你当前正在访问 Microsoft Azure Global Edition 技术文档网站。如果需要访问由世纪互联运营的 Microsoft Azure 中国技术文档网站，请访问 https://docs.azure.cn。

Policies - Create Or Update

参考

服务:: Front Door Service

API 版本:: 2024-02-01

在资源组中创建或更新具有指定规则集名称的策略。

PUT https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/FrontDoorWebApplicationFirewallPolicies/{policyName}?api-version=2024-02-01

URI 参数

名称	在	必需	类型	说明
policyName	path	True	string maxLength: 128	Web 应用程序防火墙策略的名称。
resourceGroupName	path	True	string minLength: 1 maxLength: 80 pattern: ^[a-zA-Z0-9_\-\.]*[^\.]$	Azure 订阅中的资源组的名称。
subscriptionId	path	True	string	唯一标识 Azure 订阅Microsoft的订阅凭据。订阅 ID 构成了每个服务调用的 URI 的一部分。
api-version	query	True	string	客户端 API 版本。

请求正文

名称	类型	说明
etag	string	获取在更新资源时更改的唯一只读字符串。
location	string	资源位置。
properties.customRules	CustomRuleList	描述策略中的自定义规则。
properties.managedRules	ManagedRuleSetList	描述策略中的托管规则。
properties.policySettings	PolicySettings	描述策略的设置。
sku	Sku	Web 应用程序防火墙策略的定价层。如果未指定，则默认为Classic_AzureFrontDoor。
tags	object	资源标记。

响应

名称	类型	说明
200 OK	WebApplicationFirewallPolicy	还行。请求已成功。
201 Created	WebApplicationFirewallPolicy	创建。请求已完成，并创建了新的保护策略。
202 Accepted	WebApplicationFirewallPolicy	已接受。请求已接受进行处理，操作将以异步方式完成。
Other Status Codes	ErrorResponse	描述操作失败的原因的错误响应。

安全性

azure_auth

Azure Active Directory OAuth2 Flow

类型: oauth2
流向: implicit
授权 URL: https://login.microsoftonline.com/common/oauth2/authorize

作用域

名称	说明
user_impersonation	模拟用户帐户

示例

Creates specific policy

示例请求

PUT https://management.azure.com/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/FrontDoorWebApplicationFirewallPolicies/Policy1?api-version=2024-02-01

{
  "location": "WestUs",
  "properties": {
    "policySettings": {
      "enabledState": "Enabled",
      "mode": "Prevention",
      "redirectUrl": "http://www.bing.com",
      "customBlockResponseStatusCode": 429,
      "customBlockResponseBody": "PGh0bWw+CjxoZWFkZXI+PHRpdGxlPkhlbGxvPC90aXRsZT48L2hlYWRlcj4KPGJvZHk+CkhlbGxvIHdvcmxkCjwvYm9keT4KPC9odG1sPg==",
      "requestBodyCheck": "Disabled",
      "javascriptChallengeExpirationInMinutes": 30,
      "logScrubbing": {
        "state": "Enabled",
        "scrubbingRules": [
          {
            "matchVariable": "RequestIPAddress",
            "selectorMatchOperator": "EqualsAny",
            "selector": null,
            "state": "Enabled"
          }
        ]
      }
    },
    "customRules": {
      "rules": [
        {
          "name": "Rule1",
          "priority": 1,
          "ruleType": "RateLimitRule",
          "rateLimitThreshold": 1000,
          "matchConditions": [
            {
              "matchVariable": "RemoteAddr",
              "operator": "IPMatch",
              "matchValue": [
                "192.168.1.0/24",
                "10.0.0.0/24"
              ]
            }
          ],
          "action": "Block"
        },
        {
          "name": "Rule2",
          "priority": 2,
          "ruleType": "MatchRule",
          "matchConditions": [
            {
              "matchVariable": "RemoteAddr",
              "operator": "GeoMatch",
              "matchValue": [
                "CH"
              ]
            },
            {
              "matchVariable": "RequestHeader",
              "operator": "Contains",
              "selector": "UserAgent",
              "matchValue": [
                "windows"
              ],
              "transforms": [
                "Lowercase"
              ]
            }
          ],
          "action": "Block"
        }
      ]
    },
    "managedRules": {
      "managedRuleSets": [
        {
          "ruleSetType": "DefaultRuleSet",
          "ruleSetVersion": "1.0",
          "ruleSetAction": "Block",
          "exclusions": [
            {
              "matchVariable": "RequestHeaderNames",
              "selectorMatchOperator": "Equals",
              "selector": "User-Agent"
            }
          ],
          "ruleGroupOverrides": [
            {
              "ruleGroupName": "SQLI",
              "exclusions": [
                {
                  "matchVariable": "RequestCookieNames",
                  "selectorMatchOperator": "StartsWith",
                  "selector": "token"
                }
              ],
              "rules": [
                {
                  "ruleId": "942100",
                  "enabledState": "Enabled",
                  "action": "Redirect",
                  "exclusions": [
                    {
                      "matchVariable": "QueryStringArgNames",
                      "selectorMatchOperator": "Equals",
                      "selector": "query"
                    }
                  ]
                },
                {
                  "ruleId": "942110",
                  "enabledState": "Disabled"
                }
              ]
            }
          ]
        }
      ]
    }
  },
  "sku": {
    "name": "Premium_AzureFrontDoor"
  }
}


