Rulesets
resource cloudflare_ruleset
required Expand Collapse
optional Expand Collapse
rules?: List[Attributes]The list of rules in the ruleset.
The list of rules in the ruleset.
action_parameters?: AttributesThe parameters configuring the rule’s action.
The parameters configuring the rule’s action.
overrides?: AttributesA set of overrides to apply to the target ruleset.
A set of overrides to apply to the target ruleset.
An action to override all rules with. This option has lower precedence than rule and category overrides.
categories?: List[Attributes]A list of category-level overrides. This option has the second-highest precedence after rule-level overrides.
A list of category-level overrides. This option has the second-highest precedence after rule-level overrides.
Whether to enable execution of all rules. This option has lower precedence than rule and category overrides.
from_value?: AttributesA redirect based on the request properties.
A redirect based on the request properties.
max_age?: AttributesA cache-control directive configuration that accepts a duration value in seconds.
A cache-control directive configuration that accepts a duration value in seconds.
no_cache?: AttributesA cache-control directive configuration that accepts optional qualifiers (header names).
A cache-control directive configuration that accepts optional qualifiers (header names).
private?: AttributesA cache-control directive configuration that accepts optional qualifiers (header names).
A cache-control directive configuration that accepts optional qualifiers (header names).
s_maxage?: AttributesA cache-control directive configuration that accepts a duration value in seconds.
A cache-control directive configuration that accepts a duration value in seconds.
stale_if_error?: AttributesA cache-control directive configuration that accepts a duration value in seconds.
A cache-control directive configuration that accepts a duration value in seconds.
stale_while_revalidate?: AttributesA cache-control directive configuration that accepts a duration value in seconds.
A cache-control directive configuration that accepts a duration value in seconds.
A list of additional ports that caching should be enabled on.
browser_ttl?: AttributesHow long client browsers should cache the response. Cloudflare cache purge will not purge content cached on client browsers, so high browser TTLs may lead to stale content.
How long client browsers should cache the response. Cloudflare cache purge will not purge content cached on client browsers, so high browser TTLs may lead to stale content.
Whether the request’s response from the origin is eligible for caching. Caching itself will still depend on the cache control header and your other caching configurations.
cache_key?: AttributesWhich components of the request are included in or excluded from the cache key Cloudflare uses to store the response in cache.
Which components of the request are included in or excluded from the cache key Cloudflare uses to store the response in cache.
Whether to protect from web cache deception attacks, while allowing static assets to be cached.
custom_key?: AttributesWhich components of the request are included or excluded from the cache key.
Which components of the request are included or excluded from the cache key.
header?: AttributesWhich headers to include in the cache key.
Which headers to include in the cache key.
A list of headers to check for the presence of. The presence of these headers is included in the cache key.
query_string?: AttributesWhich query string parameters to include in or exclude from the cache key.
Which query string parameters to include in or exclude from the cache key.
cache_reserve?: AttributesSettings to determine whether the request’s response from origin is eligible for Cache Reserve (requires a Cache Reserve add-on plan).
Settings to determine whether the request’s response from origin is eligible for Cache Reserve (requires a Cache Reserve add-on plan).
edge_ttl?: AttributesHow long the Cloudflare edge network should cache the response.
How long the Cloudflare edge network should cache the response.
status_code_ttl?: List[Attributes]A list of TTLs to apply to specific status codes or status code ranges.
A list of TTLs to apply to specific status codes or status code ranges.
Whether to generate Cloudflare error pages for issues from the origin server.
A timeout value between two successive read operations to use for your origin server. Historically, the timeout value between two read options from Cloudflare to an origin server is 100 seconds. If you are attempting to reduce HTTP 524 errors because of timeouts from an origin server, try increasing this timeout value.
Whether Cloudflare should respect strong ETag (entity tag) headers. If false, Cloudflare converts strong ETag headers to weak ETag headers.
shared_dictionary?: AttributesConfiguration for shared dictionary compression. When set, Cloudflare injects Use-As-Dictionary headers on matching cacheable responses.
Configuration for shared dictionary compression. When set, Cloudflare injects Use-As-Dictionary headers on matching cacheable responses.
Whether to strip Last-Modified headers from the origin response before caching.
Whether to enable Mirage.
Whether to redirect verified AI training crawlers to canonical URLs found in the HTML response.
A phase to skip the execution of. This option is only compatible with the products option.
A list of phases to skip the execution of. This option is incompatible with the rulesets option.
A mapping of ruleset IDs to a list of rule IDs in that ruleset to skip the execution of. This option is incompatible with the ruleset option.
ratelimit?: AttributesAn object configuring the rule’s rate limit behavior.
An object configuring the rule’s rate limit behavior.
Characteristics of the request on which the rate limit counter will be incremented.
An expression that defines when the rate limit counter should be incremented. It defaults to the same as the rule’s expression.
Period of time in seconds after which the action will be disabled following its first execution.
