web_application_firewall_policies

Creates, updates, deletes, gets or lists a web_application_firewall_policies resource.

Overview

Name	web_application_firewall_policies
Type	Resource
Id	azure.network.web_application_firewall_policies

Fields

The following fields are returned by SELECT queries:

get

Name	Datatype	Description
id	string	Resource ID.
name	string	Resource name.
applicationGatewayForContainers	array	A collection of references to application gateway for containers.
applicationGateways	array	A collection of references to application gateways.
customRules	array	The custom rules inside the policy.
etag	string	A unique read-only string that changes whenever the resource is updated.
httpListeners	array	A collection of references to application gateway http listeners.
location	string	Resource location.
managedRules	object	Describes the managedRules structure. Required.
pathBasedRules	array	A collection of references to application gateway path rules.
policySettings	object	The PolicySettings for policy.
provisioningState	string	The provisioning state of the web application firewall policy resource. Known values are: "Failed", "Succeeded", "Canceled", "Creating", "Updating", and "Deleting". (Failed, Succeeded, Canceled, Creating, Updating, Deleting)
resourceState	string	Resource status of the policy. Known values are: "Creating", "Enabling", "Enabled", "Disabling", "Disabled", and "Deleting". (Creating, Enabling, Enabled, Disabling, Disabled, Deleting)
tags	object	Resource tags.
type	string	Resource type.

list

Name	Datatype	Description
id	string	Resource ID.
name	string	Resource name.
applicationGatewayForContainers	array	A collection of references to application gateway for containers.
applicationGateways	array	A collection of references to application gateways.
customRules	array	The custom rules inside the policy.
etag	string	A unique read-only string that changes whenever the resource is updated.
httpListeners	array	A collection of references to application gateway http listeners.
location	string	Resource location.
managedRules	object	Describes the managedRules structure. Required.
pathBasedRules	array	A collection of references to application gateway path rules.
policySettings	object	The PolicySettings for policy.
provisioningState	string	The provisioning state of the web application firewall policy resource. Known values are: "Failed", "Succeeded", "Canceled", "Creating", "Updating", and "Deleting". (Failed, Succeeded, Canceled, Creating, Updating, Deleting)
resourceState	string	Resource status of the policy. Known values are: "Creating", "Enabling", "Enabled", "Disabling", "Disabled", and "Deleting". (Creating, Enabling, Enabled, Disabling, Disabled, Deleting)
tags	object	Resource tags.
type	string	Resource type.

list_all

Name	Datatype	Description
id	string	Resource ID.
name	string	Resource name.
applicationGatewayForContainers	array	A collection of references to application gateway for containers.
applicationGateways	array	A collection of references to application gateways.
customRules	array	The custom rules inside the policy.
etag	string	A unique read-only string that changes whenever the resource is updated.
httpListeners	array	A collection of references to application gateway http listeners.
location	string	Resource location.
managedRules	object	Describes the managedRules structure. Required.
pathBasedRules	array	A collection of references to application gateway path rules.
policySettings	object	The PolicySettings for policy.
provisioningState	string	The provisioning state of the web application firewall policy resource. Known values are: "Failed", "Succeeded", "Canceled", "Creating", "Updating", and "Deleting". (Failed, Succeeded, Canceled, Creating, Updating, Deleting)
resourceState	string	Resource status of the policy. Known values are: "Creating", "Enabling", "Enabled", "Disabling", "Disabled", and "Deleting". (Creating, Enabling, Enabled, Disabling, Disabled, Deleting)
tags	object	Resource tags.
type	string	Resource type.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	resource_group_name, policy_name, subscription_id		Retrieve protection policy with specified name within a resource group.
list	select	resource_group_name, subscription_id		Lists all of the protection policies within a resource group.
list_all	select	subscription_id		Gets all the WAF policies in a subscription.
create_or_update	insert	resource_group_name, policy_name, subscription_id		Creates or update policy with specified rule set name within a resource group.
create_or_update	replace	resource_group_name, policy_name, subscription_id		Creates or update policy with specified rule set name within a resource group.
delete	delete	resource_group_name, policy_name, subscription_id		Deletes Policy.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
policy_name	string	The name of the policy. Required.
resource_group_name	string	The name of the resource group. The name is case insensitive. Required.
subscription_id	string

SELECT examples

get

Retrieve protection policy with specified name within a resource group.

