使用 Terraform 配置 WAF 托管规则

本页提供使用 Terraform 在区域或账户中部署和配置 WAF 托管规则的示例。它涵盖以下配置：

在区域级别部署托管规则集
在账户级别部署托管规则集
配置例外
配置有效负载日志记录
配置覆盖
配置 OWASP 偏执级别（paranoia level）、分数阈值和操作

如果您使用 Cloudflare API，请参考以下资源：

有关使用规则集 API 部署和配置托管规则集的更多信息，请参考规则集引擎文档中的使用托管规则集。

开始之前

获取必要的账户、区域和托管规则集 ID

本页提供的 Terraform 配置需要您将部署托管规则集的区域 ID（或账户 ID）。

要检索您有权访问的账户列表（包括其 ID），请使用列出账户操作。
要检索您有权访问的区域列表（包括其 ID），请使用列出区域操作。

通过 Terraform 部署托管规则集需要使用规则集 ID。要查找托管规则集的 ID，请使用列出账户规则集操作。响应将包含现有托管规则集的描述和 ID。

WAF 托管规则集的 ID 也可从 WAF 托管规则页面获取。

导入或删除现有规则集

Terraform 假定其对账户和区域规则集拥有完全控制权。如果您的账户或区域中已配置了规则集，请执行以下操作之一：

使用 cf-terraforming 工具将现有规则集导入 Terraform。该工具的最新版本可以为现有规则集生成资源定义，并将其配置导入 Terraform 状态。
通过删除现有规则集（分别为 "kind": "root" 的账户规则集和 "kind": "zone" 的区域规则集）从头开始，然后在 Terraform 中定义您的规则集配置。

在区域级别部署托管规则集

以下示例使用 Terraform 将两个托管规则集部署到 ID 为 <ZONE_ID> 的区域，该示例使用了一个具有两条规则的 cloudflare_ruleset 资源，以执行这些托管规则集。

必需的 API 令牌权限

至少需要以下令牌权限之一：

Zone WAF Write

配置 cloudflare_ruleset ↗ resource：

# Configure a ruleset at the zone level for the "http_request_firewall_managed" phase
resource "cloudflare_ruleset" "zone_level_managed_waf" {
  zone_id     = var.cloudflare_zone_id
  name        = "Managed WAF entry point ruleset"
  description = "Zone-level WAF Managed Rules config"
  kind        = "zone"
  phase       = "http_request_firewall_managed"

  rules = [
    {
      # Execute Cloudflare Managed Ruleset
      ref         = "execute_cloudflare_managed_ruleset"
      description = "Execute Cloudflare Managed Ruleset on my zone-level phase entry point ruleset"
      expression  = "true"
      action      = "execute"
      action_parameters = {
        id = "efb7b8c949ac4650a09736fc376e9aee"
      }
    },
    {
      # Execute Cloudflare OWASP Core Ruleset
      ref         = "execute_cloudflare_owasp_core_ruleset"
      description = "Execute Cloudflare OWASP Core Ruleset on my zone-level phase entry point ruleset"
      expression  = "true"
      action      = "execute"
      action_parameters = {
        id = "4814384a9e5d4991b9815dcfc25d2f1f"
      }
    },
  ]
}

# Configure a ruleset at the zone level for the "http_request_firewall_managed" phase
resource "cloudflare_ruleset" "zone_level_managed_waf" {
  zone_id     = "<ZONE_ID>"
  name        = "Managed WAF entry point ruleset"
  description = "Zone-level WAF Managed Rules config"
  kind        = "zone"
  phase       = "http_request_firewall_managed"

  # Execute Cloudflare Managed Ruleset
  rules {
    ref         = "execute_cloudflare_managed_ruleset"
    description = "Execute Cloudflare Managed Ruleset on my zone-level phase entry point ruleset"
    expression  = "true"
    action      = "execute"
    action_parameters {
      id = "efb7b8c949ac4650a09736fc376e9aee"
    }
  }

  # Execute Cloudflare OWASP Core Ruleset
  rules {
    ref         = "execute_cloudflare_owasp_core_ruleset"
    description = "Execute Cloudflare OWASP Core Ruleset on my zone-level phase entry point ruleset"
    expression  = "true"
    action      = "execute"
    action_parameters {
      id = "4814384a9e5d4991b9815dcfc25d2f1f"
    }
  }
}

