1. Packages
  2. Zscaler Internet Access (ZIA)
  3. API Docs
  4. FirewallFilteringRule
Viewing docs for pulumi-resource-zia v1.3.8
published on Friday, Mar 13, 2026 by Zscaler
Schema (JSON)
zscaler/pulumi-zia

zia.FirewallFilteringRule

zia logo
Viewing docs for pulumi-resource-zia v1.3.8
published on Friday, Mar 13, 2026 by Zscaler
Schema (JSON)
zscaler/pulumi-zia

    The zia_firewall_filtering_rule resource manages firewall filtering rules in the Zscaler Internet Access (ZIA) cloud service. Cloud firewall rules control traffic that is forwarded to the Zscaler service for inspection, allowing you to allow, block, or apply specific actions based on source, destination, applications, and other criteria.

    For more information, see the ZIA Cloud Firewall documentation.

    Example Usage

    Basic Firewall Filtering Rule

    Example coming soon!

    import (
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
	zia "github.com/zscaler/pulumi-zia/sdk/go/pulumi-zia"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := zia.NewFirewallFilteringRule(ctx, "example", &zia.FirewallFilteringRuleArgs{
			Name:        pulumi.String("Example Firewall Rule"),
			Description: pulumi.StringRef("Allow outbound traffic"),
			Order:       pulumi.Int(1),
			State:       pulumi.StringRef("ENABLED"),
			Action:      pulumi.StringRef("ALLOW"),
		})
		return err
	})
}

    Example coming soon!

    import * as zia from "@bdzscaler/pulumi-zia";

const example = new zia.FirewallFilteringRule("example", {
    name: "Example Firewall Rule",
    description: "Allow outbound traffic",
    order: 1,
    state: "ENABLED",
    action: "ALLOW",
});

    import zscaler_pulumi_zia as zia

example = zia.FirewallFilteringRule("example",
    name="Example Firewall Rule",
    description="Allow outbound traffic",
    order=1,
    state="ENABLED",
    action="ALLOW",
)

    resources:
  example:
    type: zia:FirewallFilteringRule
    properties:
      name: Example Firewall Rule
      description: Allow outbound traffic
      order: 1
      state: ENABLED
      action: ALLOW

    Create FirewallFilteringRule Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new FirewallFilteringRule(name: string, args: FirewallFilteringRuleArgs, opts?: CustomResourceOptions);
    @overload
def FirewallFilteringRule(resource_name: str,
                          args: FirewallFilteringRuleArgs,
                          opts: Optional[ResourceOptions] = None)

@overload
def FirewallFilteringRule(resource_name: str,
                          opts: Optional[ResourceOptions] = None,
                          name: Optional[str] = None,
                          order: Optional[int] = None,
                          dest_ip_categories: Optional[Sequence[str]] = None,
                          app_services: Optional[Sequence[int]] = None,
                          departments: Optional[Sequence[int]] = None,
                          description: Optional[str] = None,
                          dest_addresses: Optional[Sequence[str]] = None,
                          dest_countries: Optional[Sequence[str]] = None,
                          action: Optional[str] = None,
                          dest_ip_groups: Optional[Sequence[int]] = None,
                          device_groups: Optional[Sequence[int]] = None,
                          device_trust_levels: Optional[Sequence[str]] = None,
                          devices: Optional[Sequence[int]] = None,
                          enable_full_logging: Optional[bool] = None,
                          exclude_src_countries: Optional[bool] = None,
                          groups: Optional[Sequence[int]] = None,
                          labels: Optional[Sequence[int]] = None,
                          location_groups: Optional[Sequence[int]] = None,
                          default_rule: Optional[bool] = None,
                          nw_application_groups: Optional[Sequence[int]] = None,
                          locations: Optional[Sequence[int]] = None,
                          nw_applications: Optional[Sequence[str]] = None,
                          nw_service_groups: Optional[Sequence[int]] = None,
                          nw_services: Optional[Sequence[int]] = None,
                          app_service_groups: Optional[Sequence[int]] = None,
                          predefined: Optional[bool] = None,
                          rank: Optional[int] = None,
                          source_countries: Optional[Sequence[str]] = None,
                          src_ip_groups: Optional[Sequence[int]] = None,
                          src_ips: Optional[Sequence[str]] = None,
                          state: Optional[str] = None,
                          time_windows: Optional[Sequence[int]] = None,
                          users: Optional[Sequence[int]] = None,
                          workload_groups: Optional[Sequence[WorkloadGroupInputArgs]] = None,
                          zpa_app_segments: Optional[Sequence[ZPAAppSegmentInputArgs]] = None)
    func NewFirewallFilteringRule(ctx *Context, name string, args FirewallFilteringRuleArgs, opts ...ResourceOption) (*FirewallFilteringRule, error)
    public FirewallFilteringRule(string name, FirewallFilteringRuleArgs args, CustomResourceOptions? opts = null)
    public FirewallFilteringRule(String name, FirewallFilteringRuleArgs args)
public FirewallFilteringRule(String name, FirewallFilteringRuleArgs args, CustomResourceOptions options)

    type: zia:FirewallFilteringRule
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

