Skip to content

Commit 368cf4f

Browse files
[WAF] Account-level configuration (#17324)
--------- Co-authored-by: marciocloudflare <[email protected]>
1 parent 7bb4d70 commit 368cf4f

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

53 files changed

+1150
-334
lines changed

public/_redirects

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1233,6 +1233,8 @@
12331233
/waf/security-analytics/ /waf/analytics/security-analytics/ 301
12341234
/waf/custom-rules/use-cases/require-valid-hmac-token/ /waf/custom-rules/use-cases/configure-token-authentication/ 301
12351235
/waf/tools/scrape-shield/server-side-excludes/ /waf/tools/scrape-shield/ 301
1236+
/waf/rate-limiting-rules/create-account-dashboard/ /waf/account/rate-limiting-rulesets/create-dashboard/ 301
1237+
/waf/managed-rules/deploy-account-dashboard/ /waf/account/managed-rulesets/deploy-dashboard/ 301
12361238

12371239
# waiting-room
12381240
/waiting-room/how-to/mobile-traffic/ /waiting-room/how-to/json-response/ 301
@@ -1735,7 +1737,8 @@
17351737
/waf/managed-rulesets/* /waf/managed-rules/:splat 301
17361738
/firewall/recipes/* /waf/custom-rules/use-cases/:splat 301
17371739
/workers/wrangler-legacy/* /workers/wrangler/migration/v1-to-v2/wrangler-legacy/:splat 301
1738-
/waf/custom-rulesets/* /waf/custom-rules/custom-rulesets/:splat 301
1740+
/waf/custom-rulesets/* /waf/account/custom-rulesets/:splat 301
1741+
/waf/custom-rules/custom-rulesets/* /waf/account/custom-rulesets/:splat 301
17391742
/waf/exposed-credentials-check/* /waf/managed-rules/check-for-exposed-credentials/:splat 301
17401743
/waf/security-events/* /waf/analytics/security-events/:splat 301
17411744
/web3/polygon-gateway/* /web3/ 301

src/content/docs/fundamentals/setup/manage-members/roles.mdx

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -81,8 +81,8 @@ Domain-scoped roles apply for a given domain within an account.
8181
| ------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
8282
| Bot Management | Can edit [Bot Management](/bots/plans/bm-subscription/) (including [Super Bot Fight Mode](/bots/get-started/pro/)) configurations. |
8383
| Cache Domain Purge | Grants access to [purge the edge cache](/cache/how-to/purge-cache/) for a specific domain. |
84-
| Domain Administrator | Grants full access to domains in an account, and read-only access to account-wide [Firewall](/waf/managed-rules/deploy-account-dashboard/), [Access](/cloudflare-one/policies/access/), and [Worker](/workers/) resources. |
85-
| Domain Administrator Read Only | Grants read-only access to domains in an account, as well as account-wide [Firewall](/waf/managed-rules/deploy-account-dashboard/), [Access](/cloudflare-one/policies/access/), and [Worker](/workers/) resources. |
84+
| Domain Administrator | Grants full access to domains in an account, and read-only access to account-wide [Firewall](/waf/account/managed-rulesets/deploy-dashboard/), [Access](/cloudflare-one/policies/access/), and [Worker](/workers/) resources. |
85+
| Domain Administrator Read Only | Grants read-only access to domains in an account, as well as account-wide [Firewall](/waf/account/managed-rulesets/deploy-dashboard/), [Access](/cloudflare-one/policies/access/), and [Worker](/workers/) resources. |
8686
| Domain API Gateway | Grants full access to API Gateway (including [API Shield](/api-shield/)). |
8787
| Domain API Gateway Read | Grants read access to API Gateway (including [API Shield](/api-shield/)). |
8888
| Domain DNS | Grants access to edit [DNS settings](/dns/) for domains in an account. |

src/content/docs/ruleset-engine/custom-rulesets/add-rules-ruleset.mdx

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,8 +13,8 @@ When you add rules to a custom ruleset using the [Update an account ruleset](/ap
1313

