1. Packages
  2. Zscaler Internet Access (ZIA)
  3. API Docs
  4. NatControlRule
Viewing docs for pulumi-resource-zia v1.3.8
published on Friday, Mar 13, 2026 by Zscaler
Schema (JSON)
zscaler/pulumi-zia

zia.NatControlRule

zia logo
Viewing docs for pulumi-resource-zia v1.3.8
published on Friday, Mar 13, 2026 by Zscaler
Schema (JSON)
zscaler/pulumi-zia

    The zia_nat_control_rule resource manages NAT control rules in the Zscaler Internet Access (ZIA) cloud service. NAT control rules allow you to redirect traffic to specific IP addresses or FQDNs and ports based on various criteria such as source, destination, users, and locations.

    For more information, see the ZIA NAT Control documentation.

    Example Usage

    Basic NAT Control Rule

    Example coming soon!

    import (
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
	zia "github.com/zscaler/pulumi-zia/sdk/go/pulumi-zia"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := zia.NewNatControlRule(ctx, "example", &zia.NatControlRuleArgs{
			Name:        pulumi.String("Example NAT Control Rule"),
			Description: pulumi.StringRef("Redirect traffic"),
			Order:       pulumi.Int(1),
			State:       pulumi.StringRef("ENABLED"),
		})
		return err
	})
}

    Example coming soon!

    import * as zia from "@bdzscaler/pulumi-zia";

const example = new zia.NatControlRule("example", {
    name: "Example NAT Control Rule",
    description: "Redirect traffic",
    order: 1,
    state: "ENABLED",
});

    import zscaler_pulumi_zia as zia

example = zia.NatControlRule("example",
    name="Example NAT Control Rule",
    description="Redirect traffic",
    order=1,
    state="ENABLED",
)

    resources:
  example:
    type: zia:NatControlRule
    properties:
      name: Example NAT Control Rule
      description: Redirect traffic
      order: 1
      state: ENABLED

    Create NatControlRule Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new NatControlRule(name: string, args: NatControlRuleArgs, opts?: CustomResourceOptions);
    @overload
def NatControlRule(resource_name: str,
                   args: NatControlRuleArgs,
                   opts: Optional[ResourceOptions] = None)

@overload
def NatControlRule(resource_name: str,
                   opts: Optional[ResourceOptions] = None,
                   name: Optional[str] = None,
                   order: Optional[int] = None,
                   locations: Optional[Sequence[int]] = None,
                   redirect_fqdn: Optional[str] = None,
                   dest_countries: Optional[Sequence[str]] = None,
                   dest_ip_categories: Optional[Sequence[str]] = None,
                   dest_ip_groups: Optional[Sequence[int]] = None,
                   dest_ipv6_groups: Optional[Sequence[int]] = None,
                   device_groups: Optional[Sequence[int]] = None,
                   devices: Optional[Sequence[int]] = None,
                   enable_full_logging: Optional[bool] = None,
                   groups: Optional[Sequence[int]] = None,
                   labels: Optional[Sequence[int]] = None,
                   location_groups: Optional[Sequence[int]] = None,
                   default_rule: Optional[bool] = None,
                   description: Optional[str] = None,
                   dest_addresses: Optional[Sequence[str]] = None,
                   departments: Optional[Sequence[int]] = None,
                   nw_service_groups: Optional[Sequence[int]] = None,
                   predefined: Optional[bool] = None,
                   rank: Optional[int] = None,
                   nw_services: Optional[Sequence[int]] = None,
                   redirect_ip: Optional[str] = None,
                   redirect_port: Optional[int] = None,
                   res_categories: Optional[Sequence[str]] = None,
                   src_ip_groups: Optional[Sequence[int]] = None,
                   src_ips: Optional[Sequence[str]] = None,
                   src_ipv6_groups: Optional[Sequence[int]] = None,
                   state: Optional[str] = None,
                   time_windows: Optional[Sequence[int]] = None,
                   users: Optional[Sequence[int]] = None)
    func NewNatControlRule(ctx *Context, name string, args NatControlRuleArgs, opts ...ResourceOption) (*NatControlRule, error)
    public NatControlRule(string name, NatControlRuleArgs args, CustomResourceOptions? opts = null)
    public NatControlRule(String name, NatControlRuleArgs args)
public NatControlRule(String name, NatControlRuleArgs args, CustomResourceOptions options)

