You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
| Cache Domain Purge | Grants access to [purge the edge cache](/cache/how-to/purge-cache/) for a specific domain. |
84
-
| Domain Administrator | Grants full access to domains in an account, and read-only access to account-wide [Firewall](/waf/managed-rules/deploy-account-dashboard/), [Access](/cloudflare-one/policies/access/), and [Worker](/workers/) resources. |
85
-
| Domain Administrator Read Only | Grants read-only access to domains in an account, as well as account-wide [Firewall](/waf/managed-rules/deploy-account-dashboard/), [Access](/cloudflare-one/policies/access/), and [Worker](/workers/) resources. |
84
+
| Domain Administrator | Grants full access to domains in an account, and read-only access to account-wide [Firewall](/waf/account/managed-rulesets/deploy-dashboard/), [Access](/cloudflare-one/policies/access/), and [Worker](/workers/) resources. |
85
+
| Domain Administrator Read Only | Grants read-only access to domains in an account, as well as account-wide [Firewall](/waf/account/managed-rulesets/deploy-dashboard/), [Access](/cloudflare-one/policies/access/), and [Worker](/workers/) resources. |
86
86
| Domain API Gateway | Grants full access to API Gateway (including [API Shield](/api-shield/)). |
87
87
| Domain API Gateway Read | Grants read access to API Gateway (including [API Shield](/api-shield/)). |
88
88
| Domain DNS | Grants access to edit [DNS settings](/dns/) for domains in an account. |
Copy file name to clipboardExpand all lines: src/content/docs/ruleset-engine/custom-rulesets/index.mdx
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -13,7 +13,7 @@ Use the following workflow to deploy a custom ruleset at the account level:
13
13
14
14
You must create a rule with `execute` action in an entry point ruleset to execute the custom ruleset (step 3 in the previous procedure). If you skip this step, the rules of the custom ruleset will not run.
15
15
16
-
Custom rulesets are currently only supported by the [Cloudflare WAF](/waf/).
16
+
Currently, custom rulesets are only supported by the [Cloudflare WAF](/waf/).
17
17
18
18
:::caution
19
19
You cannot execute a custom ruleset from another custom ruleset, only from an entry point ruleset.
You can deploy a managed ruleset at the zone level or at the account level.
9
11
10
12
To deploy a managed ruleset to a phase, use the [Rulesets API](/ruleset-engine/rulesets-api/).
@@ -14,133 +16,27 @@ To deploy a managed ruleset to a phase, use the [Rulesets API](/ruleset-engine/r
14
16
Use the following workflow to deploy a managed ruleset to a phase at the zone level.
15
17
16
18
1. Get your [zone ID](/fundamentals/setup/find-account-and-zone-ids/).
17
-
2. Invoke the [List account rulesets](/api/operations/listAccountRulesets) operation to obtain the available rulesets. Managed rulesets exist at the account level, but you can deploy them to a zone. Find the ruleset ID of the managed ruleset you wish to deploy.
19
+
2. Invoke the [List account rulesets](/api/operations/listAccountRulesets) operation to obtain the available managed rulesets. Managed rulesets exist at the account level, but you can deploy them to a zone. Find the ruleset ID of the managed ruleset you want to deploy.
18
20
3. Identify the [phase](/ruleset-engine/about/phases/) where you want to deploy the managed ruleset. Ensure that the managed ruleset belongs to the same phase where you want to deploy it. To learn more about the available phases supported by each Cloudflare product, refer to the specific documentation for that product, or the [Phases list](/ruleset-engine/reference/phases-list/).
19
-
4. Add a rule to the zone-level phase [entry point ruleset](/ruleset-engine/about/rulesets/#entry-point-ruleset) that executes the managed ruleset.
21
+
4. Add a rule to the zone-level phase [entry point ruleset](/ruleset-engine/about/rulesets/#entry-point-ruleset) that executes the managed ruleset. Refer to the following example for details on this step.
20
22
21
23
### Example
22
24
23
-
The following example deploys a managed ruleset to the `http_request_firewall_managed` phase of a given zone (`{zone_id}`) by creating a rule that executes the managed ruleset.
"description": "Execute Cloudflare Managed Ruleset on my zone-level phase entry point",
63
-
"last_updated": "2021-03-18T18:08:14.003361Z",
64
-
"ref": "<RULE_REF_1>",
65
-
"enabled": true
66
-
}
67
-
],
68
-
"last_updated": "2021-03-18T18:08:14.003361Z",
69
-
"phase": "http_request_firewall_managed"
70
-
},
71
-
"success": true,
72
-
"errors": [],
73
-
"messages": []
74
-
}
75
-
```
27
+
In this example, the managed ruleset executes the behavior configured by Cloudflare. To customize the behavior of managed rulesets, refer to [Override a managed ruleset](/ruleset-engine/managed-rulesets/override-managed-ruleset/).
76
28
77
29
## Deploy a managed ruleset to a phase at the account level
78
30
79
31
Use the following workflow to deploy a managed ruleset to a phase at the account level.