SELECT
id,
name,
applicationGatewayForContainers,
applicationGateways,
customRules,
etag,
httpListeners,
location,
managedRules,
pathBasedRules,
policySettings,
provisioningState,
resourceState,
tags,
type
FROM azure.network.web_application_firewall_policies
WHERE resource_group_name = '{{ resource_group_name }}' -- required
AND policy_name = '{{ policy_name }}' -- required
AND subscription_id = '{{ subscription_id }}' -- required
;

list

Lists all of the protection policies within a resource group.

SELECT
id,
name,
applicationGatewayForContainers,
applicationGateways,
customRules,
etag,
httpListeners,
location,
managedRules,
pathBasedRules,
policySettings,
provisioningState,
resourceState,
tags,
type
FROM azure.network.web_application_firewall_policies
WHERE resource_group_name = '{{ resource_group_name }}' -- required
AND subscription_id = '{{ subscription_id }}' -- required
;

list_all

Gets all the WAF policies in a subscription.

SELECT
id,
name,
applicationGatewayForContainers,
applicationGateways,
customRules,
etag,
httpListeners,
location,
managedRules,
pathBasedRules,
policySettings,
provisioningState,
resourceState,
tags,
type
FROM azure.network.web_application_firewall_policies
WHERE subscription_id = '{{ subscription_id }}' -- required
;

INSERT examples

create_or_update

Creates or update policy with specified rule set name within a resource group.

INSERT INTO azure.network.web_application_firewall_policies (
id,
location,
tags,
properties,
resource_group_name,
policy_name,
subscription_id
)
SELECT 
'{{ id }}',
'{{ location }}',
'{{ tags }}',
'{{ properties }}',
'{{ resource_group_name }}',
'{{ policy_name }}',
'{{ subscription_id }}'
RETURNING
id,
name,
etag,
location,
properties,
tags,
type
;

