FirewallRule

Define Firewall rules using filter expressions for more control over how traffic is matched to the rule. A filter expression permits selecting traffic by multiple criteria allowing greater freedom in rule creation.

Filter expressions needs to be created first before using Firewall Rule. See Filter.

Example Usage

using Pulumi;
using Cloudflare = Pulumi.Cloudflare;

class MyStack : Stack
{
    public MyStack()
    {
        var wordpressFilter = new Cloudflare.Filter("wordpressFilter", new Cloudflare.FilterArgs
        {
            ZoneId = "d41d8cd98f00b204e9800998ecf8427e",
            Description = "Wordpress break-in attempts that are outside of the office",
            Expression = "(http.request.uri.path ~ \".*wp-login.php\" or http.request.uri.path ~ \".*xmlrpc.php\") and ip.src ne 192.0.2.1",
        });
        var wordpressFirewallRule = new Cloudflare.FirewallRule("wordpressFirewallRule", new Cloudflare.FirewallRuleArgs
        {
            ZoneId = "d41d8cd98f00b204e9800998ecf8427e",
            Description = "Block wordpress break-in attempts",
            FilterId = wordpressFilter.Id,
            Action = "block",
        });
    }

}

Coming soon!

import pulumi
import pulumi_cloudflare as cloudflare

wordpress_filter = cloudflare.Filter("wordpressFilter",
    zone_id="d41d8cd98f00b204e9800998ecf8427e",
    description="Wordpress break-in attempts that are outside of the office",
    expression="(http.request.uri.path ~ \".*wp-login.php\" or http.request.uri.path ~ \".*xmlrpc.php\") and ip.src ne 192.0.2.1")
wordpress_firewall_rule = cloudflare.FirewallRule("wordpressFirewallRule",
    zone_id="d41d8cd98f00b204e9800998ecf8427e",
    description="Block wordpress break-in attempts",
    filter_id=wordpress_filter.id,
    action="block")

import * as pulumi from "@pulumi/pulumi";
import * as cloudflare from "@pulumi/cloudflare";

const wordpressFilter = new cloudflare.Filter("wordpressFilter", {
    zoneId: "d41d8cd98f00b204e9800998ecf8427e",
    description: "Wordpress break-in attempts that are outside of the office",
    expression: "(http.request.uri.path ~ \".*wp-login.php\" or http.request.uri.path ~ \".*xmlrpc.php\") and ip.src ne 192.0.2.1",
});
const wordpressFirewallRule = new cloudflare.FirewallRule("wordpressFirewallRule", {
    zoneId: "d41d8cd98f00b204e9800998ecf8427e",
    description: "Block wordpress break-in attempts",
    filterId: wordpressFilter.id,
    action: "block",
});

Create a FirewallRule Resource

new FirewallRule(name: string, args: FirewallRuleArgs, opts?: CustomResourceOptions);

def FirewallRule(resource_name, opts=None, action=None, description=None, filter_id=None, paused=None, priority=None, products=None, zone_id=None, __props__=None);

func NewFirewallRule(ctx *Context, name string, args FirewallRuleArgs, opts ...ResourceOption) (*FirewallRule, error)

public FirewallRule(string name, FirewallRuleArgs args, CustomResourceOptions? opts = null)

name string: The unique name of the resource.
args FirewallRuleArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

resource_name str: The unique name of the resource.
opts ResourceOptions: A bag of options that control this resource's behavior.

ctx Context: Context object for the current deployment.
name string: The unique name of the resource.
args FirewallRuleArgs: The arguments to resource properties.
opts ResourceOption: Bag of options to control resource's behavior.

name string: The unique name of the resource.
args FirewallRuleArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

FirewallRule Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Programming Model docs.

Inputs

The FirewallRule resource accepts the following input properties:

Action string: The action to apply to a matched request. Allowed values: “block”, “challenge”, “allow”, “js_challenge”, “bypass”. Enterprise plan also allows “log”.
FilterId string
ZoneId string: The DNS zone to which the Filter should be added.
Description string: A description of the rule to help identify it.
Paused bool: Whether this filter based firewall rule is currently paused. Boolean value.
Priority int: The priority of the rule to allow control of processing order. A lower number indicates high priority. If not provided, any rules with a priority will be sequenced before those without.
Products List<string>: List of products to bypass for a request when the bypass action is used. Allowed values: “zoneLockdown”, “uaBlock”, “bic”, “hot”, “securityLevel”, “rateLimit”, “waf”.

Action string: The action to apply to a matched request. Allowed values: “block”, “challenge”, “allow”, “js_challenge”, “bypass”. Enterprise plan also allows “log”.
FilterId string
ZoneId string: The DNS zone to which the Filter should be added.
Description string: A description of the rule to help identify it.
Paused bool: Whether this filter based firewall rule is currently paused. Boolean value.
Priority int: The priority of the rule to allow control of processing order. A lower number indicates high priority. If not provided, any rules with a priority will be sequenced before those without.
Products []string: List of products to bypass for a request when the bypass action is used. Allowed values: “zoneLockdown”, “uaBlock”, “bic”, “hot”, “securityLevel”, “rateLimit”, “waf”.

