Policy
Defines web application firewall policy. Uses Azure REST API version 2024-02-01. Other available API versions: 2019-03-01, 2019-10-01, 2020-04-01, 2020-11-01, 2021-06-01, 2022-05-01. These can be accessed by generating a local SDK package using the CLI command pulumi package add azure-native frontdoor [ApiVersion]. See the ../../../version-guide/#accessing-any-api-version-via-local-packages for details.
Example Usage
Creates specific policy
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AzureNative = Pulumi.AzureNative;
return await Deployment.RunAsync(() =>
{
var policy = new AzureNative.FrontDoor.Policy("policy", new()
{
CustomRules = new AzureNative.FrontDoor.Inputs.CustomRuleListArgs
{
Rules = new[]
{
new AzureNative.FrontDoor.Inputs.CustomRuleArgs
{
Action = AzureNative.FrontDoor.ActionType.Block,
MatchConditions = new[]
{
new AzureNative.FrontDoor.Inputs.MatchConditionArgs
{
MatchValue = new[]
{
"192.168.1.0/24",
"10.0.0.0/24",
},
MatchVariable = AzureNative.FrontDoor.MatchVariable.RemoteAddr,
Operator = AzureNative.FrontDoor.Operator.IPMatch,
},
},
Name = "Rule1",
Priority = 1,
RateLimitThreshold = 1000,
RuleType = AzureNative.FrontDoor.RuleType.RateLimitRule,
},
new AzureNative.FrontDoor.Inputs.CustomRuleArgs
{
Action = AzureNative.FrontDoor.ActionType.Block,
MatchConditions = new[]
{
new AzureNative.FrontDoor.Inputs.MatchConditionArgs
{
MatchValue = new[]
{
"CH",
},
MatchVariable = AzureNative.FrontDoor.MatchVariable.RemoteAddr,
Operator = AzureNative.FrontDoor.Operator.GeoMatch,
},
new AzureNative.FrontDoor.Inputs.MatchConditionArgs
{
MatchValue = new[]
{
"windows",
},
MatchVariable = AzureNative.FrontDoor.MatchVariable.RequestHeader,
Operator = AzureNative.FrontDoor.Operator.Contains,
Selector = "UserAgent",
Transforms = new[]
{
AzureNative.FrontDoor.TransformType.Lowercase,
},
},
},
Name = "Rule2",
Priority = 2,
RuleType = AzureNative.FrontDoor.RuleType.MatchRule,
},
},
},
Location = "WestUs",
ManagedRules = new AzureNative.FrontDoor.Inputs.ManagedRuleSetListArgs
{
ManagedRuleSets = new[]
{
new AzureNative.FrontDoor.Inputs.ManagedRuleSetArgs
{
Exclusions = new[]
{
new AzureNative.FrontDoor.Inputs.ManagedRuleExclusionArgs
{
MatchVariable = AzureNative.FrontDoor.ManagedRuleExclusionMatchVariable.RequestHeaderNames,
Selector = "User-Agent",
SelectorMatchOperator = AzureNative.FrontDoor.ManagedRuleExclusionSelectorMatchOperator.EqualsValue,
},
},
RuleGroupOverrides = new[]
{
new AzureNative.FrontDoor.Inputs.ManagedRuleGroupOverrideArgs
{
Exclusions = new[]
{
new AzureNative.FrontDoor.Inputs.ManagedRuleExclusionArgs
{
MatchVariable = AzureNative.FrontDoor.ManagedRuleExclusionMatchVariable.RequestCookieNames,
Selector = "token",
SelectorMatchOperator = AzureNative.FrontDoor.ManagedRuleExclusionSelectorMatchOperator.StartsWith,
},
},
RuleGroupName = "SQLI",
Rules = new[]
{
new AzureNative.FrontDoor.Inputs.ManagedRuleOverrideArgs
{
Action = AzureNative.FrontDoor.ActionType.Redirect,
EnabledState = AzureNative.FrontDoor.ManagedRuleEnabledState.Enabled,
Exclusions = new[]
{
new AzureNative.FrontDoor.Inputs.ManagedRuleExclusionArgs
{
MatchVariable = AzureNative.FrontDoor.ManagedRuleExclusionMatchVariable.QueryStringArgNames,
Selector = "query",
SelectorMatchOperator = AzureNative.FrontDoor.ManagedRuleExclusionSelectorMatchOperator.EqualsValue,
},
},
RuleId = "942100",
},
new AzureNative.FrontDoor.Inputs.ManagedRuleOverrideArgs