    type: zia:NatControlRule
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

    Parameters

    name string
    The unique name of the resource.
    args NatControlRuleArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args NatControlRuleArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args NatControlRuleArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args NatControlRuleArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args NatControlRuleArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var natControlRuleResource = new Zia.NatControlRule("natControlRuleResource", new()
{
    Name = "string",
    Order = 0,
    Locations = new[]
    {
        0,
    },
    RedirectFqdn = "string",
    DestCountries = new[]
    {
        "string",
    },
    DestIpCategories = new[]
    {
        "string",
    },
    DestIpGroups = new[]
    {
        0,
    },
    DestIpv6Groups = new[]
    {
        0,
    },
    DeviceGroups = new[]
    {
        0,
    },
    Devices = new[]
    {
        0,
    },
    EnableFullLogging = false,
    Groups = new[]
    {
        0,
    },
    Labels = new[]
    {
        0,
    },
    LocationGroups = new[]
    {
        0,
    },
    DefaultRule = false,
    Description = "string",
    DestAddresses = new[]
    {
        "string",
    },
    Departments = new[]
    {
        0,
    },
    NwServiceGroups = new[]
    {
        0,
    },
    Predefined = false,
    Rank = 0,
    NwServices = new[]
    {
        0,
    },
    RedirectIp = "string",
    RedirectPort = 0,
    ResCategories = new[]
    {
        "string",
    },
    SrcIpGroups = new[]
    {
        0,
    },
    SrcIps = new[]
    {
        "string",
    },
    SrcIpv6Groups = new[]
    {
        0,
    },
    State = "string",
    TimeWindows = new[]
    {
        0,
    },
    Users = new[]
    {
        0,
    },
});

    example, err := zia.NewNatControlRule(ctx, "natControlRuleResource", &zia.NatControlRuleArgs{
	Name:  pulumi.String("string"),
	Order: pulumi.Int(0),
	Locations: pulumi.IntArray{
		pulumi.Int(0),
	},
	RedirectFqdn: pulumi.String("string"),
	DestCountries: pulumi.StringArray{
		pulumi.String("string"),
	},
	DestIpCategories: pulumi.StringArray{
		pulumi.String("string"),
	},
	DestIpGroups: pulumi.IntArray{
		pulumi.Int(0),
	},
	DestIpv6Groups: pulumi.IntArray{
		pulumi.Int(0),
	},
	DeviceGroups: pulumi.IntArray{
		pulumi.Int(0),
	},
	Devices: pulumi.IntArray{
		pulumi.Int(0),
	},
	EnableFullLogging: pulumi.Bool(false),
	Groups: pulumi.IntArray{
		pulumi.Int(0),
	},
	Labels: pulumi.IntArray{
		pulumi.Int(0),
	},
	LocationGroups: pulumi.IntArray{
		pulumi.Int(0),
	},
	DefaultRule: pulumi.Bool(false),
	Description: pulumi.String("string"),
	DestAddresses: pulumi.StringArray{
		pulumi.String("string"),
	},
	Departments: pulumi.IntArray{
		pulumi.Int(0),
	},
	NwServiceGroups: pulumi.IntArray{
		pulumi.Int(0),
	},
	Predefined: pulumi.Bool(false),
	Rank:       pulumi.Int(0),
	NwServices: pulumi.IntArray{
		pulumi.Int(0),
	},
	RedirectIp:   pulumi.String("string"),
	RedirectPort: pulumi.Int(0),
	ResCategories: pulumi.StringArray{
		pulumi.String("string"),
	},
	SrcIpGroups: pulumi.IntArray{
		pulumi.Int(0),
	},
	SrcIps: pulumi.StringArray{
		pulumi.String("string"),
	},
	SrcIpv6Groups: pulumi.IntArray{
		pulumi.Int(0),
	},
	State: pulumi.String("string"),
	TimeWindows: pulumi.IntArray{
		pulumi.Int(0),
	},
	Users: pulumi.IntArray{
		pulumi.Int(0),
	},
})

