Azure Application Gateway Firewall Policy - Terraform Module

⚙️ Version compatibility

Module version	Terraform version	AzureRM version
>= 1.x.x	>= 1.9.x	>= 3.112.0

📝 Usage

resource "azurerm_resource_group" "rg" {
  name     = "resource-group"
  location = "Spain Central"
}

module "application_gateway_firewall_policy" {
  source              = "aztfm/application-gateway-firewall-policy/azurerm"
  version             = ">=1.0.0"
  name                = "application-gateway-firewall-policy"
  resource_group_name = azurerm_resource_group.rg.name
  location            = azurerm_resource_group.rg.location
  tags                = azurerm_resource_group.rg.tags
  managed_rule_sets = [{
    type    = "OWASP"
    version = "3.2"
    }, {
    type    = "Microsoft_BotManagerRuleSet"
    version = "1.0"
  }]
}

Reference to more examples.

▶️ Parameters

The following parameters are supported:

Name	Description	Type	Default	Required
name	The name of the Application Gateway Firewall Policy.	`string`	n/a	yes
resource_group_name	The name of the resource group in which to create the Application Gateway Firewall Policy.	`string`	n/a	yes
location	The location/region where the Application Gateway Firewall Policy is created.	`string`	n/a	yes
tags	A mapping of tags to assign to the resource.	`map(string)`	`{}`	no
enabled	Describes if the policy is in enabled state or disabled state.	`bool`	`true`	no
mode	Describes if it is in detection mode or prevention mode at the policy level. Valid values are `Detection` and `Prevention`.	`string`	`"Prevention"`	no
request_body_inspect_limit_in_kb	The maximum request body inspection size in KB for the policy.	`number`	`128`	no
max_request_body_size_in_kb	The maximum request body size in KB for the policy.	`number`	`128`	no
file_upload_limit_in_mb	The maximum file upload size in MB for the policy.	`number`	`100`	no
managed_rule_sets	A mapping of managed rule set types and versions to associate with the policy.	`list(object({}))`	n/a	yes
managed_rule_exclusions	A mapping of managed rule exclusions to associate with the policy.	`list(object({}))`	`[]`	no

The managed_rule_sets supports the following:

Name	Description	Type	Default	Required
type	The rule set type. Possible values: `Microsoft_BotManagerRuleSet`, `Microsoft_DefaultRuleSet` and `OWASP`.	`string`	n/a	yes
version	The rule set version. Possible values: `0.1`, `1.0`, `2.1`, `3.0`, `3.1` and `3.2`.	`string`	n/a	yes

The managed_rule_exclusions supports the following:

Name	Description	Type	Default	Required
match_variable	The name of the Match Variable. Possible values: `RequestArgKeys`, `RequestArgNames`, `RequestArgValues`, `RequestCookieKeys`, `RequestCookieNames`, `RequestCookieValues`, `RequestHeaderKeys`, `RequestHeaderNames` and `RequestHeaderValues`.	`string`	n/a	yes
selector_match_operator	Describes operator to be matched. Possible values: `Contains`, `EndsWith`, `Equals`, `EqualsAny` and `StartsWith`.	`string`	n/a	yes
selector	Describes field of the matchVariable collection.	`string`	n/a	yes
rule_set	The rule set to be excluded.	`object({})`	`null`	no

The managed_rule_exclusions.rule_set supports the following:

Name	Description	Type	Default	Required
type	The rule set type. The only possible value include `Microsoft_DefaultRuleSet` and `OWASP`.	`string`	n/a	yes
rule_groups	The rule groups to exclude from the rule set.	`list(object({})`	`[]`	no

The managed_rule_exclusions.rule_set.rule_groups supports the following:

Name	Description	Type	Default	Required
rule_group_name	The name of the Rule Group. Possible values are `BadBots`, `crs_20_protocol_violations`, `crs_21_protocol_anomalies`, `crs_23_request_limits`, `crs_30_http_policy`, `crs_35_bad_robots`, `crs_40_generic_attacks`, `crs_41_sql_injection_attacks`, `crs_41_xss_attacks`, `crs_42_tight_security`, `crs_45_trojans`, `crs_49_inbound_blocking`, `General`, `GoodBots`, `KnownBadBots`, `Known-CVEs`, `REQUEST-911-METHOD-ENFORCEMENT`, `REQUEST-913-SCANNER-DETECTION`, `REQUEST-920-PROTOCOL-ENFORCEMENT`, `REQUEST-921-PROTOCOL-ATTACK`, `REQUEST-930-APPLICATION-ATTACK-LFI`, `REQUEST-931-APPLICATION-ATTACK-RFI`, `REQUEST-932-APPLICATION-ATTACK-RCE`, `REQUEST-933-APPLICATION-ATTACK-PHP`, `REQUEST-941-APPLICATION-ATTACK-XSS`, `REQUEST-942-APPLICATION-ATTACK-SQLI`, `REQUEST-943-APPLICATION-ATTACK-SESSION-FIXATION`, `REQUEST-944-APPLICATION-ATTACK-JAVA`, `UnknownBots`, `METHOD-ENFORCEMENT`, `PROTOCOL-ENFORCEMENT`, `PROTOCOL-ATTACK`, `LFI`, `RFI`, `RCE`, `PHP`, `NODEJS`, `XSS`, `SQLI`, `FIX`, `JAVA`, `MS-ThreatIntel-WebShells`, `MS-ThreatIntel-AppSec`, `MS-ThreatIntel-SQLI`, `MS-ThreatIntel-CVEs`, `MS-ThreatIntel-AppSec`, `MS-ThreatIntel-SQLI` and `MS-ThreatIntel-CVEs`.	`string`	n/a	yes
excluded_rules	One or more Rule IDs for exclusion.	`list(number)`	`[]`	no