1414
You can use other API operations depending on the type of operation:
1515

16-
- Add a single rule to an existing custom ruleset — use the [Create an account ruleset rule](/api/operations/createAccountRulesetRule) operation.
17-
- Update a single rule in a custom ruleset — use the [Update an account ruleset rule](/api/operations/updateAccountRulesetRule) operation.
16+
- Add a single rule to an existing custom ruleset: Use the [Create an account ruleset rule](/api/operations/createAccountRulesetRule) operation.
17+
- Update a single rule in a custom ruleset: Use the [Update an account ruleset rule](/api/operations/updateAccountRulesetRule) operation.
1818

1919
:::
2020

src/content/docs/ruleset-engine/custom-rulesets/index.mdx

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ Use the following workflow to deploy a custom ruleset at the account level:
1313

1414
You must create a rule with `execute` action in an entry point ruleset to execute the custom ruleset (step 3 in the previous procedure). If you skip this step, the rules of the custom ruleset will not run.
1515

16-
Custom rulesets are currently only supported by the [Cloudflare WAF](/waf/).
16+
Currently, custom rulesets are only supported by the [Cloudflare WAF](/waf/).
1717

1818
:::caution
1919
You cannot execute a custom ruleset from another custom ruleset, only from an entry point ruleset.

src/content/docs/ruleset-engine/managed-rulesets/deploy-managed-ruleset.mdx

Lines changed: 10 additions & 114 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@ sidebar:
55
order: 2
66
---
77

8+
import { RuleID, Render } from "~/components";
9+
810
You can deploy a managed ruleset at the zone level or at the account level.
911

1012
To deploy a managed ruleset to a phase, use the [Rulesets API](/ruleset-engine/rulesets-api/).
@@ -14,133 +16,27 @@ To deploy a managed ruleset to a phase, use the [Rulesets API](/ruleset-engine/r
1416
Use the following workflow to deploy a managed ruleset to a phase at the zone level.
1517

1618
1. Get your [zone ID](/fundamentals/setup/find-account-and-zone-ids/).
17-
2. Invoke the [List account rulesets](/api/operations/listAccountRulesets) operation to obtain the available rulesets. Managed rulesets exist at the account level, but you can deploy them to a zone. Find the ruleset ID of the managed ruleset you wish to deploy.
19+
2. Invoke the [List account rulesets](/api/operations/listAccountRulesets) operation to obtain the available managed rulesets. Managed rulesets exist at the account level, but you can deploy them to a zone. Find the ruleset ID of the managed ruleset you want to deploy.
1820
3. Identify the [phase](/ruleset-engine/about/phases/) where you want to deploy the managed ruleset. Ensure that the managed ruleset belongs to the same phase where you want to deploy it. To learn more about the available phases supported by each Cloudflare product, refer to the specific documentation for that product, or the [Phases list](/ruleset-engine/reference/phases-list/).
19-
4. Add a rule to the zone-level phase [entry point ruleset](/ruleset-engine/about/rulesets/#entry-point-ruleset) that executes the managed ruleset.
21+
4. Add a rule to the zone-level phase [entry point ruleset](/ruleset-engine/about/rulesets/#entry-point-ruleset) that executes the managed ruleset. Refer to the following example for details on this step.
2022

2123
### Example
2224

23-
The following example deploys a managed ruleset to the `http_request_firewall_managed` phase of a given zone (`{zone_id}`) by creating a rule that executes the managed ruleset.
24-
25-
```bash
26-
curl --request PUT \
27-
https://api.cloudflare.com/client/v4/zones/{zone_id}/rulesets/phases/http_request_firewall_managed/entrypoint \
28-
--header "Authorization: Bearer <API_TOKEN>" \
29-
--header "Content-Type: application/json" \
30-
--data '{
31-
"rules": [
32-
{
33-
"action": "execute",
34-
"action_parameters": {
35-
"id": "<CLOUDFLARE_MANAGED_RULESET_ID>"
36-
},
37-
"expression": "true",
38-
"description": "Execute Cloudflare Managed Ruleset on my zone-level phase entry point"
39-
}
40-
]
41-
}'
42-
```
25+
<Render file="managed-rulesets/api-zone-example" product="waf" />
4326