    var natControlRuleResource = new NatControlRule("natControlRuleResource", NatControlRuleArgs.builder()
    .name("string")
    .order(0)
    .locations(0)
    .redirectFqdn("string")
    .destCountries("string")
    .destIpCategories("string")
    .destIpGroups(0)
    .destIpv6Groups(0)
    .deviceGroups(0)
    .devices(0)
    .enableFullLogging(false)
    .groups(0)
    .labels(0)
    .locationGroups(0)
    .defaultRule(false)
    .description("string")
    .destAddresses("string")
    .departments(0)
    .nwServiceGroups(0)
    .predefined(false)
    .rank(0)
    .nwServices(0)
    .redirectIp("string")
    .redirectPort(0)
    .resCategories("string")
    .srcIpGroups(0)
    .srcIps("string")
    .srcIpv6Groups(0)
    .state("string")
    .timeWindows(0)
    .users(0)
    .build());

    nat_control_rule_resource = zia.NatControlRule("natControlRuleResource",
    name="string",
    order=0,
    locations=[0],
    redirect_fqdn="string",
    dest_countries=["string"],
    dest_ip_categories=["string"],
    dest_ip_groups=[0],
    dest_ipv6_groups=[0],
    device_groups=[0],
    devices=[0],
    enable_full_logging=False,
    groups=[0],
    labels=[0],
    location_groups=[0],
    default_rule=False,
    description="string",
    dest_addresses=["string"],
    departments=[0],
    nw_service_groups=[0],
    predefined=False,
    rank=0,
    nw_services=[0],
    redirect_ip="string",
    redirect_port=0,
    res_categories=["string"],
    src_ip_groups=[0],
    src_ips=["string"],
    src_ipv6_groups=[0],
    state="string",
    time_windows=[0],
    users=[0])

    const natControlRuleResource = new zia.NatControlRule("natControlRuleResource", {
    name: "string",
    order: 0,
    locations: [0],
    redirectFqdn: "string",
    destCountries: ["string"],
    destIpCategories: ["string"],
    destIpGroups: [0],
    destIpv6Groups: [0],
    deviceGroups: [0],
    devices: [0],
    enableFullLogging: false,
    groups: [0],
    labels: [0],
    locationGroups: [0],
    defaultRule: false,
    description: "string",
    destAddresses: ["string"],
    departments: [0],
    nwServiceGroups: [0],
    predefined: false,
    rank: 0,
    nwServices: [0],
    redirectIp: "string",
    redirectPort: 0,
    resCategories: ["string"],
    srcIpGroups: [0],
    srcIps: ["string"],
    srcIpv6Groups: [0],
    state: "string",
    timeWindows: [0],
    users: [0],
});

    type: zia:NatControlRule
properties:
    defaultRule: false
    departments:
        - 0
    description: string
    destAddresses:
        - string
    destCountries:
        - string
    destIpCategories:
        - string
    destIpGroups:
        - 0
    destIpv6Groups:
        - 0
    deviceGroups:
        - 0
    devices:
        - 0
    enableFullLogging: false
    groups:
        - 0
    labels:
        - 0
    locationGroups:
        - 0
    locations:
        - 0
    name: string
    nwServiceGroups:
        - 0
    nwServices:
        - 0
    order: 0
    predefined: false
    rank: 0
    redirectFqdn: string
    redirectIp: string
    redirectPort: 0
    resCategories:
        - string
    srcIpGroups:
        - 0
    srcIps:
        - string
    srcIpv6Groups:
        - 0
    state: string
    timeWindows:
        - 0
    users:
        - 0