Manifest

# Description fields are for documentation purposes
- name: web_application_firewall_policies
props:
  - name: resource_group_name
    value: "{{ resource_group_name }}"
    description: Required parameter for the web_application_firewall_policies resource.
  - name: policy_name
    value: "{{ policy_name }}"
    description: Required parameter for the web_application_firewall_policies resource.
  - name: subscription_id
    value: "{{ subscription_id }}"
    description: Required parameter for the web_application_firewall_policies resource.
  - name: id
    value: "{{ id }}"
    description: |
      Resource ID.
  - name: location
    value: "{{ location }}"
    description: |
      Resource location.
  - name: tags
    value: "{{ tags }}"
    description: |
      Resource tags.
  - name: properties
    description: |
      Properties of the web application firewall policy.
    value:
      policySettings:
        state: "{{ state }}"
        mode: "{{ mode }}"
        requestBodyCheck: {{ requestBodyCheck }}
        requestBodyInspectLimitInKB: {{ requestBodyInspectLimitInKB }}
        requestBodyEnforcement: {{ requestBodyEnforcement }}
        maxRequestBodySizeInKb: {{ maxRequestBodySizeInKb }}
        fileUploadEnforcement: {{ fileUploadEnforcement }}
        fileUploadLimitInMb: {{ fileUploadLimitInMb }}
        customBlockResponseStatusCode: {{ customBlockResponseStatusCode }}
        customBlockResponseBody: "{{ customBlockResponseBody }}"
        logScrubbing:
          state: "{{ state }}"
          scrubbingRules:
            - matchVariable: "{{ matchVariable }}"
              selectorMatchOperator: "{{ selectorMatchOperator }}"
              selector: "{{ selector }}"
              state: "{{ state }}"
        jsChallengeCookieExpirationInMins: {{ jsChallengeCookieExpirationInMins }}
        captchaExpirationInMins: {{ captchaExpirationInMins }}
      customRules:
        - name: "{{ name }}"
          etag: "{{ etag }}"
          priority: {{ priority }}
          state: "{{ state }}"
          rateLimitDuration: "{{ rateLimitDuration }}"
          rateLimitThreshold: {{ rateLimitThreshold }}
          ruleType: "{{ ruleType }}"
          matchConditions: "{{ matchConditions }}"
          groupByUserSession: "{{ groupByUserSession }}"
          action: "{{ action }}"
      applicationGateways:
        - id: "{{ id }}"
          name: "{{ name }}"
          type: "{{ type }}"
          location: "{{ location }}"
          tags: "{{ tags }}"
          properties:
            sku:
              name: "{{ name }}"
              tier: "{{ tier }}"
              capacity: {{ capacity }}
              family: "{{ family }}"
            sslPolicy:
              disabledSslProtocols:
                - "{{ disabledSslProtocols }}"
              policyType: "{{ policyType }}"
              policyName: "{{ policyName }}"
              cipherSuites:
                - "{{ cipherSuites }}"
              minProtocolVersion: "{{ minProtocolVersion }}"
            operationalState: "{{ operationalState }}"
            gatewayIPConfigurations:
              - id: "{{ id }}"
                properties:
                  subnet: "{{ subnet }}"
                  provisioningState: "{{ provisioningState }}"
                name: "{{ name }}"
                etag: "{{ etag }}"
                type: "{{ type }}"
            authenticationCertificates:
              - id: "{{ id }}"
                properties:
                  data: "{{ data }}"
                  provisioningState: "{{ provisioningState }}"
                name: "{{ name }}"
                etag: "{{ etag }}"
                type: "{{ type }}"
            trustedRootCertificates:
              - id: "{{ id }}"
                properties:
                  data: "{{ data }}"
                  keyVaultSecretId: "{{ keyVaultSecretId }}"
                  provisioningState: "{{ provisioningState }}"
                name: "{{ name }}"
                etag: "{{ etag }}"
                type: "{{ type }}"
            trustedClientCertificates:
              - id: "{{ id }}"
                properties:
                  data: "{{ data }}"
                  validatedCertData: "{{ validatedCertData }}"
                  clientCertIssuerDN: "{{ clientCertIssuerDN }}"
                  provisioningState: "{{ provisioningState }}"
                name: "{{ name }}"
                etag: "{{ etag }}"
                type: "{{ type }}"
            sslCertificates:
              - id: "{{ id }}"
                properties:
                  data: "{{ data }}"
                  password: "{{ password }}"
                  publicCertData: "{{ publicCertData }}"
                  keyVaultSecretId: "{{ keyVaultSecretId }}"
                  hsm: "{{ hsm }}"
                  provisioningState: "{{ provisioningState }}"
