Policy
data class PolicyArgs(val customRules: Output<CustomRuleListArgs>? = null, val location: Output<String>? = null, val managedRules: Output<ManagedRuleSetListArgs>? = null, val policyName: Output<String>? = null, val policySettings: Output<PolicySettingsArgs>? = null, val resourceGroupName: Output<String>? = null, val sku: Output<SkuArgs>? = null, val tags: Output<Map<String, String>>? = null) : ConvertibleToJava<PolicyArgs>
Defines web application firewall policy. Uses Azure REST API version 2024-02-01. Other available API versions: 2019-03-01, 2019-10-01, 2020-04-01, 2020-11-01, 2021-06-01, 2022-05-01, 2025-03-01. These can be accessed by generating a local SDK package using the CLI command pulumi package add azure-native frontdoor [ApiVersion]. See the ../../../version-guide/#accessing-any-api-version-via-local-packages for details.
Example Usage
Creates specific policy
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AzureNative = Pulumi.AzureNative;
return await Deployment.RunAsync(() =>
{
var policy = new AzureNative.FrontDoor.Policy("policy", new()
{
CustomRules = new AzureNative.FrontDoor.Inputs.CustomRuleListArgs
{
Rules = new[]
{
new AzureNative.FrontDoor.Inputs.CustomRuleArgs
{
Action = AzureNative.FrontDoor.ActionType.Block,
MatchConditions = new[]
{
new AzureNative.FrontDoor.Inputs.MatchConditionArgs
{
MatchValue = new[]
{
"192.168.1.0/24",
"10.0.0.0/24",
},
MatchVariable = AzureNative.FrontDoor.MatchVariable.RemoteAddr,
Operator = AzureNative.FrontDoor.Operator.IPMatch,
},
},
Name = "Rule1",
Priority = 1,
RateLimitThreshold = 1000,
RuleType = AzureNative.FrontDoor.RuleType.RateLimitRule,
},
new AzureNative.FrontDoor.Inputs.CustomRuleArgs
{
Action = AzureNative.FrontDoor.ActionType.Block,
MatchConditions = new[]
{
new AzureNative.FrontDoor.Inputs.MatchConditionArgs
{
MatchValue = new[]
{
"CH",
},
MatchVariable = AzureNative.FrontDoor.MatchVariable.RemoteAddr,
Operator = AzureNative.FrontDoor.Operator.GeoMatch,
},
new AzureNative.FrontDoor.Inputs.MatchConditionArgs
{
MatchValue = new[]
{
"windows",
},
MatchVariable = AzureNative.FrontDoor.MatchVariable.RequestHeader,
Operator = AzureNative.FrontDoor.Operator.Contains,
Selector = "UserAgent",
Transforms = new[]
{
AzureNative.FrontDoor.TransformType.Lowercase,
},
},
},
Name = "Rule2",
Priority = 2,
RuleType = AzureNative.FrontDoor.RuleType.MatchRule,
},
},
},
Location = "WestUs",
ManagedRules = new AzureNative.FrontDoor.Inputs.ManagedRuleSetListArgs
{
ManagedRuleSets = new[]
{
new AzureNative.FrontDoor.Inputs.ManagedRuleSetArgs
{
Exclusions = new[]
{
new AzureNative.FrontDoor.Inputs.ManagedRuleExclusionArgs
{
MatchVariable = AzureNative.FrontDoor.ManagedRuleExclusionMatchVariable.RequestHeaderNames,
Selector = "User-Agent",
SelectorMatchOperator = AzureNative.FrontDoor.ManagedRuleExclusionSelectorMatchOperator.EqualsValue,
},
},
RuleGroupOverrides = new[]
{
new AzureNative.FrontDoor.Inputs.ManagedRuleGroupOverrideArgs
{
Exclusions = new[]
{
new AzureNative.FrontDoor.Inputs.ManagedRuleExclusionArgs
{
MatchVariable = AzureNative.FrontDoor.ManagedRuleExclusionMatchVariable.RequestCookieNames,
Selector = "token",
SelectorMatchOperator = AzureNative.FrontDoor.ManagedRuleExclusionSelectorMatchOperator.StartsWith,
},
},
RuleGroupName = "SQLI",
Rules = new[]
{
new AzureNative.FrontDoor.Inputs.ManagedRuleOverrideArgs
{
Action = AzureNative.FrontDoor.ActionType.Redirect,
EnabledState = AzureNative.FrontDoor.ManagedRuleEnabledState.Enabled,