    NatControlRule Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The NatControlRule resource accepts the following input properties:

    Name string
    The name of the NAT control rule. Must be unique.
    Order int
    The order of execution of the rule with respect to other NAT control rules.
    DefaultRule bool
    Indicates whether this is the default NAT control rule.
    Departments List<int>
    IDs of departments to which the rule must be applied.
    Description string
    Additional information about the NAT control rule.
    DestAddresses List<string>
    Destination IP addresses, FQDNs, or wildcard FQDNs for the rule.
    DestCountries List<string>
    Destination countries (ISO 3166-1 alpha-2 codes) for the rule.
    DestIpCategories List<string>
    Destination IP address URL categories for the rule.
    DestIpGroups List<int>
    IDs of destination IP address groups for the rule.
    DestIpv6Groups List<int>
    IDs of destination IPv6 address groups for the rule.
    DeviceGroups List<int>
    IDs of device groups for which the rule must be applied. Applicable for devices managed using Zscaler Client Connector.
    Devices List<int>
    IDs of devices for which the rule must be applied.
    EnableFullLogging bool
    If set to true, enables full logging for the rule.
    Groups List<int>
    IDs of groups to which the rule must be applied.
    Labels List<int>
    IDs of labels associated with the rule.
    LocationGroups List<int>
    IDs of location groups to which the rule must be applied.
    Locations List<int>
    IDs of locations to which the rule must be applied.
    NwServiceGroups List<int>
    IDs of network service groups to which the rule applies.
    NwServices List<int>
    IDs of network services to which the rule applies.
    Predefined bool
    Indicates whether this is a predefined rule.
    Rank int
    Admin rank of the NAT control policy rule. Valid values: 0-7. Default: 7.
    RedirectFqdn string
    The FQDN to which traffic should be redirected.
    RedirectIp string
    The IP address to which traffic should be redirected.
    RedirectPort int
    The port to which traffic should be redirected.
    ResCategories List<string>
    URL categories that apply to the response for the rule.
    SrcIpGroups List<int>
    IDs of source IP address groups for the rule.
    SrcIps List<string>
    Source IP addresses or CIDR ranges for the rule.
    SrcIpv6Groups List<int>
    IDs of source IPv6 address groups for the rule.
    State string
    Rule state. Valid values: ENABLED, DISABLED.
    TimeWindows List<int>
    IDs of time intervals during which the rule must be enforced.
    Users List<int>
    IDs of users to which the rule must be applied.
    Name string
    The name of the NAT control rule. Must be unique.
    Order int
    The order of execution of the rule with respect to other NAT control rules.
    DefaultRule bool
    Indicates whether this is the default NAT control rule.
    Departments []int
    IDs of departments to which the rule must be applied.
    Description string
    Additional information about the NAT control rule.
    DestAddresses []string
    Destination IP addresses, FQDNs, or wildcard FQDNs for the rule.
    DestCountries []string
    Destination countries (ISO 3166-1 alpha-2 codes) for the rule.
    DestIpCategories []string
    Destination IP address URL categories for the rule.
    DestIpGroups []int
    IDs of destination IP address groups for the rule.
    DestIpv6Groups []int
    IDs of destination IPv6 address groups for the rule.
    DeviceGroups []int
    IDs of device groups for which the rule must be applied. Applicable for devices managed using Zscaler Client Connector.
    Devices []int
    IDs of devices for which the rule must be applied.
    EnableFullLogging bool
    If set to true, enables full logging for the rule.
    Groups []int
    IDs of groups to which the rule must be applied.
    Labels []int
    IDs of labels associated with the rule.
    LocationGroups []int
    IDs of location groups to which the rule must be applied.
    Locations []int
    IDs of locations to which the rule must be applied.
    NwServiceGroups []int
    IDs of network service groups to which the rule applies.
    NwServices []int