{
EnabledState = AzureNative.FrontDoor.ManagedRuleEnabledState.Disabled,
RuleId = "942110",
},
},
},
},
RuleSetAction = AzureNative.FrontDoor.ManagedRuleSetActionType.Block,
RuleSetType = "DefaultRuleSet",
RuleSetVersion = "1.0",
},
},
},
PolicyName = "Policy1",
PolicySettings = new AzureNative.FrontDoor.Inputs.PolicySettingsArgs
{
CustomBlockResponseBody = "PGh0bWw+CjxoZWFkZXI+PHRpdGxlPkhlbGxvPC90aXRsZT48L2hlYWRlcj4KPGJvZHk+CkhlbGxvIHdvcmxkCjwvYm9keT4KPC9odG1sPg==",
CustomBlockResponseStatusCode = 429,
EnabledState = AzureNative.FrontDoor.PolicyEnabledState.Enabled,
JavascriptChallengeExpirationInMinutes = 30,
Mode = AzureNative.FrontDoor.PolicyMode.Prevention,
RedirectUrl = "http://www.bing.com",
RequestBodyCheck = AzureNative.FrontDoor.PolicyRequestBodyCheck.Disabled,
ScrubbingRules = new[]
{
new AzureNative.FrontDoor.Inputs.WebApplicationFirewallScrubbingRulesArgs
{
MatchVariable = AzureNative.FrontDoor.ScrubbingRuleEntryMatchVariable.RequestIPAddress,
SelectorMatchOperator = AzureNative.FrontDoor.ScrubbingRuleEntryMatchOperator.EqualsAny,
State = AzureNative.FrontDoor.ScrubbingRuleEntryState.Enabled,
},
},
State = AzureNative.FrontDoor.WebApplicationFirewallScrubbingState.Enabled,
},
ResourceGroupName = "rg1",
Sku = new AzureNative.FrontDoor.Inputs.SkuArgs
{
Name = AzureNative.FrontDoor.SkuName.Premium_AzureFrontDoor,
},
});
});Content copied to clipboard
package main
import (
frontdoor "github.com/pulumi/pulumi-azure-native-sdk/frontdoor/v2"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := frontdoor.NewPolicy(ctx, "policy", &frontdoor.PolicyArgs{
CustomRules: &frontdoor.CustomRuleListArgs{
Rules: frontdoor.CustomRuleArray{
&frontdoor.CustomRuleArgs{
Action: pulumi.String(frontdoor.ActionTypeBlock),
MatchConditions: frontdoor.MatchConditionArray{
&frontdoor.MatchConditionArgs{
MatchValue: pulumi.StringArray{
pulumi.String("192.168.1.0/24"),
pulumi.String("10.0.0.0/24"),
},
MatchVariable: pulumi.String(frontdoor.MatchVariableRemoteAddr),
Operator: pulumi.String(frontdoor.OperatorIPMatch),
},
},
Name: pulumi.String("Rule1"),
Priority: pulumi.Int(1),
RateLimitThreshold: pulumi.Int(1000),
RuleType: pulumi.String(frontdoor.RuleTypeRateLimitRule),
},
&frontdoor.CustomRuleArgs{
Action: pulumi.String(frontdoor.ActionTypeBlock),
MatchConditions: frontdoor.MatchConditionArray{
&frontdoor.MatchConditionArgs{
MatchValue: pulumi.StringArray{
pulumi.String("CH"),
},
MatchVariable: pulumi.String(frontdoor.MatchVariableRemoteAddr),
Operator: pulumi.String(frontdoor.OperatorGeoMatch),
},
&frontdoor.MatchConditionArgs{
MatchValue: pulumi.StringArray{
pulumi.String("windows"),
},
MatchVariable: pulumi.String(frontdoor.MatchVariableRequestHeader),
Operator: pulumi.String(frontdoor.OperatorContains),
Selector: pulumi.String("UserAgent"),
Transforms: pulumi.StringArray{
pulumi.String(frontdoor.TransformTypeLowercase),
},
},
},
Name: pulumi.String("Rule2"),
Priority: pulumi.Int(2),
RuleType: pulumi.String(frontdoor.RuleTypeMatchRule),
},
},
},
Location: pulumi.String("WestUs"),
ManagedRules: &frontdoor.ManagedRuleSetListArgs{
ManagedRuleSets: frontdoor.ManagedRuleSetArray{
&frontdoor.ManagedRuleSetArgs{
Exclusions: frontdoor.ManagedRuleExclusionArray{
&frontdoor.ManagedRuleExclusionArgs{
MatchVariable: pulumi.String(frontdoor.ManagedRuleExclusionMatchVariableRequestHeaderNames),
Selector: pulumi.String("User-Agent"),
