部署托管规则集

你可以在 zone 级别或账户级别部署托管规则集。要将托管规则集部署到某个阶段，请使用 Rulesets API。

如果你使用 Terraform，请参阅使用 Terraform 配置 WAF 托管规则了解更多信息。

如果你使用 Cloudflare 仪表板，请参阅以下页面：

在 zone 级别将托管规则集部署到阶段

使用以下工作流，在 zone 级别将托管规则集部署到某个阶段。

获取你的 zone ID。
调用 List account rulesets 操作以获取可用的托管规则集。托管规则集存在于账户级别，但你可以将其部署到 zone。找到要部署的托管规则集的规则集 ID。
确定要将托管规则集部署到的阶段。确保托管规则集属于你要部署到的同一阶段。
向 zone 级别阶段的入口点规则集添加一条执行该托管规则集的规则。有关此步骤的详细信息，请参阅以下示例。

示例

以下示例通过创建一个执行托管规则集的规则，将 Cloudflare Managed Ruleset 部署到给定区域（$ZONE_ID）的 http_request_firewall_managed 阶段。

调用获取区域入口点规则集操作，以获取 http_request_firewall_managed 阶段的入口点规则集定义。您需要有区域 ID才能完成此任务。

Get a zone entry point rulesetbash

curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/rulesets/phases/http_request_firewall_managed/entrypoint" \
	--request GET \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN"

{
	"result": {
		"description": "Zone-level phase entry point",
		"id": "<RULESET_ID>",
		"kind": "zone",
		"last_updated": "2024-03-16T15:40:08.202335Z",
		"name": "zone",
		"phase": "http_request_firewall_managed",
		"rules": [
			// ...
		],
		"source": "firewall_managed",
		"version": "10"
	},
	"success": true,
	"errors": [],
	"messages": []
}

如果入口点规则集已存在（即，如果您收到 200 OK 状态代码和规则集定义），请记下响应中的规则集 ID。然后，调用创建区域规则集规则操作，向现有规则集中添加一条 execute 规则，以部署 Cloudflare Managed Ruleset（ID 为 efb7b8c949ac4650a09736fc376e9aee）。默认情况下，该规则将添加到规则集中已有规则列表的末尾。

Create a zone ruleset rulebash

curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/rulesets/$RULESET_ID/rules" \
	--request POST \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"action": "execute",
		"action_parameters": {
				"id": "efb7b8c949ac4650a09736fc376e9aee"
		},
		"expression": "true",
		"description": "Execute the Cloudflare Managed Ruleset"
	}'

{
	"result": {
		"id": "<RULESET_ID>",
		"name": "Zone-level phase entry point",
		"description": "",
		"kind": "zone",
		"version": "11",
		"rules": [
			// ... any existing rules
			{
				"id": "<RULE_ID>",
				"version": "1",
				"action": "execute",
				"action_parameters": {
					"id": "efb7b8c949ac4650a09736fc376e9aee",
					"version": "latest"
				},
				"expression": "true",
				"description": "Execute the Cloudflare Managed Ruleset",
				"last_updated": "2024-03-18T18:08:14.003361Z",
				"ref": "<RULE_REF>",
				"enabled": true
			}
		],
		"last_updated": "2024-03-18T18:08:14.003361Z",
		"phase": "http_request_firewall_managed"
	},
	"success": true,
	"errors": [],
	"messages": []
}

如果入口点规则集不存在（也就是说，如果您在步骤 1 中收到了 404 Not Found 状态码），请使用创建区域规则集操作来创建它。在 rules 数组中包含单个规则，该规则针对区域中的所有传入请求执行 Cloudflare Managed Ruleset（ID 为 efb7b8c949ac4650a09736fc376e9aee）。

Create a zone rulesetbash

curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/rulesets" \
	--request POST \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"name": "My ruleset",
		"description": "Entry point ruleset for WAF managed rulesets",
		"kind": "zone",
		"phase": "http_request_firewall_managed",
		"rules": [
				{
						"action": "execute",
						"action_parameters": {
								"id": "efb7b8c949ac4650a09736fc376e9aee"
						},
						"expression": "true",
						"description": "Execute the Cloudflare Managed Ruleset"
				}
		]
	}'

在此示例中，托管规则集执行 Cloudflare 配置的行为。要自定义托管规则集的行为，请参阅覆盖托管规则集。

在账户级别将托管规则集部署到阶段

使用以下工作流，在账户级别将托管规则集部署到某个阶段。

获取你的账户 ID。
调用 List account rulesets 操作以获取可用的托管规则集。找到要部署的托管规则集的规则集 ID。
确定要将托管规则集部署到的阶段。确保托管规则集属于你要部署到的同一阶段。
向账户级别阶段的入口点规则集添加一条执行该托管规则集的规则。使用括号将规则表达式中的任何自定义条件括起来，并在表达式末尾加上 and cf.zone.plan eq "ENT"，使其仅应用于 Enterprise 计划的 zone。有关此步骤的详细信息，请参阅以下示例。