import com.azure.resourcemanager.frontdoor.models.ActionType;
import com.azure.resourcemanager.frontdoor.models.CustomRule;
import com.azure.resourcemanager.frontdoor.models.CustomRuleList;
import com.azure.resourcemanager.frontdoor.models.ManagedRuleEnabledState;
import com.azure.resourcemanager.frontdoor.models.ManagedRuleExclusion;
import com.azure.resourcemanager.frontdoor.models.ManagedRuleExclusionMatchVariable;
import com.azure.resourcemanager.frontdoor.models.ManagedRuleExclusionSelectorMatchOperator;
import com.azure.resourcemanager.frontdoor.models.ManagedRuleGroupOverride;
import com.azure.resourcemanager.frontdoor.models.ManagedRuleOverride;
import com.azure.resourcemanager.frontdoor.models.ManagedRuleSet;
import com.azure.resourcemanager.frontdoor.models.ManagedRuleSetActionType;
import com.azure.resourcemanager.frontdoor.models.ManagedRuleSetList;
import com.azure.resourcemanager.frontdoor.models.MatchCondition;
import com.azure.resourcemanager.frontdoor.models.MatchVariable;
import com.azure.resourcemanager.frontdoor.models.Operator;
import com.azure.resourcemanager.frontdoor.models.PolicyEnabledState;
import com.azure.resourcemanager.frontdoor.models.PolicyMode;
import com.azure.resourcemanager.frontdoor.models.PolicyRequestBodyCheck;
import com.azure.resourcemanager.frontdoor.models.PolicySettings;
import com.azure.resourcemanager.frontdoor.models.RuleType;
import com.azure.resourcemanager.frontdoor.models.ScrubbingRuleEntryMatchOperator;
import com.azure.resourcemanager.frontdoor.models.ScrubbingRuleEntryMatchVariable;
import com.azure.resourcemanager.frontdoor.models.ScrubbingRuleEntryState;
import com.azure.resourcemanager.frontdoor.models.Sku;
import com.azure.resourcemanager.frontdoor.models.SkuName;
import com.azure.resourcemanager.frontdoor.models.TransformType;
import com.azure.resourcemanager.frontdoor.models.WebApplicationFirewallScrubbingRules;
import com.azure.resourcemanager.frontdoor.models.WebApplicationFirewallScrubbingState;
import java.util.Arrays;

/**
 * Samples for Policies CreateOrUpdate.
 */
public final class Main {
    /*
     * x-ms-original-file:
     * specification/frontdoor/resource-manager/Microsoft.Network/stable/2024-02-01/examples/WafPolicyCreateOrUpdate.
     * json
     */
    /**
     * Sample code: Creates specific policy.
     * 
     * @param manager Entry point to FrontDoorManager.
     */
    public static void createsSpecificPolicy(com.azure.resourcemanager.frontdoor.FrontDoorManager manager) {
        manager.policies().define("Policy1").withRegion("WestUs").withExistingResourceGroup("rg1")
            .withSku(new Sku().withName(SkuName.PREMIUM_AZURE_FRONT_DOOR))
            .withPolicySettings(new PolicySettings().withEnabledState(PolicyEnabledState.ENABLED)
                .withMode(PolicyMode.PREVENTION).withRedirectUrl("http://www.bing.com")
                .withCustomBlockResponseStatusCode(429)
                .withCustomBlockResponseBody(
                    "PGh0bWw+CjxoZWFkZXI+PHRpdGxlPkhlbGxvPC90aXRsZT48L2hlYWRlcj4KPGJvZHk+CkhlbGxvIHdvcmxkCjwvYm9keT4KPC9odG1sPg==")
                .withRequestBodyCheck(
                    PolicyRequestBodyCheck.DISABLED)
                .withJavascriptChallengeExpirationInMinutes(30).withState(WebApplicationFirewallScrubbingState.ENABLED)
                .withScrubbingRules(Arrays.asList(new WebApplicationFirewallScrubbingRules()
                    .withMatchVariable(ScrubbingRuleEntryMatchVariable.REQUEST_IPADDRESS)
                    .withSelectorMatchOperator(ScrubbingRuleEntryMatchOperator.EQUALS_ANY)
                    .withState(ScrubbingRuleEntryState.ENABLED))))
            .withCustomRules(new CustomRuleList().withRules(Arrays.asList(
                new CustomRule().withName("Rule1").withPriority(1).withRuleType(RuleType.RATE_LIMIT_RULE)
                    .withRateLimitThreshold(1000)
                    .withMatchConditions(Arrays.asList(new MatchCondition().withMatchVariable(MatchVariable.REMOTE_ADDR)
                        .withOperator(Operator.IPMATCH).withMatchValue(Arrays.asList("192.168.1.0/24", "10.0.0.0/24"))))
                    .withAction(ActionType.BLOCK),
                new CustomRule().withName("Rule2").withPriority(2).withRuleType(RuleType.MATCH_RULE)
                    .withMatchConditions(Arrays.asList(
                        new MatchCondition().withMatchVariable(MatchVariable.REMOTE_ADDR)
                            .withOperator(Operator.GEO_MATCH).withMatchValue(Arrays.asList("CH")),
                        new MatchCondition().withMatchVariable(MatchVariable.REQUEST_HEADER).withSelector("UserAgent")
                            .withOperator(Operator.CONTAINS).withMatchValue(Arrays.asList("windows"))
                            .withTransforms(Arrays.asList(TransformType.LOWERCASE))))
                    .withAction(ActionType.BLOCK))))
            .withManagedRules(new ManagedRuleSetList()
                .withManagedRuleSets(Arrays.asList(new ManagedRuleSet().withRuleSetType("DefaultRuleSet")
                    .withRuleSetVersion("1.0").withRuleSetAction(ManagedRuleSetActionType.BLOCK)
                    .withExclusions(Arrays.asList(new ManagedRuleExclusion()
                        .withMatchVariable(ManagedRuleExclusionMatchVariable.REQUEST_HEADER_NAMES)
                        .withSelectorMatchOperator(ManagedRuleExclusionSelectorMatchOperator.EQUALS)
                        .withSelector("User-Agent")))
                    .withRuleGroupOverrides(
                        Arrays.asList(new ManagedRuleGroupOverride().withRuleGroupName("SQLI")
                            .withExclusions(Arrays.asList(new ManagedRuleExclusion()
                                .withMatchVariable(ManagedRuleExclusionMatchVariable.REQUEST_COOKIE_NAMES)
                                .withSelectorMatchOperator(ManagedRuleExclusionSelectorMatchOperator.STARTS_WITH)
                                .withSelector("token")))
                            .withRules(
                                Arrays
                                    .asList(
                                        new ManagedRuleOverride().withRuleId("942100")
                                            .withEnabledState(ManagedRuleEnabledState.ENABLED)
                                            .withAction(ActionType.REDIRECT)
                                            .withExclusions(Arrays.asList(new ManagedRuleExclusion()
                                                .withMatchVariable(
                                                    ManagedRuleExclusionMatchVariable.QUERY_STRING_ARG_NAMES)
                                                .withSelectorMatchOperator(
                                                    ManagedRuleExclusionSelectorMatchOperator.EQUALS)
                                                .withSelector("query"))),
                                        new ManagedRuleOverride().withRuleId("942110")
                                            .withEnabledState(ManagedRuleEnabledState.DISABLED))))))))
            .create();
    }
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

package armfrontdoor_test

import (
	"context"
	"log"

