[WAF] Add Terraform v5 examples (#30591)

* Leaked creds: Add TF v5 example
* Content scanning: Add TF v5 example
* Cloudflare Managed Ruleset: Add TF v5 example

Author: pedrosousa

src/content/docs/waf/detections/leaked-credentials/terraform-examples.mdx

@@ -14,7 +14,7 @@ tags:
   - Terraform
 ---
 
-import { Render } from "~/components";
+import { Details, Render, Tabs, TabItem } from "~/components";
 
 The following Terraform configuration examples address common scenarios for managing, configuring, and using leaked credentials detection.
 
@@ -41,11 +41,42 @@ This example adds a [custom rule](/waf/custom-rules/) that challenges requests w
 
 To use the [`cf.waf.credential_check.username_and_password_leaked`](/ruleset-engine/rules-language/fields/reference/cf.waf.credential_check.username_and_password_leaked/) field you must [enable leaked credentials detection](#enable-leaked-credentials-detection).
 
-<Render file="v4-code-snippets" product="terraform" />
+<Tabs syncKey="terraformVersion">
+<TabItem label="Terraform (v5)">
+
+<Details header="Required API token permissions">
+
+At least one of the following [token permissions](/fundamentals/api/reference/permissions/) is required:
+
+- `Zone WAF Write`
+
+</Details>
+
+Configure the [`cloudflare_ruleset`](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/ruleset) resource:
 
 ```tf
 resource "cloudflare_ruleset" "zone_custom_firewall_leaked_creds" {
-  zone_id     = "<ZONE_ID>"
+  zone_id     = var.cloudflare_zone_id
+  name        = "Phase entry point ruleset for custom rules in my zone"
+  description = ""
+  kind        = "zone"
+  phase       = "http_request_firewall_custom"
+
+  rules = [{
+    ref         = "challenge_leaked_username_password"
+    description = "Challenge requests with a leaked username and password"
+    expression  = "(cf.waf.credential_check.username_and_password_leaked)"
+    action      = "managed_challenge"
+  }]
+}
+```
+
+</TabItem>
+<TabItem label="Terraform (v4)">
+
+```tf
+resource "cloudflare_ruleset" "zone_custom_firewall_leaked_creds" {
+  zone_id     = var.cloudflare_zone_id
   name        = "Phase entry point ruleset for custom rules in my zone"
   description = ""
   kind        = "zone"
@@ -60,6 +91,9 @@ resource "cloudflare_ruleset" "zone_custom_firewall_leaked_creds" {
 }
 ```
 
+</TabItem>
+</Tabs>
+
 ## More resources
 
 For additional Terraform configuration examples, refer to [WAF custom rules configuration using Terraform](/terraform/additional-configurations/waf-custom-rules/).

src/content/docs/waf/detections/malicious-uploads/terraform-examples.mdx

@@ -14,7 +14,7 @@ tags:
   - Terraform
 ---
 
-import { Render, GlossaryTooltip } from "~/components";
+import { Details, GlossaryTooltip, Render, Tabs, TabItem } from "~/components";
 
 The following Terraform configuration examples address common scenarios for managing, configuring, and using WAF content scanning.
 
@@ -41,11 +41,42 @@ This example adds a [custom rule](/waf/custom-rules/) that blocks requests with
 
 To use the [`cf.waf.content_scan.has_malicious_obj`](/ruleset-engine/rules-language/fields/reference/cf.waf.content_scan.has_malicious_obj/) field you must [enable content scanning](#enable-waf-content-scanning).
 
-<Render file="v4-code-snippets" product="terraform" />
+<Tabs syncKey="terraformVersion">
+<TabItem label="Terraform (v5)">
+
+<Details header="Required API token permissions">
+
+At least one of the following [token permissions](/fundamentals/api/reference/permissions/) is required:
+
+- `Zone WAF Write`
+
+</Details>
+
+Configure the [`cloudflare_ruleset`](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/ruleset) resource:
 
 ```tf
 resource "cloudflare_ruleset" "zone_custom_firewall_malicious_uploads" {
-  zone_id     = "<ZONE_ID>"
+  zone_id     = var.cloudflare_zone_id
+  name        = "Phase entry point ruleset for custom rules in my zone"
+  description = ""
+  kind        = "zone"
+  phase       = "http_request_firewall_custom"
+
+  rules = [{
+    ref         = "block_malicious_uploads"
+    description = "Block requests uploading malicious content objects"
+    expression  = "(cf.waf.content_scan.has_malicious_obj and http.request.uri.path eq \"/upload.php\")"
+    action      = "block"
+  }]
+}
+```
+
+</TabItem>
+<TabItem label="Terraform (v4)">
+
+```tf
+resource "cloudflare_ruleset" "zone_custom_firewall_malicious_uploads" {
+  zone_id     = var.cloudflare_zone_id
   name        = "Phase entry point ruleset for custom rules in my zone"
   description = ""
   kind        = "zone"
@@ -60,6 +91,9 @@ resource "cloudflare_ruleset" "zone_custom_firewall_malicious_uploads" {
 }
 ```
 
