SslInspectionRule

pulumi-resource-zia v1.3.8, Mar 13 26

Viewing docs for pulumi-resource-zia v1.3.8
published on Friday, Mar 13, 2026 by Zscaler

Schema (JSON)

zscaler/pulumi-zia

Viewing docs for pulumi-resource-zia v1.3.8
published on Friday, Mar 13, 2026 by Zscaler

Schema (JSON)

zscaler/pulumi-zia

The zia_ssl_inspection_rules resource manages SSL inspection rules in the Zscaler Internet Access (ZIA) cloud service. SSL inspection rules determine whether to decrypt, not decrypt, or block SSL/TLS traffic based on criteria such as locations, departments, groups, users, URL categories, cloud applications, and platforms.

For more information, see the ZIA SSL Inspection documentation.

Example Usage

Basic SSL Inspection Rule

Example coming soon!

import * as zia from "@bdzscaler/pulumi-zia";

const example = new zia.SslInspectionRule("example", {
    name: "Example SSL Inspection Rule",
    description: "Decrypt corporate traffic",
    order: 1,
    state: "ENABLED",
    action: {
        type: "DECRYPT",
        showEun: false,
        decryptSubActions: {
            serverCertificates: "ALLOW",
            ocspCheck: true,
            http2Enabled: true,
        },
    },
    urlCategories: ["ANY"],
});

import zscaler_pulumi_zia as zia

example = zia.SslInspectionRule("example",
    name="Example SSL Inspection Rule",
    description="Decrypt corporate traffic",
    order=1,
    state="ENABLED",
    action={
        "type": "DECRYPT",
        "show_eun": False,
        "decrypt_sub_actions": {
            "server_certificates": "ALLOW",
            "ocsp_check": True,
            "http2_enabled": True,
        },
    },
    url_categories=["ANY"],
)

resources:
  example:
    type: zia:SslInspectionRule
    properties:
      name: Example SSL Inspection Rule
      description: Decrypt corporate traffic
      order: 1
      state: ENABLED
      action:
        type: DECRYPT
        showEun: false
        decryptSubActions:
          serverCertificates: ALLOW
          ocspCheck: true
          http2Enabled: true
      urlCategories:
        - ANY

Create SslInspectionRule Resource

Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

Constructor syntax

new SslInspectionRule(name: string, args: SslInspectionRuleArgs, opts?: CustomResourceOptions);

@overload
def SslInspectionRule(resource_name: str,
                      args: SslInspectionRuleArgs,
                      opts: Optional[ResourceOptions] = None)

@overload
def SslInspectionRule(resource_name: str,
                      opts: Optional[ResourceOptions] = None,
                      action: Optional[SslInspectionActionInputArgs] = None,
                      order: Optional[int] = None,
                      name: Optional[str] = None,
                      device_trust_levels: Optional[Sequence[str]] = None,
                      platforms: Optional[Sequence[str]] = None,
                      device_groups: Optional[Sequence[int]] = None,
                      description: Optional[str] = None,
                      devices: Optional[Sequence[int]] = None,
                      groups: Optional[Sequence[int]] = None,
                      labels: Optional[Sequence[int]] = None,
                      location_groups: Optional[Sequence[int]] = None,
                      locations: Optional[Sequence[int]] = None,
                      departments: Optional[Sequence[int]] = None,
                      cloud_applications: Optional[Sequence[str]] = None,
                      dest_ip_groups: Optional[Sequence[int]] = None,
                      proxy_gateways: Optional[Sequence[int]] = None,
                      rank: Optional[int] = None,
                      road_warrior_for_kerberos: Optional[bool] = None,
                      source_ip_groups: Optional[Sequence[int]] = None,
                      state: Optional[str] = None,
                      time_windows: Optional[Sequence[int]] = None,
                      url_categories: Optional[Sequence[str]] = None,
                      user_agent_types: Optional[Sequence[str]] = None,
                      users: Optional[Sequence[int]] = None,
                      workload_groups: Optional[Sequence[WorkloadGroupInputArgs]] = None)

func NewSslInspectionRule(ctx *Context, name string, args SslInspectionRuleArgs, opts ...ResourceOption) (*SslInspectionRule, error)

public SslInspectionRule(string name, SslInspectionRuleArgs args, CustomResourceOptions? opts = null)

public SslInspectionRule(String name, SslInspectionRuleArgs args)
public SslInspectionRule(String name, SslInspectionRuleArgs args, CustomResourceOptions options)

type: zia:SslInspectionRule
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