    Parameters

    name string
    The unique name of the resource.
    args FirewallFilteringRuleArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args FirewallFilteringRuleArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args FirewallFilteringRuleArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args FirewallFilteringRuleArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args FirewallFilteringRuleArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var firewallFilteringRuleResource = new Zia.FirewallFilteringRule("firewallFilteringRuleResource", new()
{
    Name = "string",
    Order = 0,
    DestIpCategories = new[]
    {
        "string",
    },
    AppServices = new[]
    {
        0,
    },
    Departments = new[]
    {
        0,
    },
    Description = "string",
    DestAddresses = new[]
    {
        "string",
    },
    DestCountries = new[]
    {
        "string",
    },
    Action = "string",
    DestIpGroups = new[]
    {
        0,
    },
    DeviceGroups = new[]
    {
        0,
    },
    DeviceTrustLevels = new[]
    {
        "string",
    },
    Devices = new[]
    {
        0,
    },
    EnableFullLogging = false,
    ExcludeSrcCountries = false,
    Groups = new[]
    {
        0,
    },
    Labels = new[]
    {
        0,
    },
    LocationGroups = new[]
    {
        0,
    },
    DefaultRule = false,
    NwApplicationGroups = new[]
    {
        0,
    },
    Locations = new[]
    {
        0,
    },
    NwApplications = new[]
    {
        "string",
    },
    NwServiceGroups = new[]
    {
        0,
    },
    NwServices = new[]
    {
        0,
    },
    AppServiceGroups = new[]
    {
        0,
    },
    Predefined = false,
    Rank = 0,
    SourceCountries = new[]
    {
        "string",
    },
    SrcIpGroups = new[]
    {
        0,
    },
    SrcIps = new[]
    {
        "string",
    },
    State = "string",
    TimeWindows = new[]
    {
        0,
    },
    Users = new[]
    {
        0,
    },
    WorkloadGroups = new[]
    {
        new Zia.Inputs.WorkloadGroupInputArgs
        {
            ResourceId = 0,
            Name = "string",
        },
    },
    ZpaAppSegments = new[]
    {
        new Zia.Inputs.ZPAAppSegmentInputArgs
        {
            ExternalId = "string",
            Name = "string",
        },
    },
});

    example, err := zia.NewFirewallFilteringRule(ctx, "firewallFilteringRuleResource", &zia.FirewallFilteringRuleArgs{
	Name:  pulumi.String("string"),
	Order: pulumi.Int(0),
	DestIpCategories: pulumi.StringArray{
		pulumi.String("string"),
	},
	AppServices: pulumi.IntArray{
		pulumi.Int(0),
	},
	Departments: pulumi.IntArray{
		pulumi.Int(0),
	},
	Description: pulumi.String("string"),
	DestAddresses: pulumi.StringArray{
		pulumi.String("string"),
	},
	DestCountries: pulumi.StringArray{
		pulumi.String("string"),
	},
	Action: pulumi.String("string"),
	DestIpGroups: pulumi.IntArray{
		pulumi.Int(0),
	},
	DeviceGroups: pulumi.IntArray{
		pulumi.Int(0),
	},
	DeviceTrustLevels: pulumi.StringArray{
		pulumi.String("string"),
	},
	Devices: pulumi.IntArray{
		pulumi.Int(0),
	},
	EnableFullLogging:   pulumi.Bool(false),
	ExcludeSrcCountries: pulumi.Bool(false),
	Groups: pulumi.IntArray{
		pulumi.Int(0),
	},
	Labels: pulumi.IntArray{
		pulumi.Int(0),
	},
	LocationGroups: pulumi.IntArray{
		pulumi.Int(0),
	},
	DefaultRule: pulumi.Bool(false),
	NwApplicationGroups: pulumi.IntArray{
		pulumi.Int(0),
	},
	Locations: pulumi.IntArray{
		pulumi.Int(0),
	},
	NwApplications: pulumi.StringArray{
		pulumi.String("string"),
	},
	NwServiceGroups: pulumi.IntArray{
		pulumi.Int(0),
	},
	NwServices: pulumi.IntArray{
		pulumi.Int(0),
	},
	AppServiceGroups: pulumi.IntArray{
		pulumi.Int(0),
	},
	Predefined: pulumi.Bool(false),
	Rank:       pulumi.Int(0),
	SourceCountries: pulumi.StringArray{
		pulumi.String("string"),
	},
	SrcIpGroups: pulumi.IntArray{
		pulumi.Int(0),
	},
	SrcIps: pulumi.StringArray{
		pulumi.String("string"),
	},
	State: pulumi.String("string"),
	TimeWindows: pulumi.IntArray{
		pulumi.Int(0),
	},
	Users: pulumi.IntArray{
		pulumi.Int(0),
	},
	WorkloadGroups: pulumizia.WorkloadGroupInputTypeArray{
		&pulumizia.WorkloadGroupInputTypeArgs{
			ResourceId: pulumi.Int(0),
			Name:       pulumi.String("string"),
		},
	},
	ZpaAppSegments: pulumizia.ZPAAppSegmentInputArray{
		&pulumizia.ZPAAppSegmentInputArgs{
			ExternalId: pulumi.String("string"),
			Name:       pulumi.String("string"),
		},
	},
})