SelectorMatchOperator: pulumi.String(frontdoor.ManagedRuleExclusionSelectorMatchOperatorEquals),
},
},
RuleGroupOverrides: frontdoor.ManagedRuleGroupOverrideArray{
&frontdoor.ManagedRuleGroupOverrideArgs{
Exclusions: frontdoor.ManagedRuleExclusionArray{
&frontdoor.ManagedRuleExclusionArgs{
MatchVariable: pulumi.String(frontdoor.ManagedRuleExclusionMatchVariableRequestCookieNames),
Selector: pulumi.String("token"),
SelectorMatchOperator: pulumi.String(frontdoor.ManagedRuleExclusionSelectorMatchOperatorStartsWith),
},
},
RuleGroupName: pulumi.String("SQLI"),
Rules: frontdoor.ManagedRuleOverrideArray{
&frontdoor.ManagedRuleOverrideArgs{
Action: pulumi.String(frontdoor.ActionTypeRedirect),
EnabledState: pulumi.String(frontdoor.ManagedRuleEnabledStateEnabled),
Exclusions: frontdoor.ManagedRuleExclusionArray{
&frontdoor.ManagedRuleExclusionArgs{
MatchVariable: pulumi.String(frontdoor.ManagedRuleExclusionMatchVariableQueryStringArgNames),
Selector: pulumi.String("query"),
SelectorMatchOperator: pulumi.String(frontdoor.ManagedRuleExclusionSelectorMatchOperatorEquals),
},
},
RuleId: pulumi.String("942100"),
},
&frontdoor.ManagedRuleOverrideArgs{
EnabledState: pulumi.String(frontdoor.ManagedRuleEnabledStateDisabled),
RuleId: pulumi.String("942110"),
},
},
},
},
RuleSetAction: pulumi.String(frontdoor.ManagedRuleSetActionTypeBlock),
RuleSetType: pulumi.String("DefaultRuleSet"),
RuleSetVersion: pulumi.String("1.0"),
},
},
},
PolicyName: pulumi.String("Policy1"),
PolicySettings: &frontdoor.PolicySettingsArgs{
CustomBlockResponseBody: pulumi.String("PGh0bWw+CjxoZWFkZXI+PHRpdGxlPkhlbGxvPC90aXRsZT48L2hlYWRlcj4KPGJvZHk+CkhlbGxvIHdvcmxkCjwvYm9keT4KPC9odG1sPg=="),
CustomBlockResponseStatusCode: pulumi.Int(429),
EnabledState: pulumi.String(frontdoor.PolicyEnabledStateEnabled),
JavascriptChallengeExpirationInMinutes: pulumi.Int(30),
Mode: pulumi.String(frontdoor.PolicyModePrevention),
RedirectUrl: pulumi.String("http://www.bing.com"),
RequestBodyCheck: pulumi.String(frontdoor.PolicyRequestBodyCheckDisabled),
ScrubbingRules: frontdoor.WebApplicationFirewallScrubbingRulesArray{
&frontdoor.WebApplicationFirewallScrubbingRulesArgs{
MatchVariable: pulumi.String(frontdoor.ScrubbingRuleEntryMatchVariableRequestIPAddress),
SelectorMatchOperator: pulumi.String(frontdoor.ScrubbingRuleEntryMatchOperatorEqualsAny),
State: pulumi.String(frontdoor.ScrubbingRuleEntryStateEnabled),
},
},
State: pulumi.String(frontdoor.WebApplicationFirewallScrubbingStateEnabled),
},
ResourceGroupName: pulumi.String("rg1"),
Sku: &frontdoor.SkuArgs{
Name: pulumi.String(frontdoor.SkuName_Premium_AzureFrontDoor),
},
})
if err != nil {
return err
}
return nil
})
}Content copied to clipboard
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azurenative.frontdoor.Policy;
import com.pulumi.azurenative.frontdoor.PolicyArgs;
import com.pulumi.azurenative.frontdoor.inputs.CustomRuleListArgs;
import com.pulumi.azurenative.frontdoor.inputs.ManagedRuleSetListArgs;
import com.pulumi.azurenative.frontdoor.inputs.PolicySettingsArgs;
import com.pulumi.azurenative.frontdoor.inputs.SkuArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var policy = new Policy("policy", PolicyArgs.builder()
.customRules(CustomRuleListArgs.builder()
.rules(
CustomRuleArgs.builder()
.action("Block")
.matchConditions(MatchConditionArgs.builder()
.matchValue(
"192.168.1.0/24",
"10.0.0.0/24")