	"github.com/Azure/azure-sdk-for-go/sdk/azcore/to"
	"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/frontdoor/armfrontdoor"
)

// Generated from example definition: https://github.com/Azure/azure-rest-api-specs/blob/b54ffc9278eff071455b1dbb4ad2e772afce885d/specification/frontdoor/resource-manager/Microsoft.Network/stable/2024-02-01/examples/WafPolicyCreateOrUpdate.json
func ExamplePoliciesClient_BeginCreateOrUpdate() {
	cred, err := azidentity.NewDefaultAzureCredential(nil)
	if err != nil {
		log.Fatalf("failed to obtain a credential: %v", err)
	}
	ctx := context.Background()
	clientFactory, err := armfrontdoor.NewClientFactory("<subscription-id>", cred, nil)
	if err != nil {
		log.Fatalf("failed to create client: %v", err)
	}
	poller, err := clientFactory.NewPoliciesClient().BeginCreateOrUpdate(ctx, "rg1", "Policy1", armfrontdoor.WebApplicationFirewallPolicy{
		Location: to.Ptr("WestUs"),
		Properties: &armfrontdoor.WebApplicationFirewallPolicyProperties{
			CustomRules: &armfrontdoor.CustomRuleList{
				Rules: []*armfrontdoor.CustomRule{
					{
						Name:   to.Ptr("Rule1"),
						Action: to.Ptr(armfrontdoor.ActionTypeBlock),
						MatchConditions: []*armfrontdoor.MatchCondition{
							{
								MatchValue: []*string{
									to.Ptr("192.168.1.0/24"),
									to.Ptr("10.0.0.0/24")},
								MatchVariable: to.Ptr(armfrontdoor.MatchVariableRemoteAddr),
								Operator:      to.Ptr(armfrontdoor.OperatorIPMatch),
							}},
						Priority:           to.Ptr[int32](1),
						RateLimitThreshold: to.Ptr[int32](1000),
						RuleType:           to.Ptr(armfrontdoor.RuleTypeRateLimitRule),
					},
					{
						Name:   to.Ptr("Rule2"),
						Action: to.Ptr(armfrontdoor.ActionTypeBlock),
						MatchConditions: []*armfrontdoor.MatchCondition{
							{
								MatchValue: []*string{
									to.Ptr("CH")},
								MatchVariable: to.Ptr(armfrontdoor.MatchVariableRemoteAddr),
								Operator:      to.Ptr(armfrontdoor.OperatorGeoMatch),
							},
							{
								MatchValue: []*string{
									to.Ptr("windows")},
								MatchVariable: to.Ptr(armfrontdoor.MatchVariableRequestHeader),
								Operator:      to.Ptr(armfrontdoor.OperatorContains),
								Selector:      to.Ptr("UserAgent"),
								Transforms: []*armfrontdoor.TransformType{
									to.Ptr(armfrontdoor.TransformTypeLowercase)},
							}},
						Priority: to.Ptr[int32](2),
						RuleType: to.Ptr(armfrontdoor.RuleTypeMatchRule),
					}},
			},
			ManagedRules: &armfrontdoor.ManagedRuleSetList{
				ManagedRuleSets: []*armfrontdoor.ManagedRuleSet{
					{
						Exclusions: []*armfrontdoor.ManagedRuleExclusion{
							{
								MatchVariable:         to.Ptr(armfrontdoor.ManagedRuleExclusionMatchVariableRequestHeaderNames),
								Selector:              to.Ptr("User-Agent"),
								SelectorMatchOperator: to.Ptr(armfrontdoor.ManagedRuleExclusionSelectorMatchOperatorEquals),
							}},
						RuleGroupOverrides: []*armfrontdoor.ManagedRuleGroupOverride{
							{
								Exclusions: []*armfrontdoor.ManagedRuleExclusion{
									{
										MatchVariable:         to.Ptr(armfrontdoor.ManagedRuleExclusionMatchVariableRequestCookieNames),
										Selector:              to.Ptr("token"),
										SelectorMatchOperator: to.Ptr(armfrontdoor.ManagedRuleExclusionSelectorMatchOperatorStartsWith),
									}},
								RuleGroupName: to.Ptr("SQLI"),
								Rules: []*armfrontdoor.ManagedRuleOverride{
									{
										Action:       to.Ptr(armfrontdoor.ActionTypeRedirect),
										EnabledState: to.Ptr(armfrontdoor.ManagedRuleEnabledStateEnabled),
										Exclusions: []*armfrontdoor.ManagedRuleExclusion{
											{
												MatchVariable:         to.Ptr(armfrontdoor.ManagedRuleExclusionMatchVariableQueryStringArgNames),
												Selector:              to.Ptr("query"),
												SelectorMatchOperator: to.Ptr(armfrontdoor.ManagedRuleExclusionSelectorMatchOperatorEquals),
											}},
										RuleID: to.Ptr("942100"),
									},
									{
										EnabledState: to.Ptr(armfrontdoor.ManagedRuleEnabledStateDisabled),
										RuleID:       to.Ptr("942110"),
									}},
							}},