    var firewallFilteringRuleResource = new FirewallFilteringRule("firewallFilteringRuleResource", FirewallFilteringRuleArgs.builder()
    .name("string")
    .order(0)
    .destIpCategories("string")
    .appServices(0)
    .departments(0)
    .description("string")
    .destAddresses("string")
    .destCountries("string")
    .action("string")
    .destIpGroups(0)
    .deviceGroups(0)
    .deviceTrustLevels("string")
    .devices(0)
    .enableFullLogging(false)
    .excludeSrcCountries(false)
    .groups(0)
    .labels(0)
    .locationGroups(0)
    .defaultRule(false)
    .nwApplicationGroups(0)
    .locations(0)
    .nwApplications("string")
    .nwServiceGroups(0)
    .nwServices(0)
    .appServiceGroups(0)
    .predefined(false)
    .rank(0)
    .sourceCountries("string")
    .srcIpGroups(0)
    .srcIps("string")
    .state("string")
    .timeWindows(0)
    .users(0)
    .workloadGroups(WorkloadGroupInputArgs.builder()
        .resourceId(0)
        .name("string")
        .build())
    .zpaAppSegments(ZPAAppSegmentInputArgs.builder()
        .externalId("string")
        .name("string")
        .build())
    .build());

    firewall_filtering_rule_resource = zia.FirewallFilteringRule("firewallFilteringRuleResource",
    name="string",
    order=0,
    dest_ip_categories=["string"],
    app_services=[0],
    departments=[0],
    description="string",
    dest_addresses=["string"],
    dest_countries=["string"],
    action="string",
    dest_ip_groups=[0],
    device_groups=[0],
    device_trust_levels=["string"],
    devices=[0],
    enable_full_logging=False,
    exclude_src_countries=False,
    groups=[0],
    labels=[0],
    location_groups=[0],
    default_rule=False,
    nw_application_groups=[0],
    locations=[0],
    nw_applications=["string"],
    nw_service_groups=[0],
    nw_services=[0],
    app_service_groups=[0],
    predefined=False,
    rank=0,
    source_countries=["string"],
    src_ip_groups=[0],
    src_ips=["string"],
    state="string",
    time_windows=[0],
    users=[0],
    workload_groups=[{
        "resource_id": 0,
        "name": "string",
    }],
    zpa_app_segments=[{
        "external_id": "string",
        "name": "string",
    }])

    const firewallFilteringRuleResource = new zia.FirewallFilteringRule("firewallFilteringRuleResource", {
    name: "string",
    order: 0,
    destIpCategories: ["string"],
    appServices: [0],
    departments: [0],
    description: "string",
    destAddresses: ["string"],
    destCountries: ["string"],
    action: "string",
    destIpGroups: [0],
    deviceGroups: [0],
    deviceTrustLevels: ["string"],
    devices: [0],
    enableFullLogging: false,
    excludeSrcCountries: false,
    groups: [0],
    labels: [0],
    locationGroups: [0],
    defaultRule: false,
    nwApplicationGroups: [0],
    locations: [0],
    nwApplications: ["string"],
    nwServiceGroups: [0],
    nwServices: [0],
    appServiceGroups: [0],
    predefined: false,
    rank: 0,
    sourceCountries: ["string"],
    srcIpGroups: [0],
    srcIps: ["string"],
    state: "string",
    timeWindows: [0],
    users: [0],
    workloadGroups: [{
        resourceId: 0,
        name: "string",
    }],
    zpaAppSegments: [{
        externalId: "string",
        name: "string",
    }],
});