示例

以下示例通过创建一个执行托管规则集的规则，将 Cloudflare Managed Ruleset 部署到给定账户（$ACCOUNT_ID）的 http_request_firewall_managed 阶段：当区域名称与 example.com 或 anotherexample.com 之一匹配时，将执行托管规则集中的规则。

调用获取账户入口点规则集操作，以获取 http_request_firewall_managed 阶段的入口点规则集定义。您将需要账户 ID来执行此任务。

Required API token permissions

At least one of the following token permissions is required:

Account WAF Write
Account WAF Read
Account Rulesets Read
Account Rulesets Write

Get an account entry point rulesetbash

curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/rulesets/phases/http_request_firewall_managed/entrypoint" \
	--request GET \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN"

{
	"result": {
		"description": "Account-level phase entry point",
		"id": "<RULESET_ID>",
		"kind": "root",
		"last_updated": "2024-03-16T15:40:08.202335Z",
		"name": "root",
		"phase": "http_request_firewall_managed",
		"rules": [
			// ...
		],
		"source": "firewall_managed",
		"version": "10"
	},
	"success": true,
	"errors": [],
	"messages": []
}

如果入口点规则集已存在（即，如果您收到 200 OK 状态代码和规则集定义），请记下响应中的规则集 ID。然后，调用创建账户规则集规则操作，向现有规则集中添加一条 execute 规则，以部署 Cloudflare Managed Ruleset（ID 为 efb7b8c949ac4650a09736fc376e9aee）。默认情况下，该规则将添加到规则集中已有规则列表的末尾。

Required API token permissions

At least one of the following token permissions is required:

Account WAF Write
Account Rulesets Write

Create an account ruleset rulebash

curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/rulesets/$RULESET_ID/rules" \
	--request POST \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"action": "execute",
		"action_parameters": {
				"id": "efb7b8c949ac4650a09736fc376e9aee"
		},
		"expression": "(cf.zone.name in {\"example.com\" \"anotherexample.com\"}) and cf.zone.plan eq \"ENT\"",
		"description": "Execute the Cloudflare Managed Ruleset"
	}'

{
	"result": {
		"id": "<RULESET_ID>",
		"name": "Account-level phase entry point",
		"description": "",
		"kind": "root",
		"version": "11",
		"rules": [
			// ... any existing rules
			{
				"id": "<RULE_ID>",
				"version": "1",
				"action": "execute",
				"action_parameters": {
					"id": "efb7b8c949ac4650a09736fc376e9aee",
					"version": "latest"
				},
				"expression": "(cf.zone.name in {\"example.com\" \"anotherexample.com\"}) and cf.zone.plan eq \"ENT\"",
				"description": "Execute the Cloudflare Managed Ruleset",
				"last_updated": "2024-03-18T18:30:08.122758Z",
				"ref": "<RULE_REF>",
				"enabled": true
			}
		],
		"last_updated": "2024-03-18T18:30:08.122758Z",
		"phase": "http_request_firewall_managed"
	},
	"success": true,
	"errors": [],
	"messages": []
}

如果入口点规则集不存在（即，如果您在第 1 步中收到 404 Not Found 状态代码），请使用创建账户规则集操作来创建它。在 rules 数组中包含一条单一规则，以便为区域名称匹配 example.com 或 anotherexample.com 之一的所有传入请求执行 Cloudflare Managed Ruleset（ID 为 efb7b8c949ac4650a09736fc376e9aee）。

Required API token permissions

At least one of the following token permissions is required:

Account WAF Write
Account Rulesets Write

Create an account rulesetbash

curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/rulesets" \
	--request POST \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"name": "My ruleset",
		"description": "Entry point ruleset for WAF managed rulesets",
		"kind": "root",
		"phase": "http_request_firewall_managed",
		"rules": [
				{
						"action": "execute",
						"action_parameters": {
								"id": "efb7b8c949ac4650a09736fc376e9aee"
						},
						"expression": "(cf.zone.name in {\"example.com\" \"anotherexample.com\"}) and cf.zone.plan eq \"ENT\"",
						"description": "Execute the Cloudflare Managed Ruleset"
				}
		]
	}'

在此示例中，托管规则集执行 Cloudflare 配置的行为。要了解如何自定义托管规则集的行为，请参阅覆盖托管规则集。