使用 Terraform 配置速率限制规则

本页提供使用 Terraform 在区域或账户中创建速率限制规则的示例。

如果您使用 Cloudflare API，请参考以下资源：

开始之前

获取必要的账户或区域 ID

本页提供的 Terraform 配置需要您将部署规则集的区域 ID（或账户 ID）。

要检索您有权访问的账户列表（包括其 ID），请使用列出账户操作。
要检索您有权访问的区域列表（包括其 ID），请使用列出区域操作。

导入或删除现有规则集

Terraform 假定其对账户和区域规则集拥有完全控制权。如果您的账户或区域中已配置了规则集，请执行以下操作之一：

使用 cf-terraforming 工具将现有规则集导入 Terraform。该工具的最新版本可以为现有规则集生成资源定义，并将其配置导入 Terraform 状态。
通过删除现有规则集（分别为 "kind": "root" 的账户规则集和 "kind": "zone" 的区域规则集）从头开始，然后在 Terraform 中定义您的规则集配置。

在区域级别创建速率限制规则

以下示例在 ID 为 <ZONE_ID> 的区域中创建一条速率限制规则，用于阻止超过配置速率的流量：

必需的 API 令牌权限

至少需要以下令牌权限之一：

Zone WAF Write

配置 cloudflare_ruleset ↗ resource：

resource "cloudflare_ruleset" "zone_rl" {
  zone_id     = var.cloudflare_zone_id
  name        = "Rate limiting for my zone"
  description = ""
  kind        = "zone"
  phase       = "http_ratelimit"

  rules = [{
    ref         = "rate_limit_api_requests_ip"
    description = "Rate limit API requests by IP"
    expression  = "(http.request.uri.path matches \"^/api/\")"
    action      = "block"
    ratelimit = {
      characteristics     = ["cf.colo.id", "ip.src"]
      period              = 60
      requests_per_period = 100
      mitigation_timeout  = 600
    }
  }]
}

resource "cloudflare_ruleset" "zone_rl" {
  zone_id     = "<ZONE_ID>"
  name        = "Rate limiting for my zone"
  description = ""
  kind        = "zone"
  phase       = "http_ratelimit"

  rules {
    ref         = "rate_limit_api_requests_ip"
    description = "Rate limit API requests by IP"
    expression  = "(http.request.uri.path matches \"^/api/\")"
    action      = "block"
    ratelimit {
      characteristics = ["cf.colo.id", "ip.src"]
      period = 60
      requests_per_period = 100
      mitigation_timeout = 600
    }
  }
}

要创建另一个速率限制规则，请在同一个 cloudflare_ruleset 资源中添加一个新的 rules 对象。

在账户级别创建速率限制规则

以下示例在 ID 为 <ACCOUNT_ID> 的账户中定义了一个包含单个速率限制规则的自定义规则集，该规则会阻止超过配置速率的 /api/ 路径流量。第二个 cloudflare_ruleset 资源定义了一个 execute 规则，用于为发往 example.com 的流量部署自定义规则集。

必需的 API 令牌权限

需要所有以下令牌权限：

Account WAF Write
Account Rulesets Write

配置 cloudflare_ruleset ↗ resource：

resource "cloudflare_ruleset" "account_rl" {
  account_id  = var.cloudflare_account_id
  name        = "Rate limiting rules for APIs"
  description = ""
  kind        = "custom"
  phase       = "http_ratelimit"

  rules = [{
    ref         = "rate_limit_api_ip"
    description = "Rate limit API requests by IP"
    expression  = "http.request.uri.path contains \"/api/\""
    action      = "block"
    ratelimit = {
      characteristics     = ["cf.colo.id", "ip.src"]
      period              = 60
      requests_per_period = 100
      mitigation_timeout  = 600
    }
  }]
}