44-
```json output
45-
{
46-
"result": {
47-
"id": "<ZONE_PHASE_RULESET_ID>",
48-
"name": "Zone-level phase entry point",
49-
"description": "",
50-
"kind": "zone",
51-
"version": "3",
52-
"rules": [
53-
{
54-
"id": "<RULE_ID_1>",
55-
"version": "1",
56-
"action": "execute",
57-
"action_parameters": {
58-
"id": "<CLOUDFLARE_MANAGED_RULESET_ID>",
59-
"version": "latest"
60-
},
61-
"expression": "true",
62-
"description": "Execute Cloudflare Managed Ruleset on my zone-level phase entry point",
63-
"last_updated": "2021-03-18T18:08:14.003361Z",
64-
"ref": "<RULE_REF_1>",
65-
"enabled": true
66-
}
67-
],
68-
"last_updated": "2021-03-18T18:08:14.003361Z",
69-
"phase": "http_request_firewall_managed"
70-
},
71-
"success": true,
72-
"errors": [],
73-
"messages": []
74-
}
75-
```
27+
In this example, the managed ruleset executes the behavior configured by Cloudflare. To customize the behavior of managed rulesets, refer to [Override a managed ruleset](/ruleset-engine/managed-rulesets/override-managed-ruleset/).
7628

7729
## Deploy a managed ruleset to a phase at the account level
7830

7931
Use the following workflow to deploy a managed ruleset to a phase at the account level.
8032

8133
1. Get your [account ID](/fundamentals/setup/find-account-and-zone-ids/).
82-
2. Invoke the [List account rulesets](/api/operations/listAccountRulesets) operation to obtain the available rulesets. Find the ruleset ID of the managed ruleset you wish to deploy.
34+
2. Invoke the [List account rulesets](/api/operations/listAccountRulesets) operation to obtain the available managed rulesets. Find the ruleset ID of the managed ruleset you want to deploy.
8335
3. Identify the [phase](/ruleset-engine/about/phases/) where you want to deploy the managed ruleset. Ensure that the managed ruleset belongs to the same phase where you want to deploy it. To learn more about the available phases supported by each Cloudflare product, refer to the specific documentation for that product, or the [Phases list](/ruleset-engine/reference/phases-list/).
84-
4. Add a rule to the account-level phase [entry point ruleset](/ruleset-engine/about/rulesets/#entry-point-ruleset) that executes the managed ruleset. Use parentheses to enclose any custom conditions in the rule expression and end your expression with `and cf.zone.plan eq "ENT"` so that it only applies to zones on an Enterprise plan.
36+
4. Add a rule to the account-level phase [entry point ruleset](/ruleset-engine/about/rulesets/#entry-point-ruleset) that executes the managed ruleset. Use parentheses to enclose any custom conditions in the rule expression and end your expression with `and cf.zone.plan eq "ENT"` so that it only applies to zones on an Enterprise plan. Refer to the following example for details on this step.
8537