						RuleSetAction:  to.Ptr(armfrontdoor.ManagedRuleSetActionTypeBlock),
						RuleSetType:    to.Ptr("DefaultRuleSet"),
						RuleSetVersion: to.Ptr("1.0"),
					}},
			},
			PolicySettings: &armfrontdoor.PolicySettings{
				CustomBlockResponseBody:                to.Ptr("PGh0bWw+CjxoZWFkZXI+PHRpdGxlPkhlbGxvPC90aXRsZT48L2hlYWRlcj4KPGJvZHk+CkhlbGxvIHdvcmxkCjwvYm9keT4KPC9odG1sPg=="),
				CustomBlockResponseStatusCode:          to.Ptr[int32](429),
				EnabledState:                           to.Ptr(armfrontdoor.PolicyEnabledStateEnabled),
				JavascriptChallengeExpirationInMinutes: to.Ptr[int32](30),
				LogScrubbing: &armfrontdoor.PolicySettingsLogScrubbing{
					ScrubbingRules: []*armfrontdoor.WebApplicationFirewallScrubbingRules{
						{
							MatchVariable:         to.Ptr(armfrontdoor.ScrubbingRuleEntryMatchVariableRequestIPAddress),
							SelectorMatchOperator: to.Ptr(armfrontdoor.ScrubbingRuleEntryMatchOperatorEqualsAny),
							State:                 to.Ptr(armfrontdoor.ScrubbingRuleEntryStateEnabled),
						}},
					State: to.Ptr(armfrontdoor.WebApplicationFirewallScrubbingStateEnabled),
				},
				Mode:             to.Ptr(armfrontdoor.PolicyModePrevention),
				RedirectURL:      to.Ptr("http://www.bing.com"),
				RequestBodyCheck: to.Ptr(armfrontdoor.PolicyRequestBodyCheckDisabled),
			},
		},
		SKU: &armfrontdoor.SKU{
			Name: to.Ptr(armfrontdoor.SKUNamePremiumAzureFrontDoor),
		},
	}, nil)
	if err != nil {
		log.Fatalf("failed to finish the request: %v", err)
	}
	res, err := poller.PollUntilDone(ctx, nil)
	if err != nil {
		log.Fatalf("failed to pull the result: %v", err)
	}
	// You could use response here. We use blank identifier for just demo purposes.
	_ = res
	// If the HTTP response code is 200 as defined in example definition, your response structure would look as follows. Please pay attention that all the values in the output are fake values for just demo purposes.
	// res.WebApplicationFirewallPolicy = armfrontdoor.WebApplicationFirewallPolicy{
	// 	Name: to.Ptr("Policy1"),
	// 	Type: to.Ptr("Microsoft.Network/frontdoorwebapplicationfirewallpolicies"),
	// 	ID: to.Ptr("/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/FrontDoorWebApplicationFirewallPolicies/Policy1"),
	// 	Location: to.Ptr("WestUs"),
	// 	Tags: map[string]*string{
	// 		"key1": to.Ptr("value1"),
	// 		"key2": to.Ptr("value2"),
	// 	},
	// 	Properties: &armfrontdoor.WebApplicationFirewallPolicyProperties{
	// 		CustomRules: &armfrontdoor.CustomRuleList{
	// 			Rules: []*armfrontdoor.CustomRule{
	// 				{
	// 					Name: to.Ptr("Rule1"),
	// 					Action: to.Ptr(armfrontdoor.ActionTypeBlock),
	// 					EnabledState: to.Ptr(armfrontdoor.CustomRuleEnabledStateEnabled),
	// 					MatchConditions: []*armfrontdoor.MatchCondition{
	// 						{
	// 							MatchValue: []*string{
	// 								to.Ptr("192.168.1.0/24"),
	// 								to.Ptr("10.0.0.0/24")},
	// 								MatchVariable: to.Ptr(armfrontdoor.MatchVariableRemoteAddr),
	// 								NegateCondition: to.Ptr(false),
	// 								Operator: to.Ptr(armfrontdoor.OperatorIPMatch),
	// 								Transforms: []*armfrontdoor.TransformType{
	// 								},
	// 						}},
	// 						Priority: to.Ptr[int32](1),
	// 						RateLimitDurationInMinutes: to.Ptr[int32](0),
	// 						RateLimitThreshold: to.Ptr[int32](1000),
	// 						RuleType: to.Ptr(armfrontdoor.RuleTypeRateLimitRule),
	// 					},
	// 					{
	// 						Name: to.Ptr("Rule2"),
	// 						Action: to.Ptr(armfrontdoor.ActionTypeBlock),
	// 						EnabledState: to.Ptr(armfrontdoor.CustomRuleEnabledStateEnabled),
	// 						MatchConditions: []*armfrontdoor.MatchCondition{
	// 							{
	// 								MatchValue: []*string{
	// 									to.Ptr("CH")},
	// 									MatchVariable: to.Ptr(armfrontdoor.MatchVariableRemoteAddr),
	// 									NegateCondition: to.Ptr(false),
	// 									Operator: to.Ptr(armfrontdoor.OperatorGeoMatch),
	// 								},
	// 								{
	// 									MatchValue: []*string{
	// 										to.Ptr("windows")},
	// 										MatchVariable: to.Ptr(armfrontdoor.MatchVariableRequestHeader),
	// 										NegateCondition: to.Ptr(false),
	// 										Operator: to.Ptr(armfrontdoor.OperatorContains),