                name: "{{ name }}"
                etag: "{{ etag }}"
                type: "{{ type }}"
            frontendIPConfigurations:
              - id: "{{ id }}"
                properties:
                  privateIPAddress: "{{ privateIPAddress }}"
                  privateIPAllocationMethod: "{{ privateIPAllocationMethod }}"
                  subnet: "{{ subnet }}"
                  publicIPAddress: "{{ publicIPAddress }}"
                  privateLinkConfiguration: "{{ privateLinkConfiguration }}"
                  provisioningState: "{{ provisioningState }}"
                name: "{{ name }}"
                etag: "{{ etag }}"
                type: "{{ type }}"
            frontendPorts:
              - id: "{{ id }}"
                properties:
                  port: {{ port }}
                  provisioningState: "{{ provisioningState }}"
                name: "{{ name }}"
                etag: "{{ etag }}"
                type: "{{ type }}"
            probes:
              - id: "{{ id }}"
                properties:
                  protocol: "{{ protocol }}"
                  host: "{{ host }}"
                  path: "{{ path }}"
                  interval: {{ interval }}
                  timeout: {{ timeout }}
                  unhealthyThreshold: {{ unhealthyThreshold }}
                  pickHostNameFromBackendHttpSettings: {{ pickHostNameFromBackendHttpSettings }}
                  pickHostNameFromBackendSettings: {{ pickHostNameFromBackendSettings }}
                  minServers: {{ minServers }}
                  match: "{{ match }}"
                  enableProbeProxyProtocolHeader: {{ enableProbeProxyProtocolHeader }}
                  provisioningState: "{{ provisioningState }}"
                  port: {{ port }}
                name: "{{ name }}"
                etag: "{{ etag }}"
                type: "{{ type }}"
            backendAddressPools:
              - id: "{{ id }}"
                properties:
                  backendIPConfigurations: "{{ backendIPConfigurations }}"
                  backendAddresses: "{{ backendAddresses }}"
                  provisioningState: "{{ provisioningState }}"
                name: "{{ name }}"
                etag: "{{ etag }}"
                type: "{{ type }}"
            backendHttpSettingsCollection:
              - id: "{{ id }}"
                properties:
                  port: {{ port }}
                  protocol: "{{ protocol }}"
                  cookieBasedAffinity: "{{ cookieBasedAffinity }}"
                  requestTimeout: {{ requestTimeout }}
                  probe: "{{ probe }}"
                  authenticationCertificates: "{{ authenticationCertificates }}"
                  trustedRootCertificates: "{{ trustedRootCertificates }}"
                  connectionDraining: "{{ connectionDraining }}"
                  hostName: "{{ hostName }}"
                  pickHostNameFromBackendAddress: {{ pickHostNameFromBackendAddress }}
                  affinityCookieName: "{{ affinityCookieName }}"
                  probeEnabled: {{ probeEnabled }}
                  path: "{{ path }}"
                  dedicatedBackendConnection: {{ dedicatedBackendConnection }}
                  validateCertChainAndExpiry: {{ validateCertChainAndExpiry }}
                  validateSNI: {{ validateSNI }}
                  sniName: "{{ sniName }}"
                  provisioningState: "{{ provisioningState }}"
                name: "{{ name }}"
                etag: "{{ etag }}"
                type: "{{ type }}"
            backendSettingsCollection:
              - id: "{{ id }}"
                properties:
                  port: {{ port }}
                  protocol: "{{ protocol }}"
                  timeout: {{ timeout }}
                  probe: "{{ probe }}"
                  trustedRootCertificates: "{{ trustedRootCertificates }}"
                  hostName: "{{ hostName }}"
                  pickHostNameFromBackendAddress: {{ pickHostNameFromBackendAddress }}
                  enableL4ClientIpPreservation: {{ enableL4ClientIpPreservation }}
                  provisioningState: "{{ provisioningState }}"
                name: "{{ name }}"
                etag: "{{ etag }}"
                type: "{{ type }}"
            httpListeners:
              - id: "{{ id }}"
                properties:
                  frontendIPConfiguration: "{{ frontendIPConfiguration }}"
                  frontendPort: "{{ frontendPort }}"
                  protocol: "{{ protocol }}"
                  hostName: "{{ hostName }}"
                  sslCertificate: "{{ sslCertificate }}"
                  sslProfile: "{{ sslProfile }}"
                  requireServerNameIndication: {{ requireServerNameIndication }}
                  provisioningState: "{{ provisioningState }}"
                  customErrorConfigurations: "{{ customErrorConfigurations }}"