+</TabItem>
+</Tabs>
+
 ## More resources
 
 For additional Terraform configuration examples, refer to [WAF custom rules configuration using Terraform](/terraform/additional-configurations/waf-custom-rules/).

src/content/docs/waf/managed-rules/reference/cloudflare-managed-ruleset.mdx

@@ -8,7 +8,7 @@ sidebar:
   order: 2
 ---
 
-import { Render, Tabs, TabItem, Markdown } from "~/components";
+import { Details, Markdown, Render, Tabs, TabItem } from "~/components";
 
 export const availableActions =
 	"The available actions are: _Block_, _Log_, _Non-Interactive Challenge_, _Managed Challenge_, and _Interactive Challenge_.";
@@ -167,12 +167,55 @@ To deploy the Cloudflare Managed Ruleset for a given zone via API, create a rule
 
 The following example deploys the Cloudflare Managed Ruleset for a zone and overrides the action and status of a specific rule.
 
-<Render file="v4-code-snippets" product="terraform" />
+<Tabs syncKey="terraformVersion">
+<TabItem label="Terraform (v5)">
+
+<Details header="Required API token permissions">
+
+At least one of the following [token permissions](/fundamentals/api/reference/permissions/) is required:
+
+- `Zone WAF Write`
+
+</Details>
+
+Configure the [`cloudflare_ruleset`](https://registry.terraform.io/providers/cloudflare/cloudflare/latest/docs/resources/ruleset) resource:
 
 ```tf
 # Configure a ruleset at the zone level for the "http_request_firewall_managed" phase
 resource "cloudflare_ruleset" "zone_level_managed_waf" {
-  zone_id     = "<ZONE_ID>"
+  zone_id     = var.cloudflare_zone_id
+  name        = "Managed WAF entry point ruleset"
+  description = "Zone-level WAF Managed Rules config"
+  kind        = "zone"
+  phase       = "http_request_firewall_managed"
+
+  # Execute Cloudflare Managed Ruleset
+  rules = [{
+    ref         = "execute_cloudflare_managed_ruleset"
+    description = "Execute Cloudflare Managed Ruleset on my zone-level phase entry point ruleset"
+    expression  = "true"
+    action      = "execute"
+    action_parameters = {
+      id = "efb7b8c949ac4650a09736fc376e9aee"
+      overrides = {
+        rules = [{
+          id      = "5de7edfa648c4d6891dc3e7f84534ffa"
+          action  = "log"
+          enabled = true
+        }]
+      }
+    }
+  }]
+}
+```
+
+</TabItem>
+<TabItem label="Terraform (v4)">
+
+```tf
+# Configure a ruleset at the zone level for the "http_request_firewall_managed" phase
+resource "cloudflare_ruleset" "zone_level_managed_waf" {
+  zone_id     = var.cloudflare_zone_id
   name        = "Managed WAF entry point ruleset"
   description = "Zone-level WAF Managed Rules config"
   kind        = "zone"
@@ -198,4 +241,7 @@ resource "cloudflare_ruleset" "zone_level_managed_waf" {
 }
 ```
 
+</TabItem>
+</Tabs>
+
 For more information, refer to [WAF Managed Rules configuration using Terraform](/terraform/additional-configurations/waf-managed-rulesets/).

src/content/partials/waf/detections/leaked-credentials-configure-location-terraform.mdx

@@ -6,7 +6,7 @@ Use the `cloudflare_leaked_credential_check_rule` resource to add a custom detec
 
 ```terraform
 resource "cloudflare_leaked_credential_check_rule" "custom_location_example" {
-	zone_id = "<ZONE_ID>"
+	zone_id = var.cloudflare_zone_id
 	username = "lookup_json_string(http.request.body.raw, \"user\")"
 	password = "lookup_json_string(http.request.body.raw, \"secret\")"
 }

src/content/partials/waf/detections/leaked-credentials-enable-terraform.mdx

@@ -6,7 +6,7 @@ Use the `cloudflare_leaked_credential_check` resource to enable leaked credentia
 
 ```terraform
 resource "cloudflare_leaked_credential_check" "zone_lcc_example" {
-	zone_id = "<ZONE_ID>"
+	zone_id = var.cloudflare_zone_id
 	enabled = true
 }
 ```

src/content/partials/waf/detections/malicious-uploads-configure-expression-terraform.mdx

@@ -6,7 +6,7 @@ Use the `cloudflare_content_scanning_expression` resource to add a custom scan e
 
 ```terraform
 resource "cloudflare_content_scanning_expression" "my_custom_scan_expression" {
-  zone_id = <ZONE_ID>
+  zone_id = var.cloudflare_zone_id
   payload = "lookup_json_string(http.request.body.raw, \"file\")"
 }
 ```

src/content/partials/waf/detections/malicious-uploads-enable-terraform.mdx

@@ -6,7 +6,7 @@ Use the `cloudflare_content_scanning` resource to enable content scanning for a
 
 ```terraform
 resource "cloudflare_content_scanning" "zone_content_scanning_example" {
-	zone_id = "<ZONE_ID>"
+	zone_id = var.cloudflare_zone_id
 	enabled = true
 }
 ```