Exclusions = new[]
{
new AzureNative.FrontDoor.Inputs.ManagedRuleExclusionArgs
{
MatchVariable = AzureNative.FrontDoor.ManagedRuleExclusionMatchVariable.QueryStringArgNames,
Selector = "query",
SelectorMatchOperator = AzureNative.FrontDoor.ManagedRuleExclusionSelectorMatchOperator.EqualsValue,
},
},
RuleId = "942100",
},
new AzureNative.FrontDoor.Inputs.ManagedRuleOverrideArgs
{
EnabledState = AzureNative.FrontDoor.ManagedRuleEnabledState.Disabled,
RuleId = "942110",
},
},
},
},
RuleSetAction = AzureNative.FrontDoor.ManagedRuleSetActionType.Block,
RuleSetType = "DefaultRuleSet",
RuleSetVersion = "1.0",
},
},
},
PolicyName = "Policy1",
PolicySettings = new AzureNative.FrontDoor.Inputs.PolicySettingsArgs
{
CustomBlockResponseBody = "PGh0bWw+CjxoZWFkZXI+PHRpdGxlPkhlbGxvPC90aXRsZT48L2hlYWRlcj4KPGJvZHk+CkhlbGxvIHdvcmxkCjwvYm9keT4KPC9odG1sPg==",
CustomBlockResponseStatusCode = 429,
EnabledState = AzureNative.FrontDoor.PolicyEnabledState.Enabled,
JavascriptChallengeExpirationInMinutes = 30,
Mode = AzureNative.FrontDoor.PolicyMode.Prevention,
RedirectUrl = "http://www.bing.com",
RequestBodyCheck = AzureNative.FrontDoor.PolicyRequestBodyCheck.Disabled,
ScrubbingRules = new[]
{
new AzureNative.FrontDoor.Inputs.WebApplicationFirewallScrubbingRulesArgs
{
MatchVariable = AzureNative.FrontDoor.ScrubbingRuleEntryMatchVariable.RequestIPAddress,
SelectorMatchOperator = AzureNative.FrontDoor.ScrubbingRuleEntryMatchOperator.EqualsAny,
State = AzureNative.FrontDoor.ScrubbingRuleEntryState.Enabled,
},
},
State = AzureNative.FrontDoor.WebApplicationFirewallScrubbingState.Enabled,
},
ResourceGroupName = "rg1",
Sku = new AzureNative.FrontDoor.Inputs.SkuArgs
{
Name = AzureNative.FrontDoor.SkuName.Premium_AzureFrontDoor,
},
});
});Content copied to clipboard
package main
import (
frontdoor "github.com/pulumi/pulumi-azure-native-sdk/frontdoor/v3"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := frontdoor.NewPolicy(ctx, "policy", &frontdoor.PolicyArgs{
CustomRules: &frontdoor.CustomRuleListArgs{
Rules: frontdoor.CustomRuleArray{
&frontdoor.CustomRuleArgs{
Action: pulumi.String(frontdoor.ActionTypeBlock),
MatchConditions: frontdoor.MatchConditionArray{
&frontdoor.MatchConditionArgs{
MatchValue: pulumi.StringArray{
pulumi.String("192.168.1.0/24"),
pulumi.String("10.0.0.0/24"),
},
MatchVariable: pulumi.String(frontdoor.MatchVariableRemoteAddr),
Operator: pulumi.String(frontdoor.OperatorIPMatch),
},
},
Name: pulumi.String("Rule1"),
Priority: pulumi.Int(1),
RateLimitThreshold: pulumi.Int(1000),
RuleType: pulumi.String(frontdoor.RuleTypeRateLimitRule),
},
&frontdoor.CustomRuleArgs{
Action: pulumi.String(frontdoor.ActionTypeBlock),
MatchConditions: frontdoor.MatchConditionArray{
&frontdoor.MatchConditionArgs{
MatchValue: pulumi.StringArray{
pulumi.String("CH"),
},
MatchVariable: pulumi.String(frontdoor.MatchVariableRemoteAddr),
Operator: pulumi.String(frontdoor.OperatorGeoMatch),
},
&frontdoor.MatchConditionArgs{
MatchValue: pulumi.StringArray{
pulumi.String("windows"),
},
MatchVariable: pulumi.String(frontdoor.MatchVariableRequestHeader),
Operator: pulumi.String(frontdoor.OperatorContains),
Selector: pulumi.String("UserAgent"),
Transforms: pulumi.StringArray{
pulumi.String(frontdoor.TransformTypeLowercase),
},
},
},
Name: pulumi.String("Rule2"),
Priority: pulumi.Int(2),
RuleType: pulumi.String(frontdoor.RuleTypeMatchRule),
},
},
},
Location: pulumi.String("WestUs"),
ManagedRules: &frontdoor.ManagedRuleSetListArgs{