                  firewallPolicy: "{{ firewallPolicy }}"
                  hostNames: "{{ hostNames }}"
                name: "{{ name }}"
                etag: "{{ etag }}"
                type: "{{ type }}"
            listeners:
              - id: "{{ id }}"
                properties:
                  frontendIPConfiguration: "{{ frontendIPConfiguration }}"
                  frontendPort: "{{ frontendPort }}"
                  protocol: "{{ protocol }}"
                  sslCertificate: "{{ sslCertificate }}"
                  sslProfile: "{{ sslProfile }}"
                  provisioningState: "{{ provisioningState }}"
                  hostNames: "{{ hostNames }}"
                name: "{{ name }}"
                etag: "{{ etag }}"
                type: "{{ type }}"
            sslProfiles:
              - id: "{{ id }}"
                properties:
                  trustedClientCertificates: "{{ trustedClientCertificates }}"
                  sslPolicy: "{{ sslPolicy }}"
                  clientAuthConfiguration: "{{ clientAuthConfiguration }}"
                  provisioningState: "{{ provisioningState }}"
                name: "{{ name }}"
                etag: "{{ etag }}"
                type: "{{ type }}"
            urlPathMaps:
              - id: "{{ id }}"
                properties:
                  defaultBackendAddressPool: "{{ defaultBackendAddressPool }}"
                  defaultBackendHttpSettings: "{{ defaultBackendHttpSettings }}"
                  defaultRewriteRuleSet: "{{ defaultRewriteRuleSet }}"
                  defaultRedirectConfiguration: "{{ defaultRedirectConfiguration }}"
                  defaultLoadDistributionPolicy: "{{ defaultLoadDistributionPolicy }}"
                  pathRules: "{{ pathRules }}"
                  provisioningState: "{{ provisioningState }}"
                name: "{{ name }}"
                etag: "{{ etag }}"
                type: "{{ type }}"
            requestRoutingRules:
              - id: "{{ id }}"
                properties:
                  ruleType: "{{ ruleType }}"
                  priority: {{ priority }}
                  backendAddressPool: "{{ backendAddressPool }}"
                  backendHttpSettings: "{{ backendHttpSettings }}"
                  httpListener: "{{ httpListener }}"
                  urlPathMap: "{{ urlPathMap }}"
                  rewriteRuleSet: "{{ rewriteRuleSet }}"
                  redirectConfiguration: "{{ redirectConfiguration }}"
                  loadDistributionPolicy: "{{ loadDistributionPolicy }}"
                  entraJWTValidationConfig: "{{ entraJWTValidationConfig }}"
                  provisioningState: "{{ provisioningState }}"
                name: "{{ name }}"
                etag: "{{ etag }}"
                type: "{{ type }}"
            routingRules:
              - id: "{{ id }}"
                properties:
                  ruleType: "{{ ruleType }}"
                  priority: {{ priority }}
                  backendAddressPool: "{{ backendAddressPool }}"
                  backendSettings: "{{ backendSettings }}"
                  listener: "{{ listener }}"
                  provisioningState: "{{ provisioningState }}"
                name: "{{ name }}"
                etag: "{{ etag }}"
                type: "{{ type }}"
            rewriteRuleSets:
              - id: "{{ id }}"
                properties:
                  rewriteRules: "{{ rewriteRules }}"
                  provisioningState: "{{ provisioningState }}"
                name: "{{ name }}"
                etag: "{{ etag }}"
            redirectConfigurations:
              - id: "{{ id }}"
                properties:
                  redirectType: "{{ redirectType }}"
                  targetListener: "{{ targetListener }}"
                  targetUrl: "{{ targetUrl }}"
                  includePath: {{ includePath }}
                  includeQueryString: {{ includeQueryString }}
                  requestRoutingRules: "{{ requestRoutingRules }}"
                  urlPathMaps: "{{ urlPathMaps }}"
                  pathRules: "{{ pathRules }}"
                name: "{{ name }}"
                etag: "{{ etag }}"
                type: "{{ type }}"
            webApplicationFirewallConfiguration:
              enabled: {{ enabled }}
              firewallMode: "{{ firewallMode }}"
              ruleSetType: "{{ ruleSetType }}"
              ruleSetVersion: "{{ ruleSetVersion }}"
              disabledRuleGroups:
                - ruleGroupName: "{{ ruleGroupName }}"
                  rules: "{{ rules }}"
              requestBodyCheck: {{ requestBodyCheck }}
              maxRequestBodySize: {{ maxRequestBodySize }}
              maxRequestBodySizeInKb: {{ maxRequestBodySizeInKb }}
              fileUploadLimitInMb: {{ fileUploadLimitInMb }}