    type: zia:FirewallFilteringRule
properties:
    action: string
    appServiceGroups:
        - 0
    appServices:
        - 0
    defaultRule: false
    departments:
        - 0
    description: string
    destAddresses:
        - string
    destCountries:
        - string
    destIpCategories:
        - string
    destIpGroups:
        - 0
    deviceGroups:
        - 0
    deviceTrustLevels:
        - string
    devices:
        - 0
    enableFullLogging: false
    excludeSrcCountries: false
    groups:
        - 0
    labels:
        - 0
    locationGroups:
        - 0
    locations:
        - 0
    name: string
    nwApplicationGroups:
        - 0
    nwApplications:
        - string
    nwServiceGroups:
        - 0
    nwServices:
        - 0
    order: 0
    predefined: false
    rank: 0
    sourceCountries:
        - string
    srcIpGroups:
        - 0
    srcIps:
        - string
    state: string
    timeWindows:
        - 0
    users:
        - 0
    workloadGroups:
        - name: string
          resourceId: 0
    zpaAppSegments:
        - externalId: string
          name: string

    FirewallFilteringRule Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The FirewallFilteringRule resource accepts the following input properties:

    Name string
    The name of the firewall filtering rule. Must be unique.
    Order int
    The order of execution of the rule with respect to other firewall filtering rules.
    Action string
    The action the rule takes when traffic matches. Valid values: ALLOW, BLOCK_DROP, BLOCK_RESET, BLOCK_ICMP, EVAL_NWAPP.
    AppServiceGroups List<int>
    IDs of application service groups to which the rule applies.
    AppServices List<int>
    IDs of application services to which the rule applies.
    DefaultRule bool
    Indicates whether this is the default firewall filtering rule.
    Departments List<int>
    IDs of departments to which the rule must be applied.
    Description string
    Additional information about the firewall filtering rule.
    DestAddresses List<string>
    Destination IP addresses, FQDNs, or wildcard FQDNs for the rule.
    DestCountries List<string>
    Destination countries (ISO 3166-1 alpha-2 codes) for the rule.
    DestIpCategories List<string>
    Destination IP address URL categories. Allows you to identify destinations based on the URL category of the domain.
    DestIpGroups List<int>
    IDs of destination IP address groups for the rule.
    DeviceGroups List<int>
    IDs of device groups for which the rule must be applied. Applicable for devices managed using Zscaler Client Connector.
    DeviceTrustLevels List<string>
    Device trust levels for the rule. Valid values: ANY, UNKNOWN_DEVICETRUSTLEVEL, LOW_TRUST, MEDIUM_TRUST, HIGH_TRUST.
    Devices List<int>
    IDs of devices for which the rule must be applied.
    EnableFullLogging bool
    If set to true, enables full logging for the rule.
    ExcludeSrcCountries bool
    If set to true, the countries specified in sourceCountries are excluded from the rule.
    Groups List<int>
    IDs of groups to which the rule must be applied.
    Labels List<int>
    IDs of labels associated with the rule.
    LocationGroups List<int>
    IDs of location groups to which the rule must be applied.
    Locations List<int>
    IDs of locations to which the rule must be applied.
    NwApplicationGroups List<int>
    IDs of network application groups to which the rule applies.
    NwApplications List<string>
    Network application values to which the rule applies (e.g., APNS, DNS, HTTP).
    NwServiceGroups List<int>
    IDs of network service groups to which the rule applies.
    NwServices List<int>
    IDs of network services to which the rule applies.
    Predefined bool
    Indicates whether this is a predefined rule.
    Rank int
    Admin rank of the firewall filtering policy rule. Valid values: 0-7. Default: 7.
    SourceCountries List<string>
    Source countries (ISO 3166-1 alpha-2 codes) for the rule.
    SrcIpGroups List<int>
    IDs of source IP address groups for the rule.
    SrcIps List<string>
    Source IP addresses or CIDR ranges for the rule.
    State string
    Rule state. Valid values: ENABLED, DISABLED.
    TimeWindows List<int>
    IDs of time intervals during which the rule must be enforced.
    Users List<int>
    IDs of users to which the rule must be applied.
    WorkloadGroups List<zscaler.PulumiPackage.Zia.Inputs.WorkloadGroupInput>
    List of preconfigured workload groups to which the policy must be applied.
    ZpaAppSegments List<zscaler.PulumiPackage.Zia.Inputs.ZPAAppSegmentInput>
    List of ZPA application segments for which this rule is applicable. This field is applicable only for the ZPA gateway forwarding method.
    Name string