    IDs of network services to which the rule applies.
    Predefined bool
    Indicates whether this is a predefined rule.
    Rank int
    Admin rank of the NAT control policy rule. Valid values: 0-7. Default: 7.
    RedirectFqdn string
    The FQDN to which traffic should be redirected.
    RedirectIp string
    The IP address to which traffic should be redirected.
    RedirectPort int
    The port to which traffic should be redirected.
    ResCategories []string
    URL categories that apply to the response for the rule.
    SrcIpGroups []int
    IDs of source IP address groups for the rule.
    SrcIps []string
    Source IP addresses or CIDR ranges for the rule.
    SrcIpv6Groups []int
    IDs of source IPv6 address groups for the rule.
    State string
    Rule state. Valid values: ENABLED, DISABLED.
    TimeWindows []int
    IDs of time intervals during which the rule must be enforced.
    Users []int
    IDs of users to which the rule must be applied.
    name String
    The name of the NAT control rule. Must be unique.
    order Integer
    The order of execution of the rule with respect to other NAT control rules.
    defaultRule Boolean
    Indicates whether this is the default NAT control rule.
    departments List<Integer>
    IDs of departments to which the rule must be applied.
    description String
    Additional information about the NAT control rule.
    destAddresses List<String>
    Destination IP addresses, FQDNs, or wildcard FQDNs for the rule.
    destCountries List<String>
    Destination countries (ISO 3166-1 alpha-2 codes) for the rule.
    destIpCategories List<String>
    Destination IP address URL categories for the rule.
    destIpGroups List<Integer>
    IDs of destination IP address groups for the rule.
    destIpv6Groups List<Integer>
    IDs of destination IPv6 address groups for the rule.
    deviceGroups List<Integer>
    IDs of device groups for which the rule must be applied. Applicable for devices managed using Zscaler Client Connector.
    devices List<Integer>
    IDs of devices for which the rule must be applied.
    enableFullLogging Boolean
    If set to true, enables full logging for the rule.
    groups List<Integer>
    IDs of groups to which the rule must be applied.
    labels List<Integer>
    IDs of labels associated with the rule.
    locationGroups List<Integer>
    IDs of location groups to which the rule must be applied.
    locations List<Integer>
    IDs of locations to which the rule must be applied.
    nwServiceGroups List<Integer>
    IDs of network service groups to which the rule applies.
    nwServices List<Integer>
    IDs of network services to which the rule applies.
    predefined Boolean
    Indicates whether this is a predefined rule.
    rank Integer
    Admin rank of the NAT control policy rule. Valid values: 0-7. Default: 7.
    redirectFqdn String
    The FQDN to which traffic should be redirected.
    redirectIp String
    The IP address to which traffic should be redirected.
    redirectPort Integer
    The port to which traffic should be redirected.
    resCategories List<String>
    URL categories that apply to the response for the rule.
    srcIpGroups List<Integer>
    IDs of source IP address groups for the rule.
    srcIps List<String>
    Source IP addresses or CIDR ranges for the rule.
    srcIpv6Groups List<Integer>
    IDs of source IPv6 address groups for the rule.
    state String
    Rule state. Valid values: ENABLED, DISABLED.
    timeWindows List<Integer>
    IDs of time intervals during which the rule must be enforced.
    users List<Integer>
    IDs of users to which the rule must be applied.
    name string
    The name of the NAT control rule. Must be unique.
    order number
    The order of execution of the rule with respect to other NAT control rules.
    defaultRule boolean
    Indicates whether this is the default NAT control rule.
    departments number[]
    IDs of departments to which the rule must be applied.
    description string
    Additional information about the NAT control rule.
    destAddresses string[]
    Destination IP addresses, FQDNs, or wildcard FQDNs for the rule.
    destCountries string[]
    Destination countries (ISO 3166-1 alpha-2 codes) for the rule.
    destIpCategories string[]
    Destination IP address URL categories for the rule.
