frostmoln_appgw_waf_platform_rules (Data Source)

The platform-owned rules in an Application Gateway WAF policy: the gateway's own self-protection, and any emergency virtual patch in force.

Read-only. You cannot create, edit or delete one. Where opt_out_allowed is true you may turn it off for this gateway — which is the one write a tenant may make to a rule they do not own, and is not expressible in Terraform today; use fm appgw waf rule opt-out or the portal.

Worth reading in a configuration to assert on: a rule appearing here that you did not expect is the platform having shipped a patch, which is exactly the thing to notice.

Example Usage

# The platform's own rules: gateway self-protection, and any emergency virtual
# patch in force. Read-only.
#
# Worth asserting on: a rule appearing here that you did not expect is the
# platform having shipped a patch, which is exactly the thing to notice.

data "frostmoln_appgw_waf_platform_rules" "in_force" {
  gateway_id = frostmoln_application_gateway.edge.id
  policy_id  = frostmoln_appgw_waf_policy.main.id
}

output "platform_patches_i_have_opted_out_of" {
  value = [
    for r in data.frostmoln_appgw_waf_platform_rules.in_force.rules :
    r.rule_key if r.opted_out
  ]
}

Schema

Required

• gateway_id (String) The Application Gateway the policy belongs to.
• policy_id (String) The WAF policy to read.

Optional

• source (String) Which ruleset to read: draft (default) is what is being edited, active is what the gateway is enforcing. They differ whenever there are unpublished changes, which is most of the time during an apply.

Read-Only

• rules (Attributes List) The rules, in evaluation order. (see below for nested schema)
• version (Number) The version number the returned rules came from.

Nested Schema for rules

Read-Only:

• builder_json (String) The structured body as JSON, for a builder rule.
• description (String) What the rule is for.
• enabled (Boolean) Whether the rule is evaluated.
• kind (String) builder, raw or managedOverride.
• managed_action (String) disable or updateTarget.
• managed_secrule_id (Number) The managed rule an override applies to.
• managed_target (String) The replacement target.
• opt_out_allowed (Boolean) For a platform rule: whether it may be turned off at all. Gateway self-protection rules may not.
• opted_out (Boolean) For a platform rule: whether this tenant has turned it off.
• ordinal (Number) Evaluation order within the policy.
• owner (String) tenant or platform.
• raw (String) The SecLang text, for a raw rule.
• revision (Number) The server-assigned write counter.
• rule_key (String) The rule's stable identity.
• secrule_id (Number) The SecRule id the platform assigned.