Policy

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AzureNative = Pulumi.AzureNative;
return await Deployment.RunAsync(() =>
{
    var policy = new AzureNative.Network.Policy("policy", new()
    {
        CustomRules = new AzureNative.Network.Inputs.CustomRuleListArgs
        {
            Rules = new[]
            {
                new AzureNative.Network.Inputs.CustomRuleArgs
                {
                    Action = "Block",
                    MatchConditions = new[]
                    {
                        new AzureNative.Network.Inputs.FrontDoorMatchConditionArgs
                        {
                            MatchValue = new[]
                            {
                                "192.168.1.0/24",
                                "10.0.0.0/24",
                            },
                            MatchVariable = "RemoteAddr",
                            Operator = "IPMatch",
                        },
                    },
                    Name = "Rule1",
                    Priority = 1,
                    RateLimitThreshold = 1000,
                    RuleType = "RateLimitRule",
                },
                new AzureNative.Network.Inputs.CustomRuleArgs
                {
                    Action = "Block",
                    MatchConditions = new[]
                    {
                        new AzureNative.Network.Inputs.FrontDoorMatchConditionArgs
                        {
                            MatchValue = new[]
                            {
                                "CH",
                            },
                            MatchVariable = "RemoteAddr",
                            Operator = "GeoMatch",
                        },
                        new AzureNative.Network.Inputs.FrontDoorMatchConditionArgs
                        {
                            MatchValue = new[]
                            {
                                "windows",
                            },
                            MatchVariable = "RequestHeader",
                            Operator = "Contains",
                            Selector = "UserAgent",
                            Transforms = new[]
                            {
                                "Lowercase",
                            },
                        },
                    },
                    Name = "Rule2",
                    Priority = 2,
                    RuleType = "MatchRule",
                },
            },
        },
        ManagedRules = new AzureNative.Network.Inputs.ManagedRuleSetListArgs
        {
            ManagedRuleSets = new[]
            {
                new AzureNative.Network.Inputs.FrontDoorManagedRuleSetArgs
                {
                    Exclusions = new[]
                    {
                        new AzureNative.Network.Inputs.ManagedRuleExclusionArgs
                        {
                            MatchVariable = "RequestHeaderNames",
                            Selector = "User-Agent",
                            SelectorMatchOperator = "Equals",
                        },
                    },
                    RuleGroupOverrides = new[]
                    {
                        new AzureNative.Network.Inputs.FrontDoorManagedRuleGroupOverrideArgs
                        {
                            Exclusions = new[]
                            {
                                new AzureNative.Network.Inputs.ManagedRuleExclusionArgs
                                {
                                    MatchVariable = "RequestCookieNames",
                                    Selector = "token",
                                    SelectorMatchOperator = "StartsWith",
                                },
                            },
                            RuleGroupName = "SQLI",
                            Rules = new[]
                            {
                                new AzureNative.Network.Inputs.FrontDoorManagedRuleOverrideArgs
                                {
                                    Action = "Redirect",
                                    EnabledState = "Enabled",
                                    Exclusions = new[]
                                    {
                                        new AzureNative.Network.Inputs.ManagedRuleExclusionArgs
                                        {
                                            MatchVariable = "QueryStringArgNames",
                                            Selector = "query",
                                            SelectorMatchOperator = "Equals",
                                        },
                                    },
                                    RuleId = "942100",
                                },
                                new AzureNative.Network.Inputs.FrontDoorManagedRuleOverrideArgs
                                {
                                    EnabledState = "Disabled",
                                    RuleId = "942110",
                                },
                            },
                        },
                    },
                    RuleSetAction = "Block",
                    RuleSetType = "DefaultRuleSet",
                    RuleSetVersion = "1.0",
                },
            },
        },
        PolicyName = "Policy1",
        PolicySettings = new AzureNative.Network.Inputs.FrontDoorPolicySettingsArgs
        {
            CustomBlockResponseBody = "PGh0bWw+CjxoZWFkZXI+PHRpdGxlPkhlbGxvPC90aXRsZT48L2hlYWRlcj4KPGJvZHk+CkhlbGxvIHdvcmxkCjwvYm9keT4KPC9odG1sPg==",
            CustomBlockResponseStatusCode = 499,
            EnabledState = "Enabled",
            Mode = "Prevention",
            RedirectUrl = "http://www.bing.com",
            RequestBodyCheck = "Disabled",
        },
        ResourceGroupName = "rg1",
        Sku = new AzureNative.Network.Inputs.SkuArgs
        {
            Name = "Classic_AzureFrontDoor",
        },
    });
});