    destIpGroups number[]
    IDs of destination IP address groups for the rule.
    destIpv6Groups number[]
    IDs of destination IPv6 address groups for the rule.
    deviceGroups number[]
    IDs of device groups for which the rule must be applied. Applicable for devices managed using Zscaler Client Connector.
    devices number[]
    IDs of devices for which the rule must be applied.
    enableFullLogging boolean
    If set to true, enables full logging for the rule.
    groups number[]
    IDs of groups to which the rule must be applied.
    labels number[]
    IDs of labels associated with the rule.
    locationGroups number[]
    IDs of location groups to which the rule must be applied.
    locations number[]
    IDs of locations to which the rule must be applied.
    nwServiceGroups number[]
    IDs of network service groups to which the rule applies.
    nwServices number[]
    IDs of network services to which the rule applies.
    predefined boolean
    Indicates whether this is a predefined rule.
    rank number
    Admin rank of the NAT control policy rule. Valid values: 0-7. Default: 7.
    redirectFqdn string
    The FQDN to which traffic should be redirected.
    redirectIp string
    The IP address to which traffic should be redirected.
    redirectPort number
    The port to which traffic should be redirected.
    resCategories string[]
    URL categories that apply to the response for the rule.
    srcIpGroups number[]
    IDs of source IP address groups for the rule.
    srcIps string[]
    Source IP addresses or CIDR ranges for the rule.
    srcIpv6Groups number[]
    IDs of source IPv6 address groups for the rule.
    state string
    Rule state. Valid values: ENABLED, DISABLED.
    timeWindows number[]
    IDs of time intervals during which the rule must be enforced.
    users number[]
    IDs of users to which the rule must be applied.
    name str
    The name of the NAT control rule. Must be unique.
    order int
    The order of execution of the rule with respect to other NAT control rules.
    default_rule bool
    Indicates whether this is the default NAT control rule.
    departments Sequence[int]
    IDs of departments to which the rule must be applied.
    description str
    Additional information about the NAT control rule.
    dest_addresses Sequence[str]
    Destination IP addresses, FQDNs, or wildcard FQDNs for the rule.
    dest_countries Sequence[str]
    Destination countries (ISO 3166-1 alpha-2 codes) for the rule.
    dest_ip_categories Sequence[str]
    Destination IP address URL categories for the rule.
    dest_ip_groups Sequence[int]
    IDs of destination IP address groups for the rule.
    dest_ipv6_groups Sequence[int]
    IDs of destination IPv6 address groups for the rule.
    device_groups Sequence[int]
    IDs of device groups for which the rule must be applied. Applicable for devices managed using Zscaler Client Connector.
    devices Sequence[int]
    IDs of devices for which the rule must be applied.
    enable_full_logging bool
    If set to true, enables full logging for the rule.
    groups Sequence[int]
    IDs of groups to which the rule must be applied.
    labels Sequence[int]
    IDs of labels associated with the rule.
    location_groups Sequence[int]
    IDs of location groups to which the rule must be applied.
    locations Sequence[int]
    IDs of locations to which the rule must be applied.
    nw_service_groups Sequence[int]
    IDs of network service groups to which the rule applies.
    nw_services Sequence[int]
    IDs of network services to which the rule applies.
    predefined bool
    Indicates whether this is a predefined rule.
    rank int
    Admin rank of the NAT control policy rule. Valid values: 0-7. Default: 7.
    redirect_fqdn str
    The FQDN to which traffic should be redirected.
    redirect_ip str
    The IP address to which traffic should be redirected.
    redirect_port int
    The port to which traffic should be redirected.
    res_categories Sequence[str]
    URL categories that apply to the response for the rule.
    src_ip_groups Sequence[int]
    IDs of source IP address groups for the rule.
    src_ips Sequence[str]
    Source IP addresses or CIDR ranges for the rule.
    src_ipv6_groups Sequence[int]