	// 										Selector: to.Ptr("UserAgent"),
	// 										Transforms: []*armfrontdoor.TransformType{
	// 											to.Ptr(armfrontdoor.TransformTypeLowercase)},
	// 									}},
	// 									Priority: to.Ptr[int32](2),
	// 									RateLimitDurationInMinutes: to.Ptr[int32](0),
	// 									RateLimitThreshold: to.Ptr[int32](0),
	// 									RuleType: to.Ptr(armfrontdoor.RuleTypeMatchRule),
	// 							}},
	// 						},
	// 						FrontendEndpointLinks: []*armfrontdoor.FrontendEndpointLink{
	// 						},
	// 						ManagedRules: &armfrontdoor.ManagedRuleSetList{
	// 							ManagedRuleSets: []*armfrontdoor.ManagedRuleSet{
	// 								{
	// 									Exclusions: []*armfrontdoor.ManagedRuleExclusion{
	// 										{
	// 											MatchVariable: to.Ptr(armfrontdoor.ManagedRuleExclusionMatchVariableRequestHeaderNames),
	// 											Selector: to.Ptr("User-Agent"),
	// 											SelectorMatchOperator: to.Ptr(armfrontdoor.ManagedRuleExclusionSelectorMatchOperatorEquals),
	// 									}},
	// 									RuleGroupOverrides: []*armfrontdoor.ManagedRuleGroupOverride{
	// 										{
	// 											Exclusions: []*armfrontdoor.ManagedRuleExclusion{
	// 												{
	// 													MatchVariable: to.Ptr(armfrontdoor.ManagedRuleExclusionMatchVariableRequestCookieNames),
	// 													Selector: to.Ptr("token"),
	// 													SelectorMatchOperator: to.Ptr(armfrontdoor.ManagedRuleExclusionSelectorMatchOperatorStartsWith),
	// 											}},
	// 											RuleGroupName: to.Ptr("SQLI"),
	// 											Rules: []*armfrontdoor.ManagedRuleOverride{
	// 												{
	// 													Action: to.Ptr(armfrontdoor.ActionTypeRedirect),
	// 													EnabledState: to.Ptr(armfrontdoor.ManagedRuleEnabledStateEnabled),
	// 													Exclusions: []*armfrontdoor.ManagedRuleExclusion{
	// 														{
	// 															MatchVariable: to.Ptr(armfrontdoor.ManagedRuleExclusionMatchVariableQueryStringArgNames),
	// 															Selector: to.Ptr("query"),
	// 															SelectorMatchOperator: to.Ptr(armfrontdoor.ManagedRuleExclusionSelectorMatchOperatorEquals),
	// 													}},
	// 													RuleID: to.Ptr("942100"),
	// 												},
	// 												{
	// 													EnabledState: to.Ptr(armfrontdoor.ManagedRuleEnabledStateDisabled),
	// 													RuleID: to.Ptr("942110"),
	// 											}},
	// 									}},
	// 									RuleSetAction: to.Ptr(armfrontdoor.ManagedRuleSetActionTypeBlock),
	// 									RuleSetType: to.Ptr("DefaultRuleSet"),
	// 									RuleSetVersion: to.Ptr("1.0"),
	// 							}},
	// 						},
	// 						PolicySettings: &armfrontdoor.PolicySettings{
	// 							CustomBlockResponseBody: to.Ptr("PGh0bWw+CjxoZWFkZXI+PHRpdGxlPkhlbGxvPC90aXRsZT48L2hlYWRlcj4KPGJvZHk+CkhlbGxvIHdvcmxkCjwvYm9keT4KPC9odG1sPg=="),
	// 							CustomBlockResponseStatusCode: to.Ptr[int32](429),
	// 							EnabledState: to.Ptr(armfrontdoor.PolicyEnabledStateEnabled),
	// 							JavascriptChallengeExpirationInMinutes: to.Ptr[int32](30),
	// 							LogScrubbing: &armfrontdoor.PolicySettingsLogScrubbing{
	// 								ScrubbingRules: []*armfrontdoor.WebApplicationFirewallScrubbingRules{
	// 									{
	// 										MatchVariable: to.Ptr(armfrontdoor.ScrubbingRuleEntryMatchVariableRequestIPAddress),
	// 										SelectorMatchOperator: to.Ptr(armfrontdoor.ScrubbingRuleEntryMatchOperatorEqualsAny),
	// 										State: to.Ptr(armfrontdoor.ScrubbingRuleEntryStateEnabled),
	// 								}},
	// 								State: to.Ptr(armfrontdoor.WebApplicationFirewallScrubbingStateEnabled),
	// 							},
	// 							Mode: to.Ptr(armfrontdoor.PolicyModePrevention),
	// 							RedirectURL: to.Ptr("http://www.bing.com"),
	// 							RequestBodyCheck: to.Ptr(armfrontdoor.PolicyRequestBodyCheckDisabled),
	// 						},
	// 						ProvisioningState: to.Ptr("Succeeded"),
	// 						ResourceState: to.Ptr(armfrontdoor.PolicyResourceStateEnabled),
	// 						SecurityPolicyLinks: []*armfrontdoor.SecurityPolicyLink{
	// 						},
	// 					},
	// 					SKU: &armfrontdoor.SKU{
	// 						Name: to.Ptr(armfrontdoor.SKUNamePremiumAzureFrontDoor),
	// 					},
	// 				}
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