8638
### Example
8739

88-
The following example deploys a managed ruleset to the `http_request_firewall_managed` phase of your account (`{account_id}`) by creating a rule that executes the managed ruleset. The rules in the managed ruleset are executed when the zone name matches one of `example.com` or `anotherexample.com`.
89-
90-
:::caution
91-
Managed rulesets deployed at the account level will only apply to incoming traffic of zones on an Enterprise plan. The expression of your `execute` rule must end with `and cf.zone.plan eq "ENT"` or else the operation will fail.
92-
:::
93-
94-
```bash
95-
curl --request PUT \
96-
https://api.cloudflare.com/client/v4/accounts/{account_id}/rulesets/phases/http_request_firewall_managed/entrypoint \
97-
--header "Authorization: Bearer <API_TOKEN>" \
98-
--header "Content-Type: application/json" \
99-
--data '{
100-
"rules": [
101-
{
102-
"action": "execute",
103-
"action_parameters": {
104-
"id": "<CLOUDFLARE_MANAGED_RULESET_ID>"
105-
},
106-
"expression": "(cf.zone.name in {\"example.com\" \"anotherexample.com\"}) and cf.zone.plan eq \"ENT\"",
107-
"description": "Execute Cloudflare Managed Ruleset on my account-level phase entry point"
108-
}
109-
]
110-
}'
111-
```
112-
113-
```json output
114-
{
115-
"result": {
116-
"id": "<RULESET_ID>",
117-
"name": "Account-level phase entry point",
118-
"description": "",
119-
"kind": "root",
120-
"version": "5",
121-
"rules": [
122-
{
123-
"id": "<RULE_ID>",
124-
"version": "1",
125-
"action": "execute",
126-
"action_parameters": {
127-
"id": "<CLOUDFLARE_MANAGED_RULESET_ID>",
128-
"version": "latest"
129-
},
130-
"expression": "(cf.zone.name in {\"example.com\" \"anotherexample.com\"}) and cf.zone.plan eq \"ENT\"",
131-
"description": "Execute Cloudflare Managed Ruleset on my account-level phase entry point",
132-
"last_updated": "2021-03-18T18:30:08.122758Z",
133-
"ref": "<RULE_REF>",
134-
"enabled": true
135-
}
136-
],
137-
"last_updated": "2021-03-18T18:30:08.122758Z",
138-
"phase": "http_request_firewall_managed"
139-
},
140-
"success": true,
141-
"errors": [],
142-
"messages": []
143-
}
144-
```
40+
<Render file="managed-rulesets/api-account-example" product="waf" />
14541

146-
In these examples, the managed ruleset executes the behavior configured by Cloudflare. To customize the behavior of managed rulesets, refer to [Override a managed ruleset](/ruleset-engine/managed-rulesets/override-managed-ruleset/).
42+
In this example, the managed ruleset executes the behavior configured by Cloudflare. To customize the behavior of managed rulesets, refer to [Override a managed ruleset](/ruleset-engine/managed-rulesets/override-managed-ruleset/).

src/content/docs/ruleset-engine/managed-rulesets/override-managed-ruleset.mdx

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ sidebar:
55
order: 3
66
---
77

8-
import { Details } from "~/components";
8+
import { Render, Details } from "~/components";
99

1010
To customize the behavior of a managed ruleset, override the ruleset at deployment. When you override a ruleset you specify changes to be executed on top of the default configuration. These changes take precedence over the ruleset's default behavior.
1111

@@ -23,9 +23,7 @@ You can override a ruleset at three levels:
2323

2424
Specific overrides take precedence over more general ones, and rule overrides take precedence over tag overrides, which take precedence over ruleset overrides.
2525

26-
:::caution
27-
Ruleset overrides and tag overrides apply to both existing and **future** rules in the managed ruleset. If you wish to override existing rules only, you must use rule overrides.
28-
:::
26+
<Render file="managed-ruleset-override-warning" product="waf" />
2927

3028
To apply an override for a managed ruleset:
3129

src/content/docs/ruleset-engine/rulesets-api/create.mdx

Lines changed: 63 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ sidebar:
66
order: 5
77
---
88

9-
import { Description, Type } from "~/components";
9+
import { Description, Type, Render } from "~/components";
1010

1111
Creates a ruleset of a given kind in the specified phase. Allows you to create phase entry point rulesets.
1212

@@ -42,7 +42,7 @@ Use the `rules` parameter to supply a list of rules for the ruleset. For an obje
4242

4343
## Example - Create a custom ruleset
4444

45-
The following example request creates a custom ruleset in the `http_request_firewall_custom` phase containing a single rule.
45+
The following `POST` request creates a custom ruleset in the `http_request_firewall_custom` phase containing a single rule.
4646