    IDs of source IPv6 address groups for the rule.
    state str
    Rule state. Valid values: ENABLED, DISABLED.
    time_windows Sequence[int]
    IDs of time intervals during which the rule must be enforced.
    users Sequence[int]
    IDs of users to which the rule must be applied.
    name String
    The name of the NAT control rule. Must be unique.
    order Number
    The order of execution of the rule with respect to other NAT control rules.
    defaultRule Boolean
    Indicates whether this is the default NAT control rule.
    departments List<Number>
    IDs of departments to which the rule must be applied.
    description String
    Additional information about the NAT control rule.
    destAddresses List<String>
    Destination IP addresses, FQDNs, or wildcard FQDNs for the rule.
    destCountries List<String>
    Destination countries (ISO 3166-1 alpha-2 codes) for the rule.
    destIpCategories List<String>
    Destination IP address URL categories for the rule.
    destIpGroups List<Number>
    IDs of destination IP address groups for the rule.
    destIpv6Groups List<Number>
    IDs of destination IPv6 address groups for the rule.
    deviceGroups List<Number>
    IDs of device groups for which the rule must be applied. Applicable for devices managed using Zscaler Client Connector.
    devices List<Number>
    IDs of devices for which the rule must be applied.
    enableFullLogging Boolean
    If set to true, enables full logging for the rule.
    groups List<Number>
    IDs of groups to which the rule must be applied.
    labels List<Number>
    IDs of labels associated with the rule.
    locationGroups List<Number>
    IDs of location groups to which the rule must be applied.
    locations List<Number>
    IDs of locations to which the rule must be applied.
    nwServiceGroups List<Number>
    IDs of network service groups to which the rule applies.
    nwServices List<Number>
    IDs of network services to which the rule applies.
    predefined Boolean
    Indicates whether this is a predefined rule.
    rank Number
    Admin rank of the NAT control policy rule. Valid values: 0-7. Default: 7.
    redirectFqdn String
    The FQDN to which traffic should be redirected.
    redirectIp String
    The IP address to which traffic should be redirected.
    redirectPort Number
    The port to which traffic should be redirected.
    resCategories List<String>
    URL categories that apply to the response for the rule.
    srcIpGroups List<Number>
    IDs of source IP address groups for the rule.
    srcIps List<String>
    Source IP addresses or CIDR ranges for the rule.
    srcIpv6Groups List<Number>
    IDs of source IPv6 address groups for the rule.
    state String
    Rule state. Valid values: ENABLED, DISABLED.
    timeWindows List<Number>
    IDs of time intervals during which the rule must be enforced.
    users List<Number>
    IDs of users to which the rule must be applied.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the NatControlRule resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    RuleId int
    The system-generated ID of the NAT control rule.
    Id string
    The provider-assigned unique ID for this managed resource.
    RuleId int
    The system-generated ID of the NAT control rule.
    id String
    The provider-assigned unique ID for this managed resource.
    ruleId Integer
    The system-generated ID of the NAT control rule.
    id string
    The provider-assigned unique ID for this managed resource.
    ruleId number
    The system-generated ID of the NAT control rule.
    id str
    The provider-assigned unique ID for this managed resource.
    rule_id int
    The system-generated ID of the NAT control rule.
    id String
    The provider-assigned unique ID for this managed resource.
    ruleId Number
    The system-generated ID of the NAT control rule.

    Import

    An existing NAT Control Rule can be imported using its resource ID, e.g.

    $ pulumi import zia:index:NatControlRule example 12345

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    zia zscaler/pulumi-zia
    License
    zia logo
    Viewing docs for pulumi-resource-zia v1.3.8
    published on Friday, Mar 13, 2026 by Zscaler
    Schema (JSON)
    zscaler/pulumi-zia
      Try Pulumi Cloud free. Your team will thank you.