.matchVariable("RemoteAddr")
.operator("IPMatch")
.build())
.name("Rule1")
.priority(1)
.rateLimitThreshold(1000)
.ruleType("RateLimitRule")
.build(),
CustomRuleArgs.builder()
.action("Block")
.matchConditions(
MatchConditionArgs.builder()
.matchValue("CH")
.matchVariable("RemoteAddr")
.operator("GeoMatch")
.build(),
MatchConditionArgs.builder()
.matchValue("windows")
.matchVariable("RequestHeader")
.operator("Contains")
.selector("UserAgent")
.transforms("Lowercase")
.build())
.name("Rule2")
.priority(2)
.ruleType("MatchRule")
.build())
.build())
.location("WestUs")
.managedRules(ManagedRuleSetListArgs.builder()
.managedRuleSets(ManagedRuleSetArgs.builder()
.exclusions(ManagedRuleExclusionArgs.builder()
.matchVariable("RequestHeaderNames")
.selector("User-Agent")
.selectorMatchOperator("Equals")
.build())
.ruleGroupOverrides(ManagedRuleGroupOverrideArgs.builder()
.exclusions(ManagedRuleExclusionArgs.builder()
.matchVariable("RequestCookieNames")
.selector("token")
.selectorMatchOperator("StartsWith")
.build())
.ruleGroupName("SQLI")
.rules(
ManagedRuleOverrideArgs.builder()
.action("Redirect")
.enabledState("Enabled")
.exclusions(ManagedRuleExclusionArgs.builder()
.matchVariable("QueryStringArgNames")
.selector("query")
.selectorMatchOperator("Equals")
.build())
.ruleId("942100")
.build(),
ManagedRuleOverrideArgs.builder()
.enabledState("Disabled")
.ruleId("942110")
.build())
.build())
.ruleSetAction("Block")
.ruleSetType("DefaultRuleSet")
.ruleSetVersion("1.0")
.build())
.build())
.policyName("Policy1")
.policySettings(PolicySettingsArgs.builder()
.customBlockResponseBody("PGh0bWw+CjxoZWFkZXI+PHRpdGxlPkhlbGxvPC90aXRsZT48L2hlYWRlcj4KPGJvZHk+CkhlbGxvIHdvcmxkCjwvYm9keT4KPC9odG1sPg==")
.customBlockResponseStatusCode(429)
.enabledState("Enabled")
.javascriptChallengeExpirationInMinutes(30)
.mode("Prevention")
.redirectUrl("http://www.bing.com")
.requestBodyCheck("Disabled")
.scrubbingRules(WebApplicationFirewallScrubbingRulesArgs.builder()
.matchVariable("RequestIPAddress")
.selectorMatchOperator("EqualsAny")
.state("Enabled")
.build())
.state("Enabled")
.build())
.resourceGroupName("rg1")
.sku(SkuArgs.builder()
.name("Premium_AzureFrontDoor")
.build())
.build());
}
}Content copied to clipboard
Import
An existing resource can be imported using its type token, name, and identifier, e.g.
$ pulumi import azure-native:frontdoor:Policy Policy1 /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/FrontDoorWebApplicationFirewallPolicies/{policyName}Content copied to clipboard
Properties
Link copied to clipboard
The Azure API version of the resource.
Link copied to clipboard
Describes custom rules inside the policy.
Link copied to clipboard
Describes Frontend Endpoints associated with this Web Application Firewall policy.
Link copied to clipboard
Describes managed rules inside the policy.
Link copied to clipboard
Describes settings for the policy.
Link copied to clipboard
Provisioning state of the policy.
Link copied to clipboard
Link copied to clipboard
Link copied to clipboard
Link copied to clipboard
Link copied to clipboard
Describes Routing Rules associated with this Web Application Firewall policy.
Link copied to clipboard
Describes Security Policy associated with this Web Application Firewall policy.
Link copied to clipboard
The pricing tier of web application firewall policy. Defaults to Classic_AzureFrontDoor if not specified.