ManagedRuleSets: frontdoor.ManagedRuleSetArray{
&frontdoor.ManagedRuleSetArgs{
Exclusions: frontdoor.ManagedRuleExclusionArray{
&frontdoor.ManagedRuleExclusionArgs{
MatchVariable: pulumi.String(frontdoor.ManagedRuleExclusionMatchVariableRequestHeaderNames),
Selector: pulumi.String("User-Agent"),
SelectorMatchOperator: pulumi.String(frontdoor.ManagedRuleExclusionSelectorMatchOperatorEquals),
},
},
RuleGroupOverrides: frontdoor.ManagedRuleGroupOverrideArray{
&frontdoor.ManagedRuleGroupOverrideArgs{
Exclusions: frontdoor.ManagedRuleExclusionArray{
&frontdoor.ManagedRuleExclusionArgs{
MatchVariable: pulumi.String(frontdoor.ManagedRuleExclusionMatchVariableRequestCookieNames),
Selector: pulumi.String("token"),
SelectorMatchOperator: pulumi.String(frontdoor.ManagedRuleExclusionSelectorMatchOperatorStartsWith),
},
},
RuleGroupName: pulumi.String("SQLI"),
Rules: frontdoor.ManagedRuleOverrideArray{
&frontdoor.ManagedRuleOverrideArgs{
Action: pulumi.String(frontdoor.ActionTypeRedirect),
EnabledState: pulumi.String(frontdoor.ManagedRuleEnabledStateEnabled),
Exclusions: frontdoor.ManagedRuleExclusionArray{
&frontdoor.ManagedRuleExclusionArgs{
MatchVariable: pulumi.String(frontdoor.ManagedRuleExclusionMatchVariableQueryStringArgNames),
Selector: pulumi.String("query"),
SelectorMatchOperator: pulumi.String(frontdoor.ManagedRuleExclusionSelectorMatchOperatorEquals),
},
},
RuleId: pulumi.String("942100"),
},
&frontdoor.ManagedRuleOverrideArgs{
EnabledState: pulumi.String(frontdoor.ManagedRuleEnabledStateDisabled),
RuleId: pulumi.String("942110"),
},
},
},
},
RuleSetAction: pulumi.String(frontdoor.ManagedRuleSetActionTypeBlock),
RuleSetType: pulumi.String("DefaultRuleSet"),
RuleSetVersion: pulumi.String("1.0"),
},
},
},
PolicyName: pulumi.String("Policy1"),
PolicySettings: &frontdoor.PolicySettingsArgs{
CustomBlockResponseBody: pulumi.String("PGh0bWw+CjxoZWFkZXI+PHRpdGxlPkhlbGxvPC90aXRsZT48L2hlYWRlcj4KPGJvZHk+CkhlbGxvIHdvcmxkCjwvYm9keT4KPC9odG1sPg=="),
CustomBlockResponseStatusCode: pulumi.Int(429),
EnabledState: pulumi.String(frontdoor.PolicyEnabledStateEnabled),
JavascriptChallengeExpirationInMinutes: pulumi.Int(30),
Mode: pulumi.String(frontdoor.PolicyModePrevention),
RedirectUrl: pulumi.String("http://www.bing.com"),
RequestBodyCheck: pulumi.String(frontdoor.PolicyRequestBodyCheckDisabled),
ScrubbingRules: frontdoor.WebApplicationFirewallScrubbingRulesArray{
&frontdoor.WebApplicationFirewallScrubbingRulesArgs{
MatchVariable: pulumi.String(frontdoor.ScrubbingRuleEntryMatchVariableRequestIPAddress),
SelectorMatchOperator: pulumi.String(frontdoor.ScrubbingRuleEntryMatchOperatorEqualsAny),
State: pulumi.String(frontdoor.ScrubbingRuleEntryStateEnabled),
},
},
State: pulumi.String(frontdoor.WebApplicationFirewallScrubbingStateEnabled),
},
ResourceGroupName: pulumi.String("rg1"),
Sku: &frontdoor.SkuArgs{
Name: pulumi.String(frontdoor.SkuName_Premium_AzureFrontDoor),
},
})
if err != nil {
return err
}
return nil
})
}Content copied to clipboard
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azurenative.frontdoor.Policy;
import com.pulumi.azurenative.frontdoor.PolicyArgs;
import com.pulumi.azurenative.frontdoor.inputs.CustomRuleListArgs;
import com.pulumi.azurenative.frontdoor.inputs.ManagedRuleSetListArgs;
import com.pulumi.azurenative.frontdoor.inputs.PolicySettingsArgs;
import com.pulumi.azurenative.frontdoor.inputs.SkuArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var policy = new Policy("policy", PolicyArgs.builder()