    The name of the firewall filtering rule. Must be unique.
    Order int
    The order of execution of the rule with respect to other firewall filtering rules.
    Action string
    The action the rule takes when traffic matches. Valid values: ALLOW, BLOCK_DROP, BLOCK_RESET, BLOCK_ICMP, EVAL_NWAPP.
    AppServiceGroups []int
    IDs of application service groups to which the rule applies.
    AppServices []int
    IDs of application services to which the rule applies.
    DefaultRule bool
    Indicates whether this is the default firewall filtering rule.
    Departments []int
    IDs of departments to which the rule must be applied.
    Description string
    Additional information about the firewall filtering rule.
    DestAddresses []string
    Destination IP addresses, FQDNs, or wildcard FQDNs for the rule.
    DestCountries []string
    Destination countries (ISO 3166-1 alpha-2 codes) for the rule.
    DestIpCategories []string
    Destination IP address URL categories. Allows you to identify destinations based on the URL category of the domain.
    DestIpGroups []int
    IDs of destination IP address groups for the rule.
    DeviceGroups []int
    IDs of device groups for which the rule must be applied. Applicable for devices managed using Zscaler Client Connector.
    DeviceTrustLevels []string
    Device trust levels for the rule. Valid values: ANY, UNKNOWN_DEVICETRUSTLEVEL, LOW_TRUST, MEDIUM_TRUST, HIGH_TRUST.
    Devices []int
    IDs of devices for which the rule must be applied.
    EnableFullLogging bool
    If set to true, enables full logging for the rule.
    ExcludeSrcCountries bool
    If set to true, the countries specified in sourceCountries are excluded from the rule.
    Groups []int
    IDs of groups to which the rule must be applied.
    Labels []int
    IDs of labels associated with the rule.
    LocationGroups []int
    IDs of location groups to which the rule must be applied.
    Locations []int
    IDs of locations to which the rule must be applied.
    NwApplicationGroups []int
    IDs of network application groups to which the rule applies.
    NwApplications []string
    Network application values to which the rule applies (e.g., APNS, DNS, HTTP).
    NwServiceGroups []int
    IDs of network service groups to which the rule applies.
    NwServices []int
    IDs of network services to which the rule applies.
    Predefined bool
    Indicates whether this is a predefined rule.
    Rank int
    Admin rank of the firewall filtering policy rule. Valid values: 0-7. Default: 7.
    SourceCountries []string
    Source countries (ISO 3166-1 alpha-2 codes) for the rule.
    SrcIpGroups []int
    IDs of source IP address groups for the rule.
    SrcIps []string
    Source IP addresses or CIDR ranges for the rule.
    State string
    Rule state. Valid values: ENABLED, DISABLED.
    TimeWindows []int
    IDs of time intervals during which the rule must be enforced.
    Users []int
    IDs of users to which the rule must be applied.
    WorkloadGroups []WorkloadGroupInputTypeArgs
    List of preconfigured workload groups to which the policy must be applied.
    ZpaAppSegments []ZPAAppSegmentInputArgs
    List of ZPA application segments for which this rule is applicable. This field is applicable only for the ZPA gateway forwarding method.
    name String
    The name of the firewall filtering rule. Must be unique.
    order Integer
    The order of execution of the rule with respect to other firewall filtering rules.
    action String
    The action the rule takes when traffic matches. Valid values: ALLOW, BLOCK_DROP, BLOCK_RESET, BLOCK_ICMP, EVAL_NWAPP.
    appServiceGroups List<Integer>
    IDs of application service groups to which the rule applies.
    appServices List<Integer>
    IDs of application services to which the rule applies.
    defaultRule Boolean
    Indicates whether this is the default firewall filtering rule.
    departments List<Integer>
    IDs of departments to which the rule must be applied.
    description String
    Additional information about the firewall filtering rule.
    destAddresses List<String>
    Destination IP addresses, FQDNs, or wildcard FQDNs for the rule.
    destCountries List<String>
    Destination countries (ISO 3166-1 alpha-2 codes) for the rule.
    destIpCategories List<String>
    Destination IP address URL categories. Allows you to identify destinations based on the URL category of the domain.
    destIpGroups List<Integer>
    IDs of destination IP address groups for the rule.
    deviceGroups List<Integer>
    IDs of device groups for which the rule must be applied. Applicable for devices managed using Zscaler Client Connector.
    deviceTrustLevels List<String>
    Device trust levels for the rule. Valid values: ANY, UNKNOWN_DEVICETRUSTLEVEL, LOW_TRUST, MEDIUM_TRUST, HIGH_TRUST.