在账户级别部署托管规则集

以下示例使用 Terraform 将两个托管规则集部署到 ID 为 <ACCOUNT_ID> 的账户，该示例使用了一个具有两条规则的 cloudflare_ruleset 资源，这些规则为属于 Enterprise 区域的两个主机名执行了托管规则集。

必需的 API 令牌权限

需要所有以下令牌权限：

Account WAF Write
Account Rulesets Write

配置 cloudflare_ruleset ↗ resource：

resource "cloudflare_ruleset" "account_level_managed_waf" {
  account_id  = var.cloudflare_account_id
  name        = "Managed WAF entry point ruleset"
  description = "Account-level WAF Managed Rules config"
  kind        = "root"
  phase       = "http_request_firewall_managed"

  rules = [
    {
      # Execute Cloudflare Managed Ruleset
      ref         = "execute_cloudflare_managed_ruleset_api_store"
      description = "Execute Cloudflare Managed Ruleset on my account-level phase entry point ruleset"
      expression  = "http.host in {\"api.example.com\" \"store.example.com\"} and cf.zone.plan eq \"ENT\""
      action      = "execute"
      action_parameters = {
        id = "efb7b8c949ac4650a09736fc376e9aee"
      }
    },
    {
      # Execute Cloudflare OWASP Core Ruleset
      ref         = "execute_owasp_core_ruleset_api_store"
      description = "Execute Cloudflare OWASP Core Ruleset on my account-level phase entry point ruleset"
      expression  = "http.host in {\"api.example.com\" \"store.example.com\"} and cf.zone.plan eq \"ENT\""
      action      = "execute"
      action_parameters = {
        id = "4814384a9e5d4991b9815dcfc25d2f1f"
      }
    },
  ]
}

resource "cloudflare_ruleset" "account_level_managed_waf" {
  account_id  = "<ACCOUNT_ID>"
  name        = "Managed WAF entry point ruleset"
  description = "Account-level WAF Managed Rules config"
  kind        = "root"
  phase       = "http_request_firewall_managed"

  # Execute Cloudflare Managed Ruleset
  rules {
    ref         = "execute_cloudflare_managed_ruleset_api_store"
    description = "Execute Cloudflare Managed Ruleset on my account-level phase entry point ruleset"
    expression  = "http.host in {\"api.example.com\" \"store.example.com\"} and cf.zone.plan eq \"ENT\""
    action      = "execute"
    action_parameters {
      id = "efb7b8c949ac4650a09736fc376e9aee"
    }
  }

  # Execute Cloudflare OWASP Core Ruleset
  rules {
    ref         = "execute_owasp_core_ruleset_api_store"
    description = "Execute Cloudflare OWASP Core Ruleset on my account-level phase entry point ruleset"
    expression  = "http.host in {\"api.example.com\" \"store.example.com\"} and cf.zone.plan eq \"ENT\""
    action      = "execute"
    action_parameters {
      id = "4814384a9e5d4991b9815dcfc25d2f1f"
    }
  }
}

配置例外

以下示例为 Cloudflare 托管规则集添加了两个例外：

第一条规则将根据规则表达式，针对特定 URL 跳过整个 Cloudflare 托管规则集（ID 为）的执行。
第二条规则将根据规则表达式，针对特定 URL 跳过属于 Cloudflare 托管规则集中的两条规则的执行。

将这两个例外添加到 cloudflare_ruleset 资源中，位于部署 Cloudflare 托管规则集的规则之前：

resource "cloudflare_ruleset" "zone_level_managed_waf" {
  # (...)