Parameters

name string: The unique name of the resource.
args SslInspectionRuleArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

resource_name str: The unique name of the resource.
args SslInspectionRuleArgs: The arguments to resource properties.
opts ResourceOptions: Bag of options to control resource's behavior.

ctx Context: Context object for the current deployment.
name string: The unique name of the resource.
args SslInspectionRuleArgs: The arguments to resource properties.
opts ResourceOption: Bag of options to control resource's behavior.

name string: The unique name of the resource.
args SslInspectionRuleArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

name String: The unique name of the resource.
args SslInspectionRuleArgs: The arguments to resource properties.
options CustomResourceOptions: Bag of options to control resource's behavior.

Constructor example

The following reference example uses placeholder values for all input properties.

var sslInspectionRuleResource = new Zia.SslInspectionRule("sslInspectionRuleResource", new()
{
    Action = new Zia.Inputs.SslInspectionActionInputArgs
    {
        DecryptSubActions = new Zia.Inputs.DecryptSubActionsInputArgs
        {
            BlockSslTrafficWithNoSniEnabled = false,
            BlockUndecrypt = false,
            Http2Enabled = false,
            MinClientTlsVersion = "string",
            MinServerTlsVersion = "string",
            OcspCheck = false,
            ServerCertificates = "string",
        },
        DoNotDecryptSubActions = new Zia.Inputs.DoNotDecryptSubActionsInputArgs
        {
            BlockSslTrafficWithNoSniEnabled = false,
            BypassOtherPolicies = false,
            MinTlsVersion = "string",
            OcspCheck = false,
            ServerCertificates = "string",
        },
        OverrideDefaultCertificate = false,
        ShowEun = false,
        ShowEunatp = false,
        SslInterceptionCert = new Zia.Inputs.SslInterceptionCertInputArgs
        {
            Id = 0,
        },
        Type = "string",
    },
    Order = 0,
    Name = "string",
    DeviceTrustLevels = new[]
    {
        "string",
    },
    Platforms = new[]
    {
        "string",
    },
    DeviceGroups = new[]
    {
        0,
    },
    Description = "string",
    Devices = new[]
    {
        0,
    },
    Groups = new[]
    {
        0,
    },
    Labels = new[]
    {
        0,
    },
    LocationGroups = new[]
    {
        0,
    },
    Locations = new[]
    {
        0,
    },
    Departments = new[]
    {
        0,
    },
    CloudApplications = new[]
    {
        "string",
    },
    DestIpGroups = new[]
    {
        0,
    },
    ProxyGateways = new[]
    {
        0,
    },
    Rank = 0,
    RoadWarriorForKerberos = false,
    SourceIpGroups = new[]
    {
        0,
    },
    State = "string",
    TimeWindows = new[]
    {
        0,
    },
    UrlCategories = new[]
    {
        "string",
    },
    UserAgentTypes = new[]
    {
        "string",
    },
    Users = new[]
    {
        0,
    },
    WorkloadGroups = new[]
    {
        new Zia.Inputs.WorkloadGroupInputArgs
        {
            ResourceId = 0,
            Name = "string",
        },
    },
});