              exclusions:
                - matchVariable: "{{ matchVariable }}"
                  selectorMatchOperator: "{{ selectorMatchOperator }}"
                  selector: "{{ selector }}"
            firewallPolicy:
              id: "{{ id }}"
            enableHttp2: {{ enableHttp2 }}
            enableFips: {{ enableFips }}
            autoscaleConfiguration:
              minCapacity: {{ minCapacity }}
              maxCapacity: {{ maxCapacity }}
            privateLinkConfigurations:
              - id: "{{ id }}"
                properties:
                  ipConfigurations: "{{ ipConfigurations }}"
                  provisioningState: "{{ provisioningState }}"
                name: "{{ name }}"
                etag: "{{ etag }}"
                type: "{{ type }}"
            privateEndpointConnections:
              - id: "{{ id }}"
                name: "{{ name }}"
                type: "{{ type }}"
                properties:
                  privateEndpoint: "{{ privateEndpoint }}"
                  privateLinkServiceConnectionState: "{{ privateLinkServiceConnectionState }}"
                  provisioningState: "{{ provisioningState }}"
                  linkIdentifier: "{{ linkIdentifier }}"
                etag: "{{ etag }}"
            resourceGuid: "{{ resourceGuid }}"
            provisioningState: "{{ provisioningState }}"
            customErrorConfigurations:
              - statusCode: "{{ statusCode }}"
                customErrorPageUrl: "{{ customErrorPageUrl }}"
            forceFirewallPolicyAssociation: {{ forceFirewallPolicyAssociation }}
            loadDistributionPolicies:
              - id: "{{ id }}"
                properties:
                  loadDistributionTargets: "{{ loadDistributionTargets }}"
                  loadDistributionAlgorithm: "{{ loadDistributionAlgorithm }}"
                  provisioningState: "{{ provisioningState }}"
                name: "{{ name }}"
                etag: "{{ etag }}"
                type: "{{ type }}"
            entraJWTValidationConfigs:
              - id: "{{ id }}"
                properties:
                  unAuthorizedRequestAction: "{{ unAuthorizedRequestAction }}"
                  tenantId: "{{ tenantId }}"
                  clientId: "{{ clientId }}"
                  audiences: "{{ audiences }}"
                  provisioningState: "{{ provisioningState }}"
                name: "{{ name }}"
                etag: "{{ etag }}"
            globalConfiguration:
              enableRequestBuffering: {{ enableRequestBuffering }}
              enableResponseBuffering: {{ enableResponseBuffering }}
            defaultPredefinedSslPolicy: "{{ defaultPredefinedSslPolicy }}"
          etag: "{{ etag }}"
          zones: "{{ zones }}"
          identity:
            principalId: "{{ principalId }}"
            tenantId: "{{ tenantId }}"
            type: "{{ type }}"
            userAssignedIdentities: "{{ userAssignedIdentities }}"
      provisioningState: "{{ provisioningState }}"
      resourceState: "{{ resourceState }}"
      managedRules:
        exceptions:
          - matchVariable: "{{ matchVariable }}"
            values: "{{ values }}"
            valueMatchOperator: "{{ valueMatchOperator }}"
            selectorMatchOperator: "{{ selectorMatchOperator }}"
            selector: "{{ selector }}"
            exceptionManagedRuleSets: "{{ exceptionManagedRuleSets }}"
        exclusions:
          - matchVariable: "{{ matchVariable }}"
            selectorMatchOperator: "{{ selectorMatchOperator }}"
            selector: "{{ selector }}"
            exclusionManagedRuleSets: "{{ exclusionManagedRuleSets }}"
        managedRuleSets:
          - ruleSetType: "{{ ruleSetType }}"
            ruleSetVersion: "{{ ruleSetVersion }}"
            ruleGroupOverrides: "{{ ruleGroupOverrides }}"
            computedDisabledRules: "{{ computedDisabledRules }}"
      httpListeners:
        - id: "{{ id }}"
      pathBasedRules:
        - id: "{{ id }}"
      applicationGatewayForContainers:
        - id: "{{ id }}"

REPLACE examples

create_or_update

Creates or update policy with specified rule set name within a resource group.

REPLACE azure.network.web_application_firewall_policies
SET 
id = '{{ id }}',
location = '{{ location }}',
tags = '{{ tags }}',
properties = '{{ properties }}'
WHERE 
resource_group_name = '{{ resource_group_name }}' --required
AND policy_name = '{{ policy_name }}' --required
AND subscription_id = '{{ subscription_id }}' --required
RETURNING
id,
name,
etag,
location,
properties,
tags,
type;

DELETE examples

delete

Deletes Policy.

DELETE FROM azure.network.web_application_firewall_policies
WHERE resource_group_name = '{{ resource_group_name }}' --required
AND policy_name = '{{ policy_name }}' --required
AND subscription_id = '{{ subscription_id }}' --required
;