.customRules(CustomRuleListArgs.builder()
.rules(
CustomRuleArgs.builder()
.action("Block")
.matchConditions(MatchConditionArgs.builder()
.matchValue(
"192.168.1.0/24",
"10.0.0.0/24")
.matchVariable("RemoteAddr")
.operator("IPMatch")
.build())
.name("Rule1")
.priority(1)
.rateLimitThreshold(1000)
.ruleType("RateLimitRule")
.build(),
CustomRuleArgs.builder()
.action("Block")
.matchConditions(
MatchConditionArgs.builder()
.matchValue("CH")
.matchVariable("RemoteAddr")
.operator("GeoMatch")
.build(),
MatchConditionArgs.builder()
.matchValue("windows")
.matchVariable("RequestHeader")
.operator("Contains")
.selector("UserAgent")
.transforms("Lowercase")
.build())
.name("Rule2")
.priority(2)
.ruleType("MatchRule")
.build())
.build())
.location("WestUs")
.managedRules(ManagedRuleSetListArgs.builder()
.managedRuleSets(ManagedRuleSetArgs.builder()
.exclusions(ManagedRuleExclusionArgs.builder()
.matchVariable("RequestHeaderNames")
.selector("User-Agent")
.selectorMatchOperator("Equals")
.build())
.ruleGroupOverrides(ManagedRuleGroupOverrideArgs.builder()
.exclusions(ManagedRuleExclusionArgs.builder()
.matchVariable("RequestCookieNames")
.selector("token")
.selectorMatchOperator("StartsWith")
.build())
.ruleGroupName("SQLI")
.rules(
ManagedRuleOverrideArgs.builder()
.action("Redirect")
.enabledState("Enabled")
.exclusions(ManagedRuleExclusionArgs.builder()
.matchVariable("QueryStringArgNames")
.selector("query")
.selectorMatchOperator("Equals")
.build())
.ruleId("942100")
.build(),
ManagedRuleOverrideArgs.builder()
.enabledState("Disabled")
.ruleId("942110")
.build())
.build())
.ruleSetAction("Block")
.ruleSetType("DefaultRuleSet")
.ruleSetVersion("1.0")
.build())
.build())
.policyName("Policy1")
.policySettings(PolicySettingsArgs.builder()
.customBlockResponseBody("PGh0bWw+CjxoZWFkZXI+PHRpdGxlPkhlbGxvPC90aXRsZT48L2hlYWRlcj4KPGJvZHk+CkhlbGxvIHdvcmxkCjwvYm9keT4KPC9odG1sPg==")
.customBlockResponseStatusCode(429)
.enabledState("Enabled")
.javascriptChallengeExpirationInMinutes(30)
.mode("Prevention")
.redirectUrl("http://www.bing.com")
.requestBodyCheck("Disabled")
.scrubbingRules(WebApplicationFirewallScrubbingRulesArgs.builder()
.matchVariable("RequestIPAddress")
.selectorMatchOperator("EqualsAny")
.state("Enabled")
.build())
.state("Enabled")
.build())
.resourceGroupName("rg1")
.sku(SkuArgs.builder()
.name("Premium_AzureFrontDoor")
.build())
.build());
}
}Content copied to clipboard
Import
An existing resource can be imported using its type token, name, and identifier, e.g.
$ pulumi import azure-native:frontdoor:Policy Policy1 /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/FrontDoorWebApplicationFirewallPolicies/{policyName}Content copied to clipboard
Constructors
Link copied to clipboard
constructor(customRules: Output<CustomRuleListArgs>? = null, location: Output<String>? = null, managedRules: Output<ManagedRuleSetListArgs>? = null, policyName: Output<String>? = null, policySettings: Output<PolicySettingsArgs>? = null, resourceGroupName: Output<String>? = null, sku: Output<SkuArgs>? = null, tags: Output<Map<String, String>>? = null)
Properties
Link copied to clipboard
Describes custom rules inside the policy.
Link copied to clipboard
Describes managed rules inside the policy.
Link copied to clipboard
The name of the Web Application Firewall Policy.
Link copied to clipboard
Describes settings for the policy.
Link copied to clipboard
Name of the Resource group within the Azure subscription.