example, err := zia.NewSslInspectionRule(ctx, "sslInspectionRuleResource", &zia.SslInspectionRuleArgs{
	Action: &pulumizia.SslInspectionActionInputArgs{
		DecryptSubActions: &pulumizia.DecryptSubActionsInputArgs{
			BlockSslTrafficWithNoSniEnabled: pulumi.Bool(false),
			BlockUndecrypt:                  pulumi.Bool(false),
			Http2Enabled:                    pulumi.Bool(false),
			MinClientTlsVersion:             pulumi.String("string"),
			MinServerTlsVersion:             pulumi.String("string"),
			OcspCheck:                       pulumi.Bool(false),
			ServerCertificates:              pulumi.String("string"),
		},
		DoNotDecryptSubActions: &pulumizia.DoNotDecryptSubActionsInputArgs{
			BlockSslTrafficWithNoSniEnabled: pulumi.Bool(false),
			BypassOtherPolicies:             pulumi.Bool(false),
			MinTlsVersion:                   pulumi.String("string"),
			OcspCheck:                       pulumi.Bool(false),
			ServerCertificates:              pulumi.String("string"),
		},
		OverrideDefaultCertificate: pulumi.Bool(false),
		ShowEun:                    pulumi.Bool(false),
		ShowEunatp:                 pulumi.Bool(false),
		SslInterceptionCert: &pulumizia.SslInterceptionCertInputArgs{
			Id: pulumi.Int(0),
		},
		Type: pulumi.String("string"),
	},
	Order: pulumi.Int(0),
	Name:  pulumi.String("string"),
	DeviceTrustLevels: pulumi.StringArray{
		pulumi.String("string"),
	},
	Platforms: pulumi.StringArray{
		pulumi.String("string"),
	},
	DeviceGroups: pulumi.IntArray{
		pulumi.Int(0),
	},
	Description: pulumi.String("string"),
	Devices: pulumi.IntArray{
		pulumi.Int(0),
	},
	Groups: pulumi.IntArray{
		pulumi.Int(0),
	},
	Labels: pulumi.IntArray{
		pulumi.Int(0),
	},
	LocationGroups: pulumi.IntArray{
		pulumi.Int(0),
	},
	Locations: pulumi.IntArray{
		pulumi.Int(0),
	},
	Departments: pulumi.IntArray{
		pulumi.Int(0),
	},
	CloudApplications: pulumi.StringArray{
		pulumi.String("string"),
	},
	DestIpGroups: pulumi.IntArray{
		pulumi.Int(0),
	},
	ProxyGateways: pulumi.IntArray{
		pulumi.Int(0),
	},
	Rank:                   pulumi.Int(0),
	RoadWarriorForKerberos: pulumi.Bool(false),
	SourceIpGroups: pulumi.IntArray{
		pulumi.Int(0),
	},
	State: pulumi.String("string"),
	TimeWindows: pulumi.IntArray{
		pulumi.Int(0),
	},
	UrlCategories: pulumi.StringArray{
		pulumi.String("string"),
	},
	UserAgentTypes: pulumi.StringArray{
		pulumi.String("string"),
	},
	Users: pulumi.IntArray{
		pulumi.Int(0),
	},
	WorkloadGroups: pulumizia.WorkloadGroupInputTypeArray{
		&pulumizia.WorkloadGroupInputTypeArgs{
			ResourceId: pulumi.Int(0),
			Name:       pulumi.String("string"),
		},
	},
})

var sslInspectionRuleResource = new SslInspectionRule("sslInspectionRuleResource", SslInspectionRuleArgs.builder()
    .action(SslInspectionActionInputArgs.builder()
        .decryptSubActions(DecryptSubActionsInputArgs.builder()
            .blockSslTrafficWithNoSniEnabled(false)
            .blockUndecrypt(false)
            .http2Enabled(false)
            .minClientTlsVersion("string")
            .minServerTlsVersion("string")
            .ocspCheck(false)
            .serverCertificates("string")
            .build())
        .doNotDecryptSubActions(DoNotDecryptSubActionsInputArgs.builder()
            .blockSslTrafficWithNoSniEnabled(false)
            .bypassOtherPolicies(false)
            .minTlsVersion("string")
            .ocspCheck(false)
            .serverCertificates("string")
            .build())
        .overrideDefaultCertificate(false)
        .showEun(false)
        .showEunatp(false)
        .sslInterceptionCert(SslInterceptionCertInputArgs.builder()
            .id(0)
            .build())
        .type("string")
        .build())
    .order(0)
    .name("string")
    .deviceTrustLevels("string")
    .platforms("string")
    .deviceGroups(0)
    .description("string")
    .devices(0)
    .groups(0)
    .labels(0)
    .locationGroups(0)
    .locations(0)
    .departments(0)
    .cloudApplications("string")
    .destIpGroups(0)
    .proxyGateways(0)
    .rank(0)
    .roadWarriorForKerberos(false)
    .sourceIpGroups(0)
    .state("string")
    .timeWindows(0)
    .urlCategories("string")
    .userAgentTypes("string")
    .users(0)
    .workloadGroups(WorkloadGroupInputArgs.builder()
        .resourceId(0)
        .name("string")
        .build())
    .build());