    devices List<Integer>
    IDs of devices for which the rule must be applied.
    enableFullLogging Boolean
    If set to true, enables full logging for the rule.
    excludeSrcCountries Boolean
    If set to true, the countries specified in sourceCountries are excluded from the rule.
    groups List<Integer>
    IDs of groups to which the rule must be applied.
    labels List<Integer>
    IDs of labels associated with the rule.
    locationGroups List<Integer>
    IDs of location groups to which the rule must be applied.
    locations List<Integer>
    IDs of locations to which the rule must be applied.
    nwApplicationGroups List<Integer>
    IDs of network application groups to which the rule applies.
    nwApplications List<String>
    Network application values to which the rule applies (e.g., APNS, DNS, HTTP).
    nwServiceGroups List<Integer>
    IDs of network service groups to which the rule applies.
    nwServices List<Integer>
    IDs of network services to which the rule applies.
    predefined Boolean
    Indicates whether this is a predefined rule.
    rank Integer
    Admin rank of the firewall filtering policy rule. Valid values: 0-7. Default: 7.
    sourceCountries List<String>
    Source countries (ISO 3166-1 alpha-2 codes) for the rule.
    srcIpGroups List<Integer>
    IDs of source IP address groups for the rule.
    srcIps List<String>
    Source IP addresses or CIDR ranges for the rule.
    state String
    Rule state. Valid values: ENABLED, DISABLED.
    timeWindows List<Integer>
    IDs of time intervals during which the rule must be enforced.
    users List<Integer>
    IDs of users to which the rule must be applied.
    workloadGroups List<WorkloadGroupInput>
    List of preconfigured workload groups to which the policy must be applied.
    zpaAppSegments List<ZPAAppSegmentInput>
    List of ZPA application segments for which this rule is applicable. This field is applicable only for the ZPA gateway forwarding method.
    name string
    The name of the firewall filtering rule. Must be unique.
    order number
    The order of execution of the rule with respect to other firewall filtering rules.
    action string
    The action the rule takes when traffic matches. Valid values: ALLOW, BLOCK_DROP, BLOCK_RESET, BLOCK_ICMP, EVAL_NWAPP.
    appServiceGroups number[]
    IDs of application service groups to which the rule applies.
    appServices number[]
    IDs of application services to which the rule applies.
    defaultRule boolean
    Indicates whether this is the default firewall filtering rule.
    departments number[]
    IDs of departments to which the rule must be applied.
    description string
    Additional information about the firewall filtering rule.
    destAddresses string[]
    Destination IP addresses, FQDNs, or wildcard FQDNs for the rule.
    destCountries string[]
    Destination countries (ISO 3166-1 alpha-2 codes) for the rule.
    destIpCategories string[]
    Destination IP address URL categories. Allows you to identify destinations based on the URL category of the domain.
    destIpGroups number[]
    IDs of destination IP address groups for the rule.
    deviceGroups number[]
    IDs of device groups for which the rule must be applied. Applicable for devices managed using Zscaler Client Connector.
    deviceTrustLevels string[]
    Device trust levels for the rule. Valid values: ANY, UNKNOWN_DEVICETRUSTLEVEL, LOW_TRUST, MEDIUM_TRUST, HIGH_TRUST.
    devices number[]
    IDs of devices for which the rule must be applied.
    enableFullLogging boolean
    If set to true, enables full logging for the rule.
    excludeSrcCountries boolean
    If set to true, the countries specified in sourceCountries are excluded from the rule.
    groups number[]
    IDs of groups to which the rule must be applied.
    labels number[]
    IDs of labels associated with the rule.
    locationGroups number[]
    IDs of location groups to which the rule must be applied.
    locations number[]
    IDs of locations to which the rule must be applied.
    nwApplicationGroups number[]
    IDs of network application groups to which the rule applies.
    nwApplications string[]
    Network application values to which the rule applies (e.g., APNS, DNS, HTTP).
    nwServiceGroups number[]
    IDs of network service groups to which the rule applies.
    nwServices number[]
    IDs of network services to which the rule applies.
    predefined boolean
    Indicates whether this is a predefined rule.
    rank number
    Admin rank of the firewall filtering policy rule. Valid values: 0-7. Default: 7.
    sourceCountries string[]
    Source countries (ISO 3166-1 alpha-2 codes) for the rule.
    srcIpGroups number[]
