@@ -14,245 +14,73 @@ In the [Configure HTTPS settings](/terraform/tutorial/configure-https-settings/)
1414
1515Specifically, you will increase the security level for a URL known to be expensive to render and cannot be cached: ` https://www.example.com/expensive-db-call ` . Additionally, you will add a redirect from the previous URL used to host this page.
1616
17- <Render file = " v4-code-snippets" product = " terraform" />
18-
19- ## 1. Create a new branch and append the page rule
17+ ## 1. Create Page Rules configuration
2018
2119Create a new branch and append the configuration.
2220
2321``` bash
2422git checkout -b step5-pagerule
2523```
2624
27- ``` bash output
28- Switched to a new branch ' step5-pagerule'
29- ```
30-
31- ``` sh
32-
33- cat >> cloudflare.tf << 'EOF '
34- resource "cloudflare_page_rule" "increase-security-on-expensive-page" {
25+ Page Rules let you override zone settings for specific URL patterns. Add two Page Rules to your ` main.tf ` :
26+ ``` hcl
27+ # Increase security for expensive database operations
28+ resource "cloudflare_page_rule" "expensive_endpoint_security" {
3529 zone_id = var.zone_id
36- target = "www. ${var.domain}/expensive-db-call"
30+ target = "${var.domain}/expensive-db-call"
3731 priority = 1
38-
39- actions {
32+
33+ actions = {
4034 security_level = "under_attack"
4135 }
4236}
4337
44- resource "cloudflare_page_rule" "redirect-to-new-db-page" {
38+ # Redirect old URLs to new location
39+ resource "cloudflare_page_rule" "legacy_redirect" {
4540 zone_id = var.zone_id
46- target = "www. ${var.domain}/old-location.php"
41+ target = "${var.domain}/old-location.php"
4742 priority = 2
48-
49- actions {
50- forwarding_url {
51- url = "https://www.${var.domain}/expensive-db-call"
43+
44+ actions = {
45+ forwarding_url = {
46+ url = "https://www.${var.domain}/expensive-db-call"
5247 status_code = 301
5348 }
5449 }
5550}
56- EOF
5751```
52+ The first rule increases security to "Under Attack" mode for your database endpoint. The second rule redirects old URLs with a 301 permanent redirect.
5853
59- ## 2. Preview and merge the changes
60-
61- Preview the changes Terraform will make and then merge them into the ` master ` branch.
62-
54+ ## 2. Preview and apply the changes:
6355``` sh
6456terraform plan
57+ terraform apply
6558```
66-
67- ``` sh output
68- cloudflare_record.www-asia: Refreshing state... [id= fda39d8c9bf909132e82a36bab992864]
69- cloudflare_record.www: Refreshing state... [id= c38d3103767284e7cd14d5dad3ab8669]
70- cloudflare_zone_settings_override.example-com-settings: Refreshing state... [id= e2e6491340be87a3726f91fc4148b126]
71- cloudflare_load_balancer_monitor.get-root-https: Refreshing state... [id= 4238142473fcd48e89ef1964be72e3e0]
72- cloudflare_load_balancer_pool.www-servers: Refreshing state... [id= 906d2a7521634783f4a96c062eeecc6d]
73- cloudflare_load_balancer.www-lb: Refreshing state... [id= cb94f53f150e5c1a65a07e43c5d4cac4]
74-
75- Terraform used the selected providers to generate the following execution plan.
76- Resource actions are indicated with the following symbols:
77- + create
78-
79- Terraform will perform the following actions:
80-
81- # cloudflare_page_rule.increase-security-on-expensive-page will be created
82- + resource " cloudflare_page_rule" " increase-security-on-expensive-page" {
83- + id = (known after apply)
84- + priority = 1
85- + status = " active"
86- + target = " www.example.com/expensive-db-call"
87- + zone_id = " e2e6491340be87a3726f91fc4148b126"
88-
89- + actions {
90- + always_use_https = false
91- + disable_apps = false
92- + disable_performance = false
93- + disable_security = false
94- + disable_zaraz = false
95- + security_level = " under_attack"
96- }
97- }
98-
99- # cloudflare_page_rule.redirect-to-new-db-page will be created
100- + resource " cloudflare_page_rule" " redirect-to-new-db-page" {
101- + id = (known after apply)
102- + priority = 2
103- + status = " active"
104- + target = " www.example.com/old-location.php"
105- + zone_id = " e2e6491340be87a3726f91fc4148b126"
106-
107- + actions {
108- + always_use_https = false
109- + disable_apps = false
110- + disable_performance = false
111- + disable_security = false
112- + disable_zaraz = false
113-
114- + forwarding_url {
115- + status_code = 301
116- + url = " https://www.example.com/expensive-db-call"
117- }
118- }
119- }
120-
121- Plan: 2 to add, 0 to change, 0 to destroy.
122-
123- ------------------------------------------------------------------------
124-
125- Note: You didn' t use the -out option to save this plan, so Terraform can' t
126- guarantee to take exactly these actions if you run " terraform apply" now.
127- ` ` `
128-
129- ` ` ` sh
130-
131- git add cloudflare.tf
132- git commit -m " Step 5 - Add two Page Rules."
133- ` ` `
134-
135- ` ` ` sh output
136- [step5-pagerule d4fec16] Step 5 - Add two Page Rules.
