frostmoln_appgw_waf_rules (Data Source)

The tenant-owned rules in an Application Gateway WAF policy — the ones you author with frostmoln_appgw_waf_rule.

Platform-owned rules are deliberately excluded. They are not yours to change, and including them would make every emergency virtual patch the platform ships show up in a list your configuration iterates over — dirtying terraform plan for a change you did not make and cannot undo. Read those with frostmoln_appgw_waf_platform_rules.

Example Usage

# The rules YOU author. Platform-owned rules are excluded, so an emergency
# virtual patch the platform ships does not dirty your plan.

data "frostmoln_appgw_waf_rules" "mine" {
  gateway_id = frostmoln_application_gateway.edge.id
  policy_id  = frostmoln_appgw_waf_policy.main.id

  # "draft" (default) is what is being edited; "active" is what the gateway is
  # enforcing right now. They differ whenever there are unpublished changes.
  source = "active"
}

output "enforced_rule_count" {
  value = length(data.frostmoln_appgw_waf_rules.mine.rules)
}

Schema

Required

• gateway_id (String) The Application Gateway the policy belongs to.
• policy_id (String) The WAF policy to read.

Optional

• source (String) Which ruleset to read: draft (default) is what is being edited, active is what the gateway is enforcing. They differ whenever there are unpublished changes, which is most of the time during an apply.

Read-Only

• rules (Attributes List) The rules, in evaluation order. (see below for nested schema)
• version (Number) The version number the returned rules came from.

Nested Schema for rules

Read-Only:

• builder_json (String) The structured body as JSON, for a builder rule.
• description (String) What the rule is for.
• enabled (Boolean) Whether the rule is evaluated.
• kind (String) builder, raw or managedOverride.
• managed_action (String) disable or updateTarget.
• managed_secrule_id (Number) The managed rule an override applies to.
• managed_target (String) The replacement target.
• opt_out_allowed (Boolean) For a platform rule: whether it may be turned off at all. Gateway self-protection rules may not.
• opted_out (Boolean) For a platform rule: whether this tenant has turned it off.
• ordinal (Number) Evaluation order within the policy.
• owner (String) tenant or platform.
• raw (String) The SecLang text, for a raw rule.
• revision (Number) The server-assigned write counter.
• rule_key (String) The rule's stable identity.
• secrule_id (Number) The SecRule id the platform assigned.