const { FrontDoorManagementClient } = require("@azure/arm-frontdoor");
const { DefaultAzureCredential } = require("@azure/identity");

/**
 * This sample demonstrates how to Create or update policy with specified rule set name within a resource group.
 *
 * @summary Create or update policy with specified rule set name within a resource group.
 * x-ms-original-file: specification/frontdoor/resource-manager/Microsoft.Network/stable/2024-02-01/examples/WafPolicyCreateOrUpdate.json
 */
async function createsSpecificPolicy() {
  const subscriptionId = process.env["FRONTDOOR_SUBSCRIPTION_ID"] || "subid";
  const resourceGroupName = process.env["FRONTDOOR_RESOURCE_GROUP"] || "rg1";
  const policyName = "Policy1";
  const parameters = {
    customRules: {
      rules: [
        {
          name: "Rule1",
          action: "Block",
          matchConditions: [
            {
              matchValue: ["192.168.1.0/24", "10.0.0.0/24"],
              matchVariable: "RemoteAddr",
              operator: "IPMatch",
            },
          ],
          priority: 1,
          rateLimitThreshold: 1000,
          ruleType: "RateLimitRule",
        },
        {
          name: "Rule2",
          action: "Block",
          matchConditions: [
            {
              matchValue: ["CH"],
              matchVariable: "RemoteAddr",
              operator: "GeoMatch",
            },
            {
              matchValue: ["windows"],
              matchVariable: "RequestHeader",
              operator: "Contains",
              selector: "UserAgent",
              transforms: ["Lowercase"],
            },
          ],
          priority: 2,
          ruleType: "MatchRule",
        },
      ],
    },
    location: "WestUs",
    managedRules: {
      managedRuleSets: [
        {
          exclusions: [
            {
              matchVariable: "RequestHeaderNames",
              selector: "User-Agent",
              selectorMatchOperator: "Equals",
            },
          ],
          ruleGroupOverrides: [
            {
              exclusions: [
                {
                  matchVariable: "RequestCookieNames",
                  selector: "token",
                  selectorMatchOperator: "StartsWith",
                },
              ],
              ruleGroupName: "SQLI",
              rules: [
                {
                  action: "Redirect",
                  enabledState: "Enabled",
                  exclusions: [
                    {
                      matchVariable: "QueryStringArgNames",
                      selector: "query",
                      selectorMatchOperator: "Equals",
                    },
                  ],
                  ruleId: "942100",
                },
                { enabledState: "Disabled", ruleId: "942110" },
              ],
            },
          ],
          ruleSetAction: "Block",
          ruleSetType: "DefaultRuleSet",
          ruleSetVersion: "1.0",
        },
      ],
    },
    policySettings: {
      customBlockResponseBody:
        "PGh0bWw+CjxoZWFkZXI+PHRpdGxlPkhlbGxvPC90aXRsZT48L2hlYWRlcj4KPGJvZHk+CkhlbGxvIHdvcmxkCjwvYm9keT4KPC9odG1sPg==",
      customBlockResponseStatusCode: 429,
      enabledState: "Enabled",
      javascriptChallengeExpirationInMinutes: 30,
      mode: "Prevention",
      redirectUrl: "http://www.bing.com",
      requestBodyCheck: "Disabled",
      scrubbingRules: [
        {
          matchVariable: "RequestIPAddress",
          selector: undefined,
          selectorMatchOperator: "EqualsAny",
          state: "Enabled",
        },
      ],
      state: "Enabled",
    },
    sku: { name: "Premium_AzureFrontDoor" },
  };
  const credential = new DefaultAzureCredential();
  const client = new FrontDoorManagementClient(credential, subscriptionId);
  const result = await client.policies.beginCreateOrUpdateAndWait(
    resourceGroupName,
    policyName,
    parameters,
  );
  console.log(result);
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

using Azure;
using Azure.ResourceManager;
using System;
using System.Threading.Tasks;
using Azure.Core;
using Azure.Identity;
using Azure.ResourceManager.FrontDoor.Models;
using Azure.ResourceManager.Resources;
using Azure.ResourceManager.FrontDoor;

// Generated from example definition: specification/frontdoor/resource-manager/Microsoft.Network/stable/2024-02-01/examples/WafPolicyCreateOrUpdate.json
// this example is just showing the usage of "Policies_CreateOrUpdate" operation, for the dependent resources, they will have to be created separately.

// get your azure access token, for more details of how Azure SDK get your access token, please refer to https://learn.microsoft.com/en-us/dotnet/azure/sdk/authentication?tabs=command-line
TokenCredential cred = new DefaultAzureCredential();
// authenticate your client
ArmClient client = new ArmClient(cred);

// this example assumes you already have this ResourceGroupResource created on azure
// for more information of creating ResourceGroupResource, please refer to the document of ResourceGroupResource
string subscriptionId = "subid";
string resourceGroupName = "rg1";
ResourceIdentifier resourceGroupResourceId = ResourceGroupResource.CreateResourceIdentifier(subscriptionId, resourceGroupName);
ResourceGroupResource resourceGroupResource = client.GetResourceGroupResource(resourceGroupResourceId);

// get the collection of this FrontDoorWebApplicationFirewallPolicyResource
FrontDoorWebApplicationFirewallPolicyCollection collection = resourceGroupResource.GetFrontDoorWebApplicationFirewallPolicies();

// invoke the operation
string policyName = "Policy1";
FrontDoorWebApplicationFirewallPolicyData data = new FrontDoorWebApplicationFirewallPolicyData(new AzureLocation("WestUs"))
{
    SkuName = FrontDoorSkuName.PremiumAzureFrontDoor,
    PolicySettings = new FrontDoorWebApplicationFirewallPolicySettings
    {
        EnabledState = PolicyEnabledState.Enabled,
        Mode = FrontDoorWebApplicationFirewallPolicyMode.Prevention,
        RedirectUri = new Uri("http://www.bing.com"),
        CustomBlockResponseStatusCode = 429,
        CustomBlockResponseBody = "PGh0bWw+CjxoZWFkZXI+PHRpdGxlPkhlbGxvPC90aXRsZT48L2hlYWRlcj4KPGJvZHk+CkhlbGxvIHdvcmxkCjwvYm9keT4KPC9odG1sPg==",
        RequestBodyCheck = PolicyRequestBodyCheck.Disabled,
        JavascriptChallengeExpirationInMinutes = 30,
        State = WebApplicationFirewallScrubbingState.Enabled,
        ScrubbingRules = {new WebApplicationFirewallScrubbingRules(ScrubbingRuleEntryMatchVariable.RequestIPAddress, ScrubbingRuleEntryMatchOperator.EqualsAny)
        {
        Selector = null,
        State = ScrubbingRuleEntryState.Enabled,
        }},
    },
    Rules = {new WebApplicationCustomRule(1, WebApplicationRuleType.RateLimitRule, new WebApplicationRuleMatchCondition[]
    {
    new WebApplicationRuleMatchCondition(WebApplicationRuleMatchVariable.RemoteAddr, WebApplicationRuleMatchOperator.IPMatch, new string[]{"192.168.1.0/24", "10.0.0.0/24"})
    }, RuleMatchActionType.Block)
    {
    Name = "Rule1",
    RateLimitThreshold = 1000,
    }, new WebApplicationCustomRule(2, WebApplicationRuleType.MatchRule, new WebApplicationRuleMatchCondition[]
    {
    new WebApplicationRuleMatchCondition(WebApplicationRuleMatchVariable.RemoteAddr, WebApplicationRuleMatchOperator.GeoMatch, new string[]{"CH"}),
    new WebApplicationRuleMatchCondition(WebApplicationRuleMatchVariable.RequestHeader, WebApplicationRuleMatchOperator.Contains, new string[]{"windows"})
    {
    Selector = "UserAgent",
    Transforms = {WebApplicationRuleMatchTransformType.Lowercase},
    }
    }, RuleMatchActionType.Block)
    {
    Name = "Rule2",
    }},
    ManagedRuleSets = {new ManagedRuleSet("DefaultRuleSet", "1.0")
    {
    RuleSetAction = ManagedRuleSetActionType.Block,
    Exclusions = {new ManagedRuleExclusion(ManagedRuleExclusionMatchVariable.RequestHeaderNames, ManagedRuleExclusionSelectorMatchOperator.EqualsValue, "User-Agent")},
    RuleGroupOverrides = {new ManagedRuleGroupOverride("SQLI")
    {
    Exclusions = {new ManagedRuleExclusion(ManagedRuleExclusionMatchVariable.RequestCookieNames, ManagedRuleExclusionSelectorMatchOperator.StartsWith, "token")},
    Rules = {new ManagedRuleOverride("942100")
    {
    EnabledState = ManagedRuleEnabledState.Enabled,
    Action = RuleMatchActionType.Redirect,
    Exclusions = {new ManagedRuleExclusion(ManagedRuleExclusionMatchVariable.QueryStringArgNames, ManagedRuleExclusionSelectorMatchOperator.EqualsValue, "query")},
    }, new ManagedRuleOverride("942110")
    {
    EnabledState = ManagedRuleEnabledState.Disabled,
    }},
    }},
    }},
};
ArmOperation<FrontDoorWebApplicationFirewallPolicyResource> lro = await collection.CreateOrUpdateAsync(WaitUntil.Completed, policyName, data);
FrontDoorWebApplicationFirewallPolicyResource result = lro.Value;