# Account-level entry point ruleset for the 'http_ratelimit' phase
resource "cloudflare_ruleset" "account_rl_entrypoint" {
  account_id  = var.cloudflare_account_id
  name        = "Account-level rate limiting"
  description = ""
  kind        = "root"
  phase       = "http_ratelimit"

  depends_on = [cloudflare_ruleset.account_rl]

  rules = [{
    # Deploy the previously defined custom ruleset containing a rate limiting rule
    ref         = "deploy_rate_limit_example_com"
    description = "Deploy custom ruleset with RL rule"
    expression  = "cf.zone.name eq \"example.com\" and cf.zone.plan eq \"ENT\""
    action      = "execute"
    action_parameters = {
      id = cloudflare_ruleset.account_rl.id
    }
  }]
}

resource "cloudflare_ruleset" "account_rl" {
  account_id  = "<ACCOUNT_ID>"
  name        = "Rate limiting rules for APIs"
  description = ""
  kind        = "custom"
  phase       = "http_ratelimit"

  rules {
    ref         = "rate_limit_api_ip"
    description = "Rate limit API requests by IP"
    expression  = "http.request.uri.path contains \"/api/\""
    action      = "block"
    ratelimit {
      characteristics     = ["cf.colo.id", "ip.src"]
      period              = 60
      requests_per_period = 100
      mitigation_timeout  = 600
    }
  }
}

# Account-level entry point ruleset for the 'http_ratelimit' phase
resource "cloudflare_ruleset" "account_rl_entrypoint" {
  account_id  = "<ACCOUNT_ID>"
  name        = "Account-level rate limiting"
  description = ""
  kind        = "root"
  phase       = "http_ratelimit"

  depends_on = [cloudflare_ruleset.account_rl]

  rules {
    # Deploy the previously defined custom ruleset containing a rate limiting rule
    ref         = "deploy_rate_limit_example_com"
    description = "Deploy custom ruleset with RL rule"
    expression  = "cf.zone.name eq \"example.com\" and cf.zone.plan eq \"ENT\""
    action      = "execute"
    action_parameters {
      id = cloudflare_ruleset.account_rl.id
    }
  }
}

要创建另一个速率限制规则，请在同一个 cloudflare_ruleset 资源中添加一个新的 rules 对象。

创建高级速率限制规则

以下示例在 ID 为 <ZONE_ID> 的区域中创建速率限制规则，具有：

包含响应字段 (http.response.code) 的自定义计数表达式。
针对被速率限制的请求提供自定义 JSON 响应。

必需的 API 令牌权限

至少需要以下令牌权限之一：

Zone WAF Write

配置 cloudflare_ruleset ↗ resource：

resource "cloudflare_ruleset" "zone_rl_custom_response" {
  zone_id     = var.cloudflare_zone_id
  name        = "Advanced rate limiting rule for my zone"
  description = ""
  kind        = "zone"
  phase       = "http_ratelimit"

  rules = [{
    ref         = "rate_limit_example_com_status_404"
    description = "Rate limit requests to www.example.com when exceeding the threshold of 404 responses on /status/"
    expression  = "http.host eq \"www.example.com\" and (http.request.uri.path matches \"^/status/\")"
    action      = "block"
    action_parameters = {
      response = {
        status_code  = 429
        content      = "{\"response\": \"block\"}"
        content_type = "application/json"
      }
    }
    ratelimit = {
      characteristics     = ["ip.src", "cf.colo.id"]
      period              = 10
      requests_per_period = 5
      mitigation_timeout  = 30
      counting_expression = "(http.host eq \"www.example.com\") and (http.request.uri.path matches \"^/status/\") and (http.response.code eq 404)"
    }
  }]
}

resource "cloudflare_ruleset" "zone_rl_custom_response" {
  zone_id     = "<ZONE_ID>"
  name        = "Advanced rate limiting rule for my zone"
  description = ""
  kind        = "zone"
  phase       = "http_ratelimit"

  rules {
    ref         = "rate_limit_example_com_status_404"
    description = "Rate limit requests to www.example.com when exceeding the threshold of 404 responses on /status/"
    expression  = "http.host eq \"www.example.com\" and (http.request.uri.path matches \"^/status/\")"
    action      = "block"
    action_parameters {
      response {
        status_code  = 429
        content      = "{\"response\": \"block\"}"
        content_type = "application/json"
      }
    }
    ratelimit {
      characteristics     = ["ip.src", "cf.colo.id"]
      period              = 10
      requests_per_period = 5
      mitigation_timeout  = 30
      counting_expression = "(http.host eq \"www.example.com\") and (http.request.uri.path matches \"^/status/\") and (http.response.code eq 404)"
    }
  }
}

要创建另一个速率限制规则，请在同一个 cloudflare_ruleset 资源中添加一个新的 rules 对象。