action string: The action to apply to a matched request. Allowed values: “block”, “challenge”, “allow”, “js_challenge”, “bypass”. Enterprise plan also allows “log”.
filterId string
zoneId string: The DNS zone to which the Filter should be added.
description string: A description of the rule to help identify it.
paused boolean: Whether this filter based firewall rule is currently paused. Boolean value.
priority number: The priority of the rule to allow control of processing order. A lower number indicates high priority. If not provided, any rules with a priority will be sequenced before those without.
products string[]: List of products to bypass for a request when the bypass action is used. Allowed values: “zoneLockdown”, “uaBlock”, “bic”, “hot”, “securityLevel”, “rateLimit”, “waf”.

action str: The action to apply to a matched request. Allowed values: “block”, “challenge”, “allow”, “js_challenge”, “bypass”. Enterprise plan also allows “log”.
filter_id str
zone_id str: The DNS zone to which the Filter should be added.
description str: A description of the rule to help identify it.
paused bool: Whether this filter based firewall rule is currently paused. Boolean value.
priority float: The priority of the rule to allow control of processing order. A lower number indicates high priority. If not provided, any rules with a priority will be sequenced before those without.
products List[str]: List of products to bypass for a request when the bypass action is used. Allowed values: “zoneLockdown”, “uaBlock”, “bic”, “hot”, “securityLevel”, “rateLimit”, “waf”.

Outputs

All input properties are implicitly available as output properties. Additionally, the FirewallRule resource produces the following output properties:

Id string: The provider-assigned unique ID for this managed resource.

Id string: The provider-assigned unique ID for this managed resource.

id string: The provider-assigned unique ID for this managed resource.

id str: The provider-assigned unique ID for this managed resource.

Look up an Existing FirewallRule Resource

Get an existing FirewallRule resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

public static get(name: string, id: Input<ID>, state?: FirewallRuleState, opts?: CustomResourceOptions): FirewallRule

static get(resource_name, id, opts=None, action=None, description=None, filter_id=None, paused=None, priority=None, products=None, zone_id=None, __props__=None);

func GetFirewallRule(ctx *Context, name string, id IDInput, state *FirewallRuleState, opts ...ResourceOption) (*FirewallRule, error)

public static FirewallRule Get(string name, Input<string> id, FirewallRuleState? state, CustomResourceOptions? opts = null)

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

resource_name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

The following state arguments are supported:

Action string: The action to apply to a matched request. Allowed values: “block”, “challenge”, “allow”, “js_challenge”, “bypass”. Enterprise plan also allows “log”.
Description string: A description of the rule to help identify it.
FilterId string
Paused bool: Whether this filter based firewall rule is currently paused. Boolean value.
Priority int: The priority of the rule to allow control of processing order. A lower number indicates high priority. If not provided, any rules with a priority will be sequenced before those without.
Products List<string>: List of products to bypass for a request when the bypass action is used. Allowed values: “zoneLockdown”, “uaBlock”, “bic”, “hot”, “securityLevel”, “rateLimit”, “waf”.
ZoneId string: The DNS zone to which the Filter should be added.

Action string: The action to apply to a matched request. Allowed values: “block”, “challenge”, “allow”, “js_challenge”, “bypass”. Enterprise plan also allows “log”.
Description string: A description of the rule to help identify it.
FilterId string
Paused bool: Whether this filter based firewall rule is currently paused. Boolean value.
Priority int: The priority of the rule to allow control of processing order. A lower number indicates high priority. If not provided, any rules with a priority will be sequenced before those without.
Products []string: List of products to bypass for a request when the bypass action is used. Allowed values: “zoneLockdown”, “uaBlock”, “bic”, “hot”, “securityLevel”, “rateLimit”, “waf”.
ZoneId string: The DNS zone to which the Filter should be added.

action string: The action to apply to a matched request. Allowed values: “block”, “challenge”, “allow”, “js_challenge”, “bypass”. Enterprise plan also allows “log”.
description string: A description of the rule to help identify it.
filterId string
paused boolean: Whether this filter based firewall rule is currently paused. Boolean value.
priority number: The priority of the rule to allow control of processing order. A lower number indicates high priority. If not provided, any rules with a priority will be sequenced before those without.
products string[]: List of products to bypass for a request when the bypass action is used. Allowed values: “zoneLockdown”, “uaBlock”, “bic”, “hot”, “securityLevel”, “rateLimit”, “waf”.
zoneId string: The DNS zone to which the Filter should be added.

action str: The action to apply to a matched request. Allowed values: “block”, “challenge”, “allow”, “js_challenge”, “bypass”. Enterprise plan also allows “log”.
description str: A description of the rule to help identify it.
filter_id str
paused bool: Whether this filter based firewall rule is currently paused. Boolean value.
priority float: The priority of the rule to allow control of processing order. A lower number indicates high priority. If not provided, any rules with a priority will be sequenced before those without.
products List[str]: List of products to bypass for a request when the bypass action is used. Allowed values: “zoneLockdown”, “uaBlock”, “bic”, “hot”, “securityLevel”, “rateLimit”, “waf”.
zone_id str: The DNS zone to which the Filter should be added.

Package Details

Repository: https://github.com/pulumi/pulumi-cloudflare
License: Apache-2.0
Notes: This Pulumi package is based on the cloudflare Terraform Provider.

The Pulumi Platform

Get Started

Migrate to Pulumi

Solutions for All Teams and Engineers

Any Code

Any Cloud