// the variable result is a resource, you could call other operations on this instance as well
// but just for demo, we get its data from this resource instance
FrontDoorWebApplicationFirewallPolicyData resourceData = result.Data;
// for demo we just print out the id
Console.WriteLine($"Succeeded on id: {resourceData.Id}");

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

示例响应

状态代码:: 200

{
  "name": "Policy1",
  "id": "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/FrontDoorWebApplicationFirewallPolicies/Policy1",
  "type": "Microsoft.Network/frontdoorwebapplicationfirewallpolicies",
  "tags": {
    "key1": "value1",
    "key2": "value2"
  },
  "location": "WestUs",
  "properties": {
    "resourceState": "Enabled",
    "provisioningState": "Succeeded",
    "policySettings": {
      "enabledState": "Enabled",
      "mode": "Prevention",
      "redirectUrl": "http://www.bing.com",
      "customBlockResponseStatusCode": 429,
      "customBlockResponseBody": "PGh0bWw+CjxoZWFkZXI+PHRpdGxlPkhlbGxvPC90aXRsZT48L2hlYWRlcj4KPGJvZHk+CkhlbGxvIHdvcmxkCjwvYm9keT4KPC9odG1sPg==",
      "requestBodyCheck": "Disabled",
      "javascriptChallengeExpirationInMinutes": 30,
      "logScrubbing": {
        "state": "Enabled",
        "scrubbingRules": [
          {
            "matchVariable": "RequestIPAddress",
            "selectorMatchOperator": "EqualsAny",
            "selector": null,
            "state": "Enabled"
          }
        ]
      }
    },
    "customRules": {
      "rules": [
        {
          "name": "Rule1",
          "priority": 1,
          "enabledState": "Enabled",
          "ruleType": "RateLimitRule",
          "rateLimitDurationInMinutes": 0,
          "rateLimitThreshold": 1000,
          "matchConditions": [
            {
              "matchVariable": "RemoteAddr",
              "selector": null,
              "operator": "IPMatch",
              "negateCondition": false,
              "matchValue": [
                "192.168.1.0/24",
                "10.0.0.0/24"
              ],
              "transforms": []
            }
          ],
          "action": "Block"
        },
        {
          "name": "Rule2",
          "priority": 2,
          "enabledState": "Enabled",
          "ruleType": "MatchRule",
          "rateLimitDurationInMinutes": 0,
          "rateLimitThreshold": 0,
          "matchConditions": [
            {
              "matchVariable": "RemoteAddr",
              "selector": null,
              "operator": "GeoMatch",
              "negateCondition": false,
              "matchValue": [
                "CH"
              ]
            },
            {
              "matchVariable": "RequestHeader",
              "selector": "UserAgent",
              "operator": "Contains",
              "negateCondition": false,
              "matchValue": [
                "windows"
              ],
              "transforms": [
                "Lowercase"
              ]
            }
          ],
          "action": "Block"
        }
      ]
    },
    "managedRules": {
      "managedRuleSets": [
        {
          "ruleSetType": "DefaultRuleSet",
          "ruleSetVersion": "1.0",
          "ruleSetAction": "Block",
          "exclusions": [
            {
              "matchVariable": "RequestHeaderNames",
              "selectorMatchOperator": "Equals",
              "selector": "User-Agent"
            }
          ],
          "ruleGroupOverrides": [
            {
              "ruleGroupName": "SQLI",
              "exclusions": [
                {
                  "matchVariable": "RequestCookieNames",
                  "selectorMatchOperator": "StartsWith",
                  "selector": "token"
                }
              ],
              "rules": [
                {
                  "ruleId": "942100",
                  "enabledState": "Enabled",
                  "action": "Redirect",
                  "exclusions": [
                    {
                      "matchVariable": "QueryStringArgNames",
                      "selectorMatchOperator": "Equals",
                      "selector": "query"
                    }
                  ]
                },
                {
                  "ruleId": "942110",
                  "enabledState": "Disabled"
                }
              ]
            }
          ]
        }
      ]
    },
    "frontendEndpointLinks": [],
    "securityPolicyLinks": []
  },
  "sku": {
    "name": "Premium_AzureFrontDoor"
  }
}

