terraform-examples.mdx

title	Terraform configuration examples
pcx_content_type	configuration
description	Configure malicious upload detection using Terraform.
products	waf
sidebar	order label 5 Terraform examples
head	tag content title Terraform configuration examples | WAF content scanning

import { Details, GlossaryTooltip, Render, Tabs, TabItem } from "~/components";

The following Terraform configuration examples address common scenarios for managing, configuring, and using WAF content scanning.

For more information, refer to the Terraform Cloudflare provider documentation.

If you are using the Cloudflare API, refer to Common API calls.

Enable WAF content scanning

Configure a custom scan expression

For more information, refer to Custom scan expressions.

Add a custom rule to block malicious uploads

This example adds a custom rule that blocks requests with one or more content objects considered malicious by using one of the content scanning fields in the rule expression.

To use the cf.waf.content_scan.has_malicious_obj field you must enable content scanning.

Details

At least one of the following token permissions is required:

• Zone WAF Write

Configure the cloudflare_ruleset resource:

resource "cloudflare_ruleset" "zone_custom_firewall_malicious_uploads" {
  zone_id     = var.cloudflare_zone_id
  name        = "Phase entry point ruleset for custom rules in my zone"
  description = ""
  kind        = "zone"
  phase       = "http_request_firewall_custom"

  rules = [{
    ref         = "block_malicious_uploads"
    description = "Block requests uploading malicious content objects"
    expression  = "(cf.waf.content_scan.has_malicious_obj and http.request.uri.path eq \"/upload.php\")"
    action      = "block"
  }]
}

resource "cloudflare_ruleset" "zone_custom_firewall_malicious_uploads" {
  zone_id     = var.cloudflare_zone_id
  name        = "Phase entry point ruleset for custom rules in my zone"
  description = ""
  kind        = "zone"
  phase       = "http_request_firewall_custom"

  rules {
    ref         = "block_malicious_uploads"
    description = "Block requests uploading malicious content objects"
    expression  = "(cf.waf.content_scan.has_malicious_obj and http.request.uri.path eq \"/upload.php\")"
    action      = "block"
  }
}

More resources

For additional Terraform configuration examples, refer to WAF custom rules configuration using Terraform.