    IDs of source IP address groups for the rule.
    srcIps string[]
    Source IP addresses or CIDR ranges for the rule.
    state string
    Rule state. Valid values: ENABLED, DISABLED.
    timeWindows number[]
    IDs of time intervals during which the rule must be enforced.
    users number[]
    IDs of users to which the rule must be applied.
    workloadGroups WorkloadGroupInput[]
    List of preconfigured workload groups to which the policy must be applied.
    zpaAppSegments ZPAAppSegmentInput[]
    List of ZPA application segments for which this rule is applicable. This field is applicable only for the ZPA gateway forwarding method.
    name str
    The name of the firewall filtering rule. Must be unique.
    order int
    The order of execution of the rule with respect to other firewall filtering rules.
    action str
    The action the rule takes when traffic matches. Valid values: ALLOW, BLOCK_DROP, BLOCK_RESET, BLOCK_ICMP, EVAL_NWAPP.
    app_service_groups Sequence[int]
    IDs of application service groups to which the rule applies.
    app_services Sequence[int]
    IDs of application services to which the rule applies.
    default_rule bool
    Indicates whether this is the default firewall filtering rule.
    departments Sequence[int]
    IDs of departments to which the rule must be applied.
    description str
    Additional information about the firewall filtering rule.
    dest_addresses Sequence[str]
    Destination IP addresses, FQDNs, or wildcard FQDNs for the rule.
    dest_countries Sequence[str]
    Destination countries (ISO 3166-1 alpha-2 codes) for the rule.
    dest_ip_categories Sequence[str]
    Destination IP address URL categories. Allows you to identify destinations based on the URL category of the domain.
    dest_ip_groups Sequence[int]
    IDs of destination IP address groups for the rule.
    device_groups Sequence[int]
    IDs of device groups for which the rule must be applied. Applicable for devices managed using Zscaler Client Connector.
    device_trust_levels Sequence[str]
    Device trust levels for the rule. Valid values: ANY, UNKNOWN_DEVICETRUSTLEVEL, LOW_TRUST, MEDIUM_TRUST, HIGH_TRUST.
    devices Sequence[int]
    IDs of devices for which the rule must be applied.
    enable_full_logging bool
    If set to true, enables full logging for the rule.
    exclude_src_countries bool
    If set to true, the countries specified in sourceCountries are excluded from the rule.
    groups Sequence[int]
    IDs of groups to which the rule must be applied.
    labels Sequence[int]
    IDs of labels associated with the rule.
    location_groups Sequence[int]
    IDs of location groups to which the rule must be applied.
    locations Sequence[int]
    IDs of locations to which the rule must be applied.
    nw_application_groups Sequence[int]
    IDs of network application groups to which the rule applies.
    nw_applications Sequence[str]
    Network application values to which the rule applies (e.g., APNS, DNS, HTTP).
    nw_service_groups Sequence[int]
    IDs of network service groups to which the rule applies.
    nw_services Sequence[int]
    IDs of network services to which the rule applies.
    predefined bool
    Indicates whether this is a predefined rule.
    rank int
    Admin rank of the firewall filtering policy rule. Valid values: 0-7. Default: 7.
    source_countries Sequence[str]
    Source countries (ISO 3166-1 alpha-2 codes) for the rule.
    src_ip_groups Sequence[int]
    IDs of source IP address groups for the rule.
    src_ips Sequence[str]
    Source IP addresses or CIDR ranges for the rule.
    state str
    Rule state. Valid values: ENABLED, DISABLED.
    time_windows Sequence[int]
    IDs of time intervals during which the rule must be enforced.
    users Sequence[int]
    IDs of users to which the rule must be applied.
    workload_groups Sequence[WorkloadGroupInputArgs]
    List of preconfigured workload groups to which the policy must be applied.
    zpa_app_segments Sequence[ZPAAppSegmentInputArgs]
    List of ZPA application segments for which this rule is applicable. This field is applicable only for the ZPA gateway forwarding method.
    name String
    The name of the firewall filtering rule. Must be unique.
    order Number
    The order of execution of the rule with respect to other firewall filtering rules.
    action String
    The action the rule takes when traffic matches. Valid values: ALLOW, BLOCK_DROP, BLOCK_RESET, BLOCK_ICMP, EVAL_NWAPP.
    appServiceGroups List<Number>
    IDs of application service groups to which the rule applies.
    appServices List<Number>
    IDs of application services to which the rule applies.
    defaultRule Boolean
    Indicates whether this is the default firewall filtering rule.
    departments List<Number>
