the rule takes when traffic matches. Valid values: ALLOW, BLOCK_DROP, BLOCK_RESET, BLOCK_ICMP, REDIR_REQ.
    applications List<String>
    DNS application values to which the rule applies.
    blockResponseCode String
    The DNS response code to return when blocking. Valid values: ANY, NONE, FORMERR, SERVFAIL, NXDOMAIN, NOTIMP, REFUSED, NOTAUTH, NXRRSET.
    capturePcap Boolean
    If set to true, enables packet capture (PCAP) for the rule.
    defaultRule Boolean
    Indicates whether this is the default firewall DNS rule.
    departments List<Number>
    IDs of departments to which the rule must be applied.
    description String
    Additional information about the firewall DNS rule.
    destAddresses List<String>
    Destination IP addresses, FQDNs, or wildcard FQDNs for the rule.
    destCountries List<String>
    Destination countries (ISO 3166-1 alpha-2 codes) for the rule.
    destIpCategories List<String>
    Destination IP address URL categories for the rule.
    destIpGroups List<Number>
    IDs of destination IP address groups for the rule.
    destIpv6Groups List<Number>
    IDs of destination IPv6 address groups for the rule.
    deviceGroups List<Number>
    IDs of device groups for which the rule must be applied. Applicable for devices managed using Zscaler Client Connector.
    devices List<Number>
    IDs of devices for which the rule must be applied.
    dnsGateway Number
    The ID of the DNS gateway associated with the rule.
    dnsRuleRequestTypes List<String>
    DNS request types to which the rule applies. Valid values: A, AAAA, CNAME, MX, NS, SOA, TXT, SRV, PTR, ANY.
    ednsEcsObject Number
    The ID of the EDNS ECS object associated with the rule.
    groups List<Number>
    IDs of groups to which the rule must be applied.
    isWebEunEnabled Boolean
    If set to true, enables web end user notification for the rule.
    labels List<Number>
    IDs of labels associated with the rule.
    locationGroups List<Number>
    IDs of location groups to which the rule must be applied.
    locations List<Number>
    IDs of locations to which the rule must be applied.
    predefined Boolean
    Indicates whether this is a predefined rule.
    protocols List<String>
    Protocols to which the rule applies. Valid values: ANY_RULE, TCP_RULE, UDP_RULE.
    rank Number
    Admin rank of the firewall DNS policy rule. Valid values: 0-7. Default: 7.
    redirectIp String
    The IP address to redirect DNS requests to. Required when action is REDIR_REQ.
    resCategories List<String>
    URL categories that apply to the response for the rule.
    sourceCountries List<String>
    Source countries (ISO 3166-1 alpha-2 codes) for the rule.
    srcIpGroups List<Number>
    IDs of source IP address groups for the rule.
    srcIps List<String>
    Source IP addresses or CIDR ranges for the rule.
    srcIpv6Groups List<Number>
    IDs of source IPv6 address groups for the rule.
    state String
    Rule state. Valid values: ENABLED, DISABLED.
    timeWindows List<Number>
    IDs of time intervals during which the rule must be enforced.
    users List<Number>
    IDs of users to which the rule must be applied.
    zpaIpGroup Number
    The ID of the ZPA IP group associated with the rule.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the FirewallDNSRule resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    RuleId int
    The system-generated ID of the firewall DNS rule.
    Id string
    The provider-assigned unique ID for this managed resource.
    RuleId int
    The system-generated ID of the firewall DNS rule.
    id String
    The provider-assigned unique ID for this managed resource.
    ruleId Integer
    The system-generated ID of the firewall DNS rule.
    id string
    The provider-assigned unique ID for this managed resource.
    ruleId number
    The system-generated ID of the firewall DNS rule.
    id str
    The provider-assigned unique ID for this managed resource.
    rule_id int
    The system-generated ID of the firewall DNS rule.
    id String
    The provider-assigned unique ID for this managed resource.
    ruleId Number
    The system-generated ID of the firewall DNS rule.

    Import

    An existing Firewall DNS Rule can be imported using its resource ID, e.g.

    $ pulumi import zia:index:FirewallDNSRule example 12345

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    zia zscaler/pulumi-zia
    License
    zia logo
    Viewing docs for pulumi-resource-zia v1.3.8
    published on Friday, Mar 13, 2026 by Zscaler
    Schema (JSON)
    zscaler/pulumi-zia
      Try Pulumi Cloud free. Your team will thank you.