状态代码:: 201

{
  "name": "Policy1",
  "id": "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/FrontDoorWebApplicationFirewallPolicies/Policy1",
  "type": "Microsoft.Network/frontdoorwebapplicationfirewallpolicies",
  "tags": {
    "key1": "value1",
    "key2": "value2"
  },
  "location": "WestUs",
  "properties": {
    "resourceState": "Enabled",
    "provisioningState": "Succeeded",
    "policySettings": {
      "enabledState": "Enabled",
      "mode": "Prevention",
      "redirectUrl": "http://www.bing.com",
      "customBlockResponseStatusCode": 429,
      "customBlockResponseBody": "PGh0bWw+CjxoZWFkZXI+PHRpdGxlPkhlbGxvPC90aXRsZT48L2hlYWRlcj4KPGJvZHk+CkhlbGxvIHdvcmxkCjwvYm9keT4KPC9odG1sPg==",
      "requestBodyCheck": "Disabled",
      "logScrubbing": {
        "state": "Enabled",
        "scrubbingRules": [
          {
            "matchVariable": "RequestIPAddress",
            "selectorMatchOperator": "EqualsAny",
            "selector": null,
            "state": "Enabled"
          }
        ]
      }
    },
    "customRules": {
      "rules": [
        {
          "name": "Rule1",
          "priority": 1,
          "enabledState": "Enabled",
          "ruleType": "RateLimitRule",
          "rateLimitDurationInMinutes": 0,
          "rateLimitThreshold": 1000,
          "matchConditions": [
            {
              "matchVariable": "RemoteAddr",
              "selector": null,
              "operator": "IPMatch",
              "negateCondition": false,
              "matchValue": [
                "192.168.1.0/24",
                "10.0.0.0/24"
              ],
              "transforms": []
            }
          ],
          "action": "Block"
        },
        {
          "name": "Rule2",
          "priority": 2,
          "enabledState": "Enabled",
          "ruleType": "MatchRule",
          "rateLimitDurationInMinutes": 0,
          "rateLimitThreshold": 0,
          "matchConditions": [
            {
              "matchVariable": "RemoteAddr",
              "selector": null,
              "operator": "GeoMatch",
              "negateCondition": false,
              "matchValue": [
                "CH"
              ]
            },
            {
              "matchVariable": "RequestHeader",
              "selector": "UserAgent",
              "operator": "Contains",
              "negateCondition": false,
              "matchValue": [
                "windows"
              ],
              "transforms": [
                "Lowercase"
              ]
            }
          ],
          "action": "Block"
        }
      ]
    },
    "managedRules": {
      "managedRuleSets": [
        {
          "ruleSetType": "DefaultRuleSet",
          "ruleSetVersion": "1.0",
          "exclusions": [
            {
              "matchVariable": "RequestHeaderNames",
              "selectorMatchOperator": "Equals",
              "selector": "User-Agent"
            }
          ],
          "ruleGroupOverrides": [
            {
              "ruleGroupName": "SQLI",
              "exclusions": [
                {
                  "matchVariable": "RequestCookieNames",
                  "selectorMatchOperator": "StartsWith",
                  "selector": "token"
                }
              ],
              "rules": [
                {
                  "ruleId": "942100",
                  "enabledState": "Enabled",
                  "action": "Redirect",
                  "exclusions": [
                    {
                      "matchVariable": "QueryStringArgNames",
                      "selectorMatchOperator": "Equals",
                      "selector": "query"
                    }
                  ]
                },
                {
                  "ruleId": "942110",
                  "enabledState": "Disabled"
                }
              ]
            }
          ]
        }
      ]
    },
    "frontendEndpointLinks": [],
    "securityPolicyLinks": []
  },
  "sku": {
    "name": "Classic_AzureFrontDoor"
  }
}

状态代码:: 202

{
  "name": "Policy1",
  "id": "/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/FrontDoorWebApplicationFirewallPolicies/Policy1",
  "type": "Microsoft.Network/frontdoorwebapplicationfirewallpolicies",
  "tags": {
    "key1": "value1",
    "key2": "value2"
  },
  "location": "WestUs",
  "properties": {
    "resourceState": "Enabled",
    "provisioningState": "Succeeded",
    "policySettings": {
      "enabledState": "Enabled",
      "mode": "Prevention",
      "redirectUrl": "http://www.bing.com",
      "customBlockResponseStatusCode": 429,
      "customBlockResponseBody": "PGh0bWw+CjxoZWFkZXI+PHRpdGxlPkhlbGxvPC90aXRsZT48L2hlYWRlcj4KPGJvZHk+CkhlbGxvIHdvcmxkCjwvYm9keT4KPC9odG1sPg==",
      "requestBodyCheck": "Disabled",
      "logScrubbing": {
        "state": "Enabled",
        "scrubbingRules": [
          {
            "matchVariable": "RequestIPAddress",
            "selectorMatchOperator": "EqualsAny",
            "selector": null,
            "state": "Enabled"
          }
        ]
      }
    },
    "customRules": {
      "rules": [
        {
          "name": "Rule1",
          "priority": 1,
          "enabledState": "Enabled",
          "ruleType": "RateLimitRule",
          "rateLimitDurationInMinutes": 0,
          "rateLimitThreshold": 1000,
          "matchConditions": [
            {
              "matchVariable": "RemoteAddr",
              "selector": null,
              "operator": "IPMatch",
              "negateCondition": false,
              "matchValue": [
                "192.168.1.0/24",
                "10.0.0.0/24"
              ],
              "transforms": []
            }
          ],
          "action": "Block"
        },
        {
          "name": "Rule2",
          "priority": 2,
          "enabledState": "Enabled",
          "ruleType": "MatchRule",
          "rateLimitDurationInMinutes": 0,
          "rateLimitThreshold": 0,
          "matchConditions": [
            {
              "matchVariable": "RemoteAddr",
              "selector": null,
              "operator": "GeoMatch",
              "negateCondition": false,
              "matchValue": [
                "CH"
              ]
            },
            {
              "matchVariable": "RequestHeader",
              "selector": "UserAgent",
              "operator": "Contains",
              "negateCondition": false,
              "matchValue": [
                "windows"
              ],
              "transforms": [
                "Lowercase"
              ]
            }
          ],
          "action": "Block"
        }
      ]
    },
    "managedRules": {
      "managedRuleSets": [
        {
          "ruleSetType": "DefaultRuleSet",
          "ruleSetVersion": "1.0",
          "ruleSetAction": "Block",
          "exclusions": [
            {
              "matchVariable": "RequestHeaderNames",
              "selectorMatchOperator