    IDs of departments to which the rule must be applied.
    description String
    Additional information about the firewall filtering rule.
    destAddresses List<String>
    Destination IP addresses, FQDNs, or wildcard FQDNs for the rule.
    destCountries List<String>
    Destination countries (ISO 3166-1 alpha-2 codes) for the rule.
    destIpCategories List<String>
    Destination IP address URL categories. Allows you to identify destinations based on the URL category of the domain.
    destIpGroups List<Number>
    IDs of destination IP address groups for the rule.
    deviceGroups List<Number>
    IDs of device groups for which the rule must be applied. Applicable for devices managed using Zscaler Client Connector.
    deviceTrustLevels List<String>
    Device trust levels for the rule. Valid values: ANY, UNKNOWN_DEVICETRUSTLEVEL, LOW_TRUST, MEDIUM_TRUST, HIGH_TRUST.
    devices List<Number>
    IDs of devices for which the rule must be applied.
    enableFullLogging Boolean
    If set to true, enables full logging for the rule.
    excludeSrcCountries Boolean
    If set to true, the countries specified in sourceCountries are excluded from the rule.
    groups List<Number>
    IDs of groups to which the rule must be applied.
    labels List<Number>
    IDs of labels associated with the rule.
    locationGroups List<Number>
    IDs of location groups to which the rule must be applied.
    locations List<Number>
    IDs of locations to which the rule must be applied.
    nwApplicationGroups List<Number>
    IDs of network application groups to which the rule applies.
    nwApplications List<String>
    Network application values to which the rule applies (e.g., APNS, DNS, HTTP).
    nwServiceGroups List<Number>
    IDs of network service groups to which the rule applies.
    nwServices List<Number>
    IDs of network services to which the rule applies.
    predefined Boolean
    Indicates whether this is a predefined rule.
    rank Number
    Admin rank of the firewall filtering policy rule. Valid values: 0-7. Default: 7.
    sourceCountries List<String>
    Source countries (ISO 3166-1 alpha-2 codes) for the rule.
    srcIpGroups List<Number>
    IDs of source IP address groups for the rule.
    srcIps List<String>
    Source IP addresses or CIDR ranges for the rule.
    state String
    Rule state. Valid values: ENABLED, DISABLED.
    timeWindows List<Number>
    IDs of time intervals during which the rule must be enforced.
    users List<Number>
    IDs of users to which the rule must be applied.
    workloadGroups List<Property Map>
    List of preconfigured workload groups to which the policy must be applied.
    zpaAppSegments List<Property Map>
    List of ZPA application segments for which this rule is applicable. This field is applicable only for the ZPA gateway forwarding method.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the FirewallFilteringRule resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    RuleId int
    The system-generated ID of the firewall filtering rule.
    Id string
    The provider-assigned unique ID for this managed resource.
    RuleId int
    The system-generated ID of the firewall filtering rule.
    id String
    The provider-assigned unique ID for this managed resource.
    ruleId Integer
    The system-generated ID of the firewall filtering rule.
    id string
    The provider-assigned unique ID for this managed resource.
    ruleId number
    The system-generated ID of the firewall filtering rule.
    id str
    The provider-assigned unique ID for this managed resource.
    rule_id int
    The system-generated ID of the firewall filtering rule.
    id String
    The provider-assigned unique ID for this managed resource.
    ruleId Number
    The system-generated ID of the firewall filtering rule.

    Supporting Types

    WorkloadGroupInput, WorkloadGroupInputArgs

    ResourceId int
    Name string
    ResourceId int
    Name string
    resourceId Integer
    name String
    resourceId number
    name string
    resourceId Number
    name String

    ZPAAppSegmentInput, ZPAAppSegmentInputArgs

    ExternalId string
    Name string
    ExternalId string
    Name string
    externalId String
    name String
    externalId string
    name string
    externalId String
    name String

    Import

    An existing Firewall Filtering Rule can be imported using its resource ID, e.g.

    $ pulumi import zia:index:FirewallFilteringRule example 12345

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    zia zscaler/pulumi-zia
    License
    zia logo
    Viewing docs for pulumi-resource-zia v1.3.8
    published on Friday, Mar 13, 2026 by Zscaler
    Schema (JSON)
    zscaler/pulumi-zia
      Try Pulumi Cloud free. Your team will thank you.