ssl_inspection_rule_resource = zia.SslInspectionRule("sslInspectionRuleResource",
    action={
        "decrypt_sub_actions": {
            "block_ssl_traffic_with_no_sni_enabled": False,
            "block_undecrypt": False,
            "http2_enabled": False,
            "min_client_tls_version": "string",
            "min_server_tls_version": "string",
            "ocsp_check": False,
            "server_certificates": "string",
        },
        "do_not_decrypt_sub_actions": {
            "block_ssl_traffic_with_no_sni_enabled": False,
            "bypass_other_policies": False,
            "min_tls_version": "string",
            "ocsp_check": False,
            "server_certificates": "string",
        },
        "override_default_certificate": False,
        "show_eun": False,
        "show_eunatp": False,
        "ssl_interception_cert": {
            "id": 0,
        },
        "type": "string",
    },
    order=0,
    name="string",
    device_trust_levels=["string"],
    platforms=["string"],
    device_groups=[0],
    description="string",
    devices=[0],
    groups=[0],
    labels=[0],
    location_groups=[0],
    locations=[0],
    departments=[0],
    cloud_applications=["string"],
    dest_ip_groups=[0],
    proxy_gateways=[0],
    rank=0,
    road_warrior_for_kerberos=False,
    source_ip_groups=[0],
    state="string",
    time_windows=[0],
    url_categories=["string"],
    user_agent_types=["string"],
    users=[0],
    workload_groups=[{
        "resource_id": 0,
        "name": "string",
    }])

const sslInspectionRuleResource = new zia.SslInspectionRule("sslInspectionRuleResource", {
    action: {
        decryptSubActions: {
            blockSslTrafficWithNoSniEnabled: false,
            blockUndecrypt: false,
            http2Enabled: false,
            minClientTlsVersion: "string",
            minServerTlsVersion: "string",
            ocspCheck: false,
            serverCertificates: "string",
        },
        doNotDecryptSubActions: {
            blockSslTrafficWithNoSniEnabled: false,
            bypassOtherPolicies: false,
            minTlsVersion: "string",
            ocspCheck: false,
            serverCertificates: "string",
        },
        overrideDefaultCertificate: false,
        showEun: false,
        showEunatp: false,
        sslInterceptionCert: {
            id: 0,
        },
        type: "string",
    },
    order: 0,
    name: "string",
    deviceTrustLevels: ["string"],
    platforms: ["string"],
    deviceGroups: [0],
    description: "string",
    devices: [0],
    groups: [0],
    labels: [0],
    locationGroups: [0],
    locations: [0],
    departments: [0],
    cloudApplications: ["string"],
    destIpGroups: [0],
    proxyGateways: [0],
    rank: 0,
    roadWarriorForKerberos: false,
    sourceIpGroups: [0],
    state: "string",
    timeWindows: [0],
    urlCategories: ["string"],
    userAgentTypes: ["string"],
    users: [0],
    workloadGroups: [{
        resourceId: 0,
        name: "string",
    }],
});

type: zia:SslInspectionRule
properties:
    action:
        decryptSubActions:
            blockSslTrafficWithNoSniEnabled: false
            blockUndecrypt: false
            http2Enabled: false
            minClientTlsVersion: string
            minServerTlsVersion: string
            ocspCheck: false
            serverCertificates: string
        doNotDecryptSubActions:
            blockSslTrafficWithNoSniEnabled: false
            bypassOtherPolicies: false
            minTlsVersion: string
            ocspCheck: false
            serverCertificates: string
        overrideDefaultCertificate: false
        showEun: false
        showEunatp: false
        sslInterceptionCert:
            id: 0
        type: string
    cloudApplications:
        - string
    departments:
        - 0
    description: string
    destIpGroups:
        - 0
    deviceGroups:
        - 0
    deviceTrustLevels:
        - string
    devices:
        - 0
    groups:
        - 0
    labels:
        - 0
    locationGroups:
        - 0
    locations:
        - 0
    name: string
    order: 0
    platforms:
        - string
    proxyGateways:
        - 0
    rank: 0
    roadWarriorForKerberos: false
    sourceIpGroups:
        - 0
    state: string
    timeWindows:
        - 0
    urlCategories:
        - string
    userAgentTypes:
        - string
    users:
        - 0
    workloadGroups:
        - name: string
          resourceId: 0