  rules = [
    {
      # Skip execution of the entire Cloudflare Managed Ruleset for specific URLs
      ref         = "skip_cloudflare_managed_ruleset_example_com"
      description = "Skip Cloudflare Managed Ruleset"
      expression  = "(http.request.uri.path eq \"/status\" and http.request.uri.query contains \"skip=rulesets\")"
      action      = "skip"
      action_parameters = {
        rulesets = ["efb7b8c949ac4650a09736fc376e9aee"]
      }
    },
    {
      # Skip execution of two rules in the Cloudflare Managed Ruleset for specific URLs
      ref         = "skip_wordpress_sqli_rules_example_com"
      description = "Skip WordPress and SQLi rules"
      expression  = "(http.request.uri.path eq \"/status\" and http.request.uri.query contains \"skip=rules\")"
      action      = "skip"
      action_parameters = {
        rules = {
          # Format: "<RULESET_ID>" = ["<RULE_ID_1>", "<RULE_ID_2>"]
          "efb7b8c949ac4650a09736fc376e9aee" = ["5de7edfa648c4d6891dc3e7f84534ffa", "e3a567afc347477d9702d9047e97d760"]
        }
      }
    },
    {
      # Execute Cloudflare Managed Ruleset
      ref         = "execute_cloudflare_managed_ruleset"
      description = "Execute Cloudflare Managed Ruleset on my zone-level phase entry point ruleset"
      expression  = "true"
      action      = "execute"
      action_parameters = {
        id = "efb7b8c949ac4650a09736fc376e9aee"
      }
    },
    # (...)
  ]
}

resource "cloudflare_ruleset" "zone_level_managed_waf" {
  # (...)

  # Skip execution of the entire Cloudflare Managed Ruleset for specific URLs
  rules {
    ref         = "skip_cloudflare_managed_ruleset_example_com"
    description = "Skip Cloudflare Managed Ruleset"
    expression  = "(http.request.uri.path eq \"/status\" and http.request.uri.query contains \"skip=rulesets\")"
    action      = "skip"
    action_parameters {
      rulesets = ["efb7b8c949ac4650a09736fc376e9aee"]
    }
  }

  # Skip execution of two rules in the Cloudflare Managed Ruleset for specific URLs
  rules {
    ref         = "skip_wordpress_sqli_rules_example_com"
    description = "Skip WordPress and SQLi rules"
    expression  = "(http.request.uri.path eq \"/status\" and http.request.uri.query contains \"skip=rules\")"
    action      = "skip"
    action_parameters {
      rules = {
        # Format: "<RULESET_ID>" = "<RULE_ID_1>,<RULE_ID_2>,..."
        "efb7b8c949ac4650a09736fc376e9aee" = "5de7edfa648c4d6891dc3e7f84534ffa,e3a567afc347477d9702d9047e97d760"
      }
    }
  }

  # Execute Cloudflare Managed Ruleset
  rules {
    ref         = "execute_cloudflare_managed_ruleset"
    description = "Execute Cloudflare Managed Ruleset on my zone-level phase entry point ruleset"
    expression  = "true"
    action      = "execute"
    action_parameters {
      id = "efb7b8c949ac4650a09736fc376e9aee"
    }
  }

  # (...)
}

配置覆盖

以下示例为 Cloudflare 托管规则集添加了三个覆盖：

为 ID 为 5de7edfa648c4d6891dc3e7f84534ffa 的规则添加规则覆盖，将操作设置为 log。
为 ID 为 75a0060762034a6cb663fd51a02344cb 的规则添加规则覆盖，禁用该规则。
为 wordpress 标签添加标签覆盖，将带有此标签的所有规则的操作设置为 js_challenge。

以下配置在执行 Cloudflare 托管规则集的规则中包含这三个覆盖：

  # (...)

  # Execute Cloudflare Managed Ruleset
  rules = [{
    ref         = "execute_cloudflare_managed_ruleset"
    description = "Execute Cloudflare Managed Ruleset on my zone-level phase entry point ruleset"
    expression  = "true"
    action      = "execute"
    action_parameters = {
      id = "efb7b8c949ac4650a09736fc376e9aee"
      overrides = {
        rules = [
          {
            id      = "5de7edfa648c4d6891dc3e7f84534ffa"
            action  = "log"
            enabled = true
          },
          {
            id      = "75a0060762034a6cb663fd51a02344cb"
            enabled = false
          },
        ]
        categories = [{
          category = "wordpress"
          action   = "js_challenge"
          enabled  = true
        }]
      }
    }
  }]

  # (...)

  # (...)

  # Execute Cloudflare Managed Ruleset
  rules {
    ref         = "execute_cloudflare_managed_ruleset"
    description = "Execute Cloudflare Managed Ruleset on my zone-level phase entry point ruleset"
    expression  = "true"
    action      = "execute"
    action_parameters {
      id = "efb7b8c949ac4650a09736fc376e9aee"
      overrides {
        rules {
          id      = "5de7edfa648c4d6891dc3e7f84534ffa"
          action  = "log"
          enabled = true
        }
        rules {
          id      = "75a0060762034a6cb663fd51a02344cb"
          enabled = false
        }
        categories {
          category = "wordpress"
          action   = "js_challenge"
          enabled  = true
        }
      }
    }
  }