137- 1 file changed, 23 insertions(+)
138- ` ` `
139-
140- ` ` ` sh
141- git checkout master
142- ` ` `
143-
144- ` ` ` sh output
145- Switched to branch ' master'
146- ` ` `
147-
148- ` ` ` sh
149- git merge step5-pagerule
150- ` ` `
151-
152- ` ` ` sh output
153- Updating 7a2ac34..d4fec16
154- Fast-forward
155- cloudflare.tf | 23 +++++++++++++++++++++++
156- 1 file changed, 23 insertions(+)
157- ` ` `
158-
159- # # 3. Apply and verify the changes
160-
161- First, test request the (now missing) old location of the expensive-to-render page.
162-
163- ` ` ` sh
164- curl -vso /dev/null https://www.example.com/old-location.php 2>&1 | grep " < HTTP\|Location"
165- ` ` `
166-
167- ` ` ` sh output
168- < HTTP/1.1 404 Not Found
169- ` ` `
170-
171- As expected, the location cannot be found. Apply the Page Rules, including the redirect that should fix this error.
172-
173- ` ` ` sh
174- terraform apply --auto-approve
175- ` ` `
176-
177- ` ` ` sh output
178- cloudflare_record.www-asia: Refreshing state... [id= fda39d8c9bf909132e82a36bab992864]
179- cloudflare_load_balancer_monitor.get-root-https: Refreshing state... [id= 4238142473fcd48e89ef1964be72e3e0]
180- cloudflare_zone_settings_override.example-com-settings: Refreshing state... [id= e2e6491340be87a3726f91fc4148b126]
181- cloudflare_record.www: Refreshing state... [id= c38d3103767284e7cd14d5dad3ab8669]
182- cloudflare_load_balancer_pool.www-servers: Refreshing state... [id= 906d2a7521634783f4a96c062eeecc6d]
183- cloudflare_load_balancer.www-lb: Refreshing state... [id= cb94f53f150e5c1a65a07e43c5d4cac4]
184-
185- Terraform used the selected providers to generate the following execution plan.
186- Resource actions are indicated with the following symbols:
187- + create
188-
189- Terraform will perform the following actions:
190-
191- # cloudflare_page_rule.increase-security-on-expensive-page will be created
192- + resource " cloudflare_page_rule" " increase-security-on-expensive-page" {
193- + id = (known after apply)
194- + priority = 1
195- + status = " active"
196- + target = " www.example.com/expensive-db-call"
197- + zone_id = " e2e6491340be87a3726f91fc4148b126"
198-
199- + actions {
200- + always_use_https = false
201- + disable_apps = false
202- + disable_performance = false
203- + disable_security = false
204- + disable_zaraz = false
205- + security_level = " under_attack"
206- }
207- }
208-
209- # cloudflare_page_rule.redirect-to-new-db-page will be created
210- + resource " cloudflare_page_rule" " redirect-to-new-db-page" {
211- + id = (known after apply)
212- + priority = 2
213- + status = " active"
214- + target = " www.example.com/old-location.php"
215- + zone_id = " e2e6491340be87a3726f91fc4148b126"
216-
217- + actions {
218- + always_use_https = false
219- + disable_apps = false
220- + disable_performance = false
221- + disable_security = false
222- + disable_zaraz = false
223-
224- + forwarding_url {
225- + status_code = 301
226- + url = " https://www.example.com/expensive-db-call"
227- }
228- }
229- }
230-
231- cloudflare_page_rule.redirect-to-new-db-page: Creating...
232- cloudflare_page_rule.increase-security-on-expensive-page: Creating...
233- cloudflare_page_rule.redirect-to-new-db-page: Creation complete after 3s [id= c5c40ff2dc12416b5fe4d0541980c591]
234- cloudflare_page_rule.increase-security-on-expensive-page: Creation complete after 6s [id= 1c13fdb84710c4cc8b11daf7ffcca449]
235-
236- Apply complete! Resources: 2 added, 0 changed, 0 destroyed.
59+ ## 3. Verify changes:
60+ Test the redirect functionality:
61+ ``` bash
62+ curl -I https://example.com/old-location.php
23763```
238-
239- With the Page Rules in place, try that call again, along with a test for the Under Attack mode:
240-
241- ` ` ` sh
242- curl -vso /dev/null https://www.example.com/old-location.php 2>&1 | grep " < HTTP\|Location"
64+ Expected output:
65+ ``` bash output
66+ HTTP/1.1 301 Moved Permanently
67+ Location: https://example.com/expensive-db-call
24368```
244-
245- ` ` ` sh output
246- < HTTP/1.1 301 Moved Permanently
247- < Location: https://www.example.com/expensive-db-call
69+ Test the increased security (Under Attack mode returns a challenge page):
70+ ``` bash
71+ curl -I https://example.com/expensive-db-call
24872```
249-
250- ` ` ` sh
251- curl -vso /dev/null https://www.example.com/expensive-db-call 2>&1 | grep " < HTTP "
73+ Expected output:
74+ ``` bash output
75+ HTTP/1.1 503 Service Temporarily Unavailable
25276```
77+ The 503 response indicates the Under Attack mode is active, presenting visitors with a challenge page before allowing access to protect against DDoS attacks.
25378
254- ` ` ` sh output
255- < HTTP/1.1 503 Service Temporarily Unavailable
79+ ## 4. Commit and merge the changes:
80+ ``` bash
81+ git add main.tf
82+ git commit -m " Step 5 - Add two Page Rules"
83+ git push
25684```
25785
25886The call works as expected. In the first case, the Cloudflare global network responds with a ` 301 ` redirecting the browser to the new location. In the second case, the Cloudflare global network initially responds with a ` 503 ` , which is consistent with the Under Attack mode.
0 commit comments