package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azurenative.network.Policy;
import com.pulumi.azurenative.network.PolicyArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }
    public static void stack(Context ctx) {
        var policy = new Policy("policy", PolicyArgs.builder()
            .customRules(Map.of("rules",
                Map.ofEntries(
                    Map.entry("action", "Block"),
                    Map.entry("matchConditions", Map.ofEntries(
                        Map.entry("matchValue",
                            "192.168.1.0/24",
                            "10.0.0.0/24"),
                        Map.entry("matchVariable", "RemoteAddr"),
                        Map.entry("operator", "IPMatch")
                    )),
                    Map.entry("name", "Rule1"),
                    Map.entry("priority", 1),
                    Map.entry("rateLimitThreshold", 1000),
                    Map.entry("ruleType", "RateLimitRule")
                ),
                Map.ofEntries(
                    Map.entry("action", "Block"),
                    Map.entry("matchConditions",
                        Map.ofEntries(
                            Map.entry("matchValue", "CH"),
                            Map.entry("matchVariable", "RemoteAddr"),
                            Map.entry("operator", "GeoMatch")
                        ),
                        Map.ofEntries(
                            Map.entry("matchValue", "windows"),
                            Map.entry("matchVariable", "RequestHeader"),
                            Map.entry("operator", "Contains"),
                            Map.entry("selector", "UserAgent"),
                            Map.entry("transforms", "Lowercase")
                        )),
                    Map.entry("name", "Rule2"),
                    Map.entry("priority", 2),
                    Map.entry("ruleType", "MatchRule")
                )))
            .managedRules(Map.of("managedRuleSets", Map.ofEntries(
                Map.entry("exclusions", Map.ofEntries(
                    Map.entry("matchVariable", "RequestHeaderNames"),
                    Map.entry("selector", "User-Agent"),
                    Map.entry("selectorMatchOperator", "Equals")
                )),
                Map.entry("ruleGroupOverrides", Map.ofEntries(
                    Map.entry("exclusions", Map.ofEntries(
                        Map.entry("matchVariable", "RequestCookieNames"),
                        Map.entry("selector", "token"),
                        Map.entry("selectorMatchOperator", "StartsWith")
                    )),
                    Map.entry("ruleGroupName", "SQLI"),
                    Map.entry("rules",
                        Map.ofEntries(
                            Map.entry("action", "Redirect"),
                            Map.entry("enabledState", "Enabled"),
                            Map.entry("exclusions", Map.ofEntries(
                                Map.entry("matchVariable", "QueryStringArgNames"),
                                Map.entry("selector", "query"),
                                Map.entry("selectorMatchOperator", "Equals")
                            )),
                            Map.entry("ruleId", "942100")
                        ),
                        Map.ofEntries(
                            Map.entry("enabledState", "Disabled"),
                            Map.entry("ruleId", "942110")
                        ))
                )),
                Map.entry("ruleSetAction", "Block"),
                Map.entry("ruleSetType", "DefaultRuleSet"),
                Map.entry("ruleSetVersion", "1.0")
            )))
            .policyName("Policy1")
            .policySettings(Map.ofEntries(
                Map.entry("customBlockResponseBody", "PGh0bWw+CjxoZWFkZXI+PHRpdGxlPkhlbGxvPC90aXRsZT48L2hlYWRlcj4KPGJvZHk+CkhlbGxvIHdvcmxkCjwvYm9keT4KPC9odG1sPg=="),
                Map.entry("customBlockResponseStatusCode", 499),
                Map.entry("enabledState", "Enabled"),
                Map.entry("mode", "Prevention"),
                Map.entry("redirectUrl", "http://www.bing.com"),
                Map.entry("requestBodyCheck", "Disabled")
            ))
            .resourceGroupName("rg1")
            .sku(Map.of("name", "Classic_AzureFrontDoor"))
            .build());
    }
}

$ pulumi import azure-native:network:Policy Policy1 /subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/FrontDoorWebApplicationFirewallPolicies/Policy1