The threshold of requests per period after which the action will be executed for the first time.
cloudflare_ruleset
resource "cloudflare_ruleset" "example_ruleset" {
kind = "root"
name = "My ruleset"
phase = "http_request_firewall_custom"
zone_id = "zone_id"
description = "A description for my ruleset."
rules = [{
id = "3a03d665bac047339bb530ecb439a90d"
action = "block"
action_parameters = {
response = {
content = <<EOT
{
"success": false,
"error": "you have been blocked"
}
EOT
content_type = "application/json"
status_code = 400
}
}
description = "Block the request."
enabled = true
exposed_credential_check = {
password_expression = "url_decode(http.request.body.form[\\\"password\\\"][0])"
username_expression = "url_decode(http.request.body.form[\\\"username\\\"][0])"
}
expression = "ip.src eq 1.1.1.1"
logging = {
enabled = true
}
ratelimit = {
characteristics = ["cf.colo.id"]
period = 60
counting_expression = "http.request.body.raw eq \"abcd\""
mitigation_timeout = 600
requests_per_period = 1000
requests_to_origin = true
score_per_period = 400
score_response_header_name = "my-score"
}
ref = "my_ref"
}]
}
data cloudflare_ruleset
optional Expand Collapse
computed Expand Collapse
rules: List[Attributes]The list of rules in the ruleset.
The list of rules in the ruleset.
action_parameters: AttributesThe parameters configuring the rule’s action.
The parameters configuring the rule’s action.
overrides: AttributesA set of overrides to apply to the target ruleset.
A set of overrides to apply to the target ruleset.
An action to override all rules with. This option has lower precedence than rule and category overrides.
categories: List[Attributes]A list of category-level overrides. This option has the second-highest precedence after rule-level overrides.
A list of category-level overrides. This option has the second-highest precedence after rule-level overrides.
Whether to enable execution of all rules. This option has lower precedence than rule and category overrides.
from_value: AttributesA redirect based on the request properties.
A redirect based on the request properties.
max_age: AttributesA cache-control directive configuration that accepts a duration value in seconds.
A cache-control directive configuration that accepts a duration value in seconds.
no_cache: AttributesA cache-control directive configuration that accepts optional qualifiers (header names).
A cache-control directive configuration that accepts optional qualifiers (header names).
private: AttributesA cache-control directive configuration that accepts optional qualifiers (header names).
A cache-control directive configuration that accepts optional qualifiers (header names).
s_maxage: AttributesA cache-control directive configuration that accepts a duration value in seconds.
A cache-control directive configuration that accepts a duration value in seconds.
stale_if_error: AttributesA cache-control directive configuration that accepts a duration value in seconds.
A cache-control directive configuration that accepts a duration value in seconds.
stale_while_revalidate: AttributesA cache-control directive configuration that accepts a duration value in seconds.
A cache-control directive configuration that accepts a duration value in seconds.
A list of additional ports that caching should be enabled on.
browser_ttl: AttributesHow long client browsers should cache the response. Cloudflare cache purge will not purge content cached on client browsers, so high browser TTLs may lead to stale content.
How long client browsers should cache the response. Cloudflare cache purge will not purge content cached on client browsers, so high browser TTLs may lead to stale content.
Whether the request’s response from the origin is eligible for caching. Caching itself will still depend on the cache control header and your other caching configurations.
cache_key: AttributesWhich components of the request are included in or excluded from the cache key Cloudflare uses to store the response in cache.
Which components of the request are included in or excluded from the cache key Cloudflare uses to store the response in cache.
Whether to protect from web cache deception attacks, while allowing static assets to be cached.
custom_key: AttributesWhich components of the request are included or excluded from the cache key.
Which components of the request are included or excluded from the cache key.
header: AttributesWhich headers to include in the cache key.
Which headers to include in the cache key.
A list of headers to check for the presence of. The presence of these headers is included in the cache key.
cache_reserve: AttributesSettings to determine whether the request’s response from origin is eligible for Cache Reserve (requires a Cache Reserve add-on plan).
Settings to determine whether the request’s response from origin is eligible for Cache Reserve (requires a Cache Reserve add-on plan).
edge_ttl: AttributesHow long the Cloudflare edge network should cache the response.
How long the Cloudflare edge network should cache the response.
status_code_ttl: List[Attributes]A list of TTLs to apply to specific status codes or status code ranges.
A list of TTLs to apply to specific status codes or status code ranges.
Whether to generate Cloudflare error pages for issues from the origin server.
A timeout value between two successive read operations to use for your origin server. Historically, the timeout value between two read options from Cloudflare to an origin server is 100 seconds. If you are attempting to reduce HTTP 524 errors because of timeouts from an origin server, try increasing this timeout value.
Whether Cloudflare should respect strong ETag (entity tag) headers. If false, Cloudflare converts strong ETag headers to weak ETag headers.
shared_dictionary: AttributesConfiguration for shared dictionary compression. When set, Cloudflare injects Use-As-Dictionary headers on matching cacheable responses.
Configuration for shared dictionary compression. When set, Cloudflare injects Use-As-Dictionary headers on matching cacheable responses.
Whether to strip Last-Modified headers from the origin response before caching.
Whether to enable Mirage.
Whether to redirect verified AI training crawlers to canonical URLs found in the HTML response.
A phase to skip the execution of. This option is only compatible with the products option.
A list of phases to skip the execution of. This option is incompatible with the rulesets option.
A mapping of ruleset IDs to a list of rule IDs in that ruleset to skip the execution of. This option is incompatible with the ruleset option.
ratelimit: AttributesAn object configuring the rule’s rate limit behavior.
An object configuring the rule’s rate limit behavior.
Characteristics of the request on which the rate limit counter will be incremented.
An expression that defines when the rate limit counter should be incremented. It defaults to the same as the rule’s expression.
Period of time in seconds after which the action will be disabled following its first execution.
The threshold of requests per period after which the action will be executed for the first time.
cloudflare_ruleset
data "cloudflare_ruleset" "example_ruleset" {
ruleset_id = "2f2feab2026849078ba485f918791bdc"
account_id = "account_id"
zone_id = "zone_id"
}