80
32
81
33
1. Get your [account ID](/fundamentals/setup/find-account-and-zone-ids/).
82
-
2. Invoke the [List account rulesets](/api/operations/listAccountRulesets) operation to obtain the available rulesets. Find the ruleset ID of the managed ruleset you wish to deploy.
34
+
2. Invoke the [List account rulesets](/api/operations/listAccountRulesets) operation to obtain the available managed rulesets. Find the ruleset ID of the managed ruleset you want to deploy.
83
35
3. Identify the [phase](/ruleset-engine/about/phases/) where you want to deploy the managed ruleset. Ensure that the managed ruleset belongs to the same phase where you want to deploy it. To learn more about the available phases supported by each Cloudflare product, refer to the specific documentation for that product, or the [Phases list](/ruleset-engine/reference/phases-list/).
84
-
4. Add a rule to the account-level phase [entry point ruleset](/ruleset-engine/about/rulesets/#entry-point-ruleset) that executes the managed ruleset. Use parentheses to enclose any custom conditions in the rule expression and end your expression with `and cf.zone.plan eq "ENT"` so that it only applies to zones on an Enterprise plan.
36
+
4. Add a rule to the account-level phase [entry point ruleset](/ruleset-engine/about/rulesets/#entry-point-ruleset) that executes the managed ruleset. Use parentheses to enclose any custom conditions in the rule expression and end your expression with `and cf.zone.plan eq "ENT"` so that it only applies to zones on an Enterprise plan. Refer to the following example for details on this step.
85
37
86
38
### Example
87
39
88
-
The following example deploys a managed ruleset to the `http_request_firewall_managed` phase of your account (`{account_id}`) by creating a rule that executes the managed ruleset. The rules in the managed ruleset are executed when the zone name matches one of `example.com` or `anotherexample.com`.
89
-
90
-
:::caution
91
-
Managed rulesets deployed at the account level will only apply to incoming traffic of zones on an Enterprise plan. The expression of your `execute` rule must end with `and cf.zone.plan eq "ENT"` or else the operation will fail.
In these examples, the managed ruleset executes the behavior configured by Cloudflare. To customize the behavior of managed rulesets, refer to [Override a managed ruleset](/ruleset-engine/managed-rulesets/override-managed-ruleset/).
42
+
In this example, the managed ruleset executes the behavior configured by Cloudflare. To customize the behavior of managed rulesets, refer to [Override a managed ruleset](/ruleset-engine/managed-rulesets/override-managed-ruleset/).
Copy file name to clipboardExpand all lines: src/content/docs/ruleset-engine/managed-rulesets/override-managed-ruleset.mdx
+2-4Lines changed: 2 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -5,7 +5,7 @@ sidebar:
5
5
order: 3
6
6
---
7
7
8
-
import { Details } from"~/components";
8
+
import { Render, Details } from"~/components";
9
9
10
10
To customize the behavior of a managed ruleset, override the ruleset at deployment. When you override a ruleset you specify changes to be executed on top of the default configuration. These changes take precedence over the ruleset's default behavior.
11
11
@@ -23,9 +23,7 @@ You can override a ruleset at three levels:
23
23
24
24
Specific overrides take precedence over more general ones, and rule overrides take precedence over tag overrides, which take precedence over ruleset overrides.
25
25
26
-
:::caution
27
-
Ruleset overrides and tag overrides apply to both existing and **future** rules in the managed ruleset. If you wish to override existing rules only, you must use rule overrides.
## Example - Create a zone-level phase entry point ruleset
113
113
114
-
The following example request creates a zone-level phase entry point ruleset at the `http_request_firewall_managed` phase with a single rule that executes a managed ruleset.
114
+
The following `POST` request creates a zone-level phase entry point ruleset at the `http_request_firewall_managed` phase with a single rule that executes a managed ruleset.
## Example - Create an account-level phase entry point ruleset
173
+
174
+
The following `POST` request creates an account-level phase entry point ruleset for the `http_ratelimit` phase with a single rule that executes a rate limiting ruleset for all Enterprise zones in the account.
175
+
176
+
:::note
177
+
You do not have to use this method to create a phase entry point ruleset — Cloudflare automatically creates the entry point ruleset when you add a rule to it, if it does not exist. Refer to [Add rules to phase entry point rulesets](/ruleset-engine/basic-operations/add-rule-phase-rulesets/) for more information.
Copy file name to clipboardExpand all lines: src/content/docs/terraform/additional-configurations/waf-managed-rulesets.mdx
+1-4Lines changed: 1 addition & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -183,10 +183,7 @@ The following example adds three [overrides](/ruleset-engine/managed-rulesets/ov
183
183
- A rule override for rule with ID `75a0060762034a6cb663fd51a02344cb` disabling the rule.
184
184
- A tag override for the `wordpress` tag, setting the action of all the rules with this tag to `js_challenge`.
185
185
186
-
:::caution[Important]
187
-
188
-
Ruleset overrides and tag overrides apply to both existing and **future** rules in the managed ruleset. If you wish to override existing rules only, you must use rule overrides.
0 commit comments