WebApplicationFirewallPolicy is the Schema for the WebApplicationFirewallPolicys API. Manages a Azure Web Application Firewall Policy instance.
Type
CRD
Group
network.azure.upbound.io
Version
v1beta1
apiVersion: network.azure.upbound.io/v1beta1
kind: WebApplicationFirewallPolicy
WebApplicationFirewallPolicySpec defines the desired state of WebApplicationFirewallPolicy
No description provided.
One or more custom_rules blocks as defined below.
One or more match_conditions blocks as defined below.
A list of match values. This is Required when the operator is not Any.
One or more match_variables blocks as defined below.
A list of transformations to do before the match is attempted. Possible values are HtmlEntityDecode, Lowercase, RemoveNulls, Trim, UrlDecode and UrlEncode.
A managed_rules blocks as defined below.
One or more exclusion block defined below.
One or more excluded_rule_set block defined below.
One or more rule_group block defined below.
One or more Rule IDs for exclusion.
One or more managed_rule_set block defined below.
One or more rule_group_override block defined below.
No description provided.
A policy_settings block as defined below.
Reference to a ResourceGroup in azure to populate resourceGroupName.
Policies for referencing.
Selector for a ResourceGroup in azure to populate resourceGroupName.
Policies for selection.
ProviderConfigReference specifies how the provider that will be used to create, observe, update, and delete this managed resource should be configured.
Policies for referencing.
ProviderReference specifies the provider that will be used to create, observe, update, and delete this managed resource. Deprecated: Please use ProviderConfigReference, i.e. providerConfigRef
Policies for referencing.
PublishConnectionDetailsTo specifies the connection secret config which contains a name, metadata and a reference to secret store config to which any connection details for this managed resource should be written. Connection details frequently include the endpoint, username, and password required to connect to the managed resource.
WriteConnectionSecretToReference specifies the namespace and name of a Secret to which any connection details for this managed resource should be written. Connection details frequently include the endpoint, username, and password required to connect to the managed resource. This field is planned to be replaced in a future release in favor of PublishConnectionDetailsTo. Currently, both could be set independently and connection details would be published to both without affecting each other.
WebApplicationFirewallPolicyStatus defines the observed state of WebApplicationFirewallPolicy.
No description provided.
One or more custom_rules blocks as defined below.
One or more match_conditions blocks as defined below.
A list of match values. This is Required when the operator is not Any.
One or more match_variables blocks as defined below.
A list of transformations to do before the match is attempted. Possible values are HtmlEntityDecode, Lowercase, RemoveNulls, Trim, UrlDecode and UrlEncode.
A list of HTTP Listener IDs from an azurerm_application_gateway.
A managed_rules blocks as defined below.
One or more exclusion block defined below.
One or more excluded_rule_set block defined below.
One or more rule_group block defined below.
One or more Rule IDs for exclusion.
One or more managed_rule_set block defined below.
One or more rule_group_override block defined below.
No description provided.
A list of URL Path Map Path Rule IDs from an azurerm_application_gateway.
A policy_settings block as defined below.
Conditions of the resource.
example
apiVersion: network.azure.upbound.io/v1beta1
kind: WebApplicationFirewallPolicy
metadata:
annotations:
meta.upbound.io/example-id: network/v1beta1/webapplicationfirewallpolicy
labels:
testing.upbound.io/example-name: example
name: example
spec:
forProvider:
customRules:
- action: Block
matchConditions:
- matchValues:
- 192.168.1.0/24
- 10.0.0.0/24
matchVariables:
- variableName: RemoteAddr
negationCondition: false
operator: IPMatch
name: Rule1
priority: 1
ruleType: MatchRule
- action: Block
matchConditions:
- matchValues:
- 192.168.1.0/24
matchVariables:
- variableName: RemoteAddr
negationCondition: false
operator: IPMatch
- matchValues:
- Windows
matchVariables:
- selector: UserAgent
variableName: RequestHeaders
negationCondition: false
operator: Contains
name: Rule2
priority: 2
ruleType: MatchRule
location: West Europe
managedRules:
- exclusion:
- matchVariable: RequestHeaderNames
selector: x-company-secret-header
selectorMatchOperator: Equals
- matchVariable: RequestCookieNames
selector: too-tasty
selectorMatchOperator: EndsWith
managedRuleSet:
- ruleGroupOverride:
- rule:
- action: Log
enabled: true
id: "920300"
- action: Block
enabled: true
id: "920440"
ruleGroupName: REQUEST-920-PROTOCOL-ENFORCEMENT
type: OWASP
version: "3.2"
policySettings:
- enabled: true
fileUploadLimitInMb: 100
maxRequestBodySizeInKb: 128
mode: Prevention
requestBodyCheck: true
resourceGroupNameSelector:
matchLabels:
testing.upbound.io/example-name: example
© 2022 Upbound, Inc.
Discover the building blocksfor your internal cloud platform.