4747
```bash
4848
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/rulesets \
@@ -111,7 +111,7 @@ curl https://api.cloudflare.com/client/v4/accounts/{account_id}/rulesets \
111111

112112
## Example - Create a zone-level phase entry point ruleset
113113

114-
The following example request creates a zone-level phase entry point ruleset at the `http_request_firewall_managed` phase with a single rule that executes a managed ruleset.
114+
The following `POST` request creates a zone-level phase entry point ruleset at the `http_request_firewall_managed` phase with a single rule that executes a managed ruleset.
115115

116116
:::note
117117

@@ -168,3 +168,63 @@ curl https://api.cloudflare.com/client/v4/zones/{zone_id}/rulesets \
168168
"messages": []
169169
}
170170
```
171+
172+
## Example - Create an account-level phase entry point ruleset
173+
174+
The following `POST` request creates an account-level phase entry point ruleset for the `http_ratelimit` phase with a single rule that executes a rate limiting ruleset for all Enterprise zones in the account.
175+
176+
:::note
177+
You do not have to use this method to create a phase entry point ruleset — Cloudflare automatically creates the entry point ruleset when you add a rule to it, if it does not exist. Refer to [Add rules to phase entry point rulesets](/ruleset-engine/basic-operations/add-rule-phase-rulesets/) for more information.
178+
:::
179+
180+
```bash
181+
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/rulesets \
182+
--header "Authorization: Bearer <API_TOKEN>" \
183+
--header "Content-Type: application/json" \
184+
--data '{
185+
"name": "Account-level phase entry point",
186+
"kind": "root",
187+
"description": "This ruleset executes a rate limiting ruleset.",
188+
"rules": [
189+
{
190+
"action": "execute",
191+
"expression": "(cf.zone.plan eq \"ENT\")",
192+
"action_parameters": {
193+
"id": "<RATE_LIMITING_RULESET_ID>"
194+
}
195+
}
196+
],
197+
"phase": "http_ratelimit"
198+
}'
199+
```
200+
201+
```json output
202+
{
203+
"result": {
204+
"id": "<RULESET_ID>",
205+
"name": "Account-level phase entry point",
206+
"description": "This ruleset executes a rate limiting ruleset.",
207+
"kind": "root",
208+
"version": "1",
209+
"rules": [
210+
{
211+
"id": "<RULE_ID>",
212+
"version": "1",
213+
"action": "execute",
214+
"expression": "(cf.zone.plan eq \"ENT\")",
215+
"action_parameters": {
216+
"id": "<RATE_LIMITING_RULESET_ID>"
217+
},
218+
"last_updated": "2024-09-17T15:42:37.917815Z"
219+
}
220+
],
221+
"last_updated": "2024-09-17T15:42:37.917815Z",
222+
"phase": "http_ratelimit"
223+
},
224+
"success": true,
225+
"errors": [],
226+
"messages": []
227+
}
228+
```
229+
230+
<Render file="account-enterprise-zones-only-api" product="waf" />

src/content/docs/terraform/additional-configurations/waf-managed-rulesets.mdx

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -183,10 +183,7 @@ The following example adds three [overrides](/ruleset-engine/managed-rulesets/ov
183183
- A rule override for rule with ID `75a0060762034a6cb663fd51a02344cb` disabling the rule.
184184
- A tag override for the `wordpress` tag, setting the action of all the rules with this tag to `js_challenge`.
185185

186-
:::caution[Important]
187-
188-
Ruleset overrides and tag overrides apply to both existing and **future** rules in the managed ruleset. If you wish to override existing rules only, you must use rule overrides.
189-
:::
186+
<Render file="managed-ruleset-override-warning" product="waf" />
190187

191188
The following configuration includes the three overrides in the rule that executes the Cloudflare Managed Ruleset:
192189

0 commit comments

Comments
 (0)