  # (...)

配置有效负载日志记录

此示例为 Cloudflare 托管规则集中匹配的规则启用有效负载日志记录，设置用于加密记录的有效负载的公钥。

在部署 Cloudflare 托管规则集的规则基础上，以下规则配置添加了 matched_data 对象以及用于加密有效负载的公钥：

  # (...)

  # Execute Cloudflare Managed Ruleset
  rules = [{
    ref         = "execute_cloudflare_managed_ruleset"
    description = "Execute Cloudflare Managed Ruleset on my zone-level phase entry point ruleset"
    expression  = "true"
    action      = "execute"
    action_parameters = {
      id = "efb7b8c949ac4650a09736fc376e9aee"
      matched_data = {
        public_key = "Ycig/Zr/pZmklmFUN99nr+taURlYItL91g+NcHGYpB8="
      }
    }
  }]

  # (...)

  # (...)

  # Execute Cloudflare Managed Ruleset
  rules {
    ref         = "execute_cloudflare_managed_ruleset"
    description = "Execute Cloudflare Managed Ruleset on my zone-level phase entry point ruleset"
    expression  = "true"
    action      = "execute"
    action_parameters {
      id = "efb7b8c949ac4650a09736fc376e9aee"
      matched_data {
         public_key = "Ycig/Zr/pZmklmFUN99nr+taURlYItL91g+NcHGYpB8="
      }
    }
  }

  # (...)

配置 OWASP 偏执级别（paranoia level）、分数阈值和操作

OWASP 托管规则集支持以下配置：

通过创建标签覆盖来禁用与较高偏执级别相关联的所有规则，从而启用特定偏执级别及以下的所有规则。
通过为 Cloudflare OWASP 核心规则集中的最后一条规则（ID 为的规则）创建规则覆盖，并包含 action 属性，设置当计算的威胁分数大于分数阈值时要执行的操作。
通过为 Cloudflare OWASP 核心规则集中的最后一条规则（ID 为的规则）创建规则覆盖，并包含 score_threshold 属性，以设置分数阈值。

有关可用配置值的更多信息，请参考 WAF 文档中的 Cloudflare OWASP 核心规则集页面。

以下 cloudflare_ruleset Terraform 资源示例规则执行以下配置：

部署 OWASP 托管规则集。
将 OWASP 偏执级别设置为 PL2。
将分数阈值设置为 60（Low）。
将规则集操作设置为 log。

  # (...)

  # Execute Cloudflare OWASP Core Ruleset
  rules = [{
    ref         = "execute_owasp_core_ruleset"
    description = "Execute Cloudflare OWASP Core Ruleset"
    expression  = "true"
    action      = "execute"
    action_parameters = {
      id = "4814384a9e5d4991b9815dcfc25d2f1f"
      overrides = {
        # By default, all PL1 to PL4 rules are enabled.
        # Set the paranoia level to PL2 by disabling rules with
        # tags "paranoia-level-3" and "paranoia-level-4".
        categories = [
          {
            category = "paranoia-level-3"
            enabled  = false
          },
          {
            category = "paranoia-level-4"
            enabled  = false
          },
        ]
        rules = [{
          id              = "6179ae15870a4bb7b2d480d4843b323c"
          action          = "log"
          score_threshold = 60
        }]
      }
    }
  }]

  # (...)

  # (...)

  # Execute Cloudflare OWASP Core Ruleset
  rules {
    ref         = "execute_owasp_core_ruleset"
    description = "Execute Cloudflare OWASP Core Ruleset"
    expression  = "true"
    action      = "execute"
    action_parameters {
      id = "4814384a9e5d4991b9815dcfc25d2f1f"
      overrides {
        # By default, all PL1 to PL4 rules are enabled.
        # Set the paranoia level to PL2 by disabling rules with
        # tags "paranoia-level-3" and "paranoia-level-4".
        categories {
          category = "paranoia-level-3"
          enabled  = false
        }
        categories {
          category = "paranoia-level-4"
          enabled  = false
        }
        rules {
          id              = "6179ae15870a4bb7b2d480d4843b323c"
          action          = "log"
          score_threshold = 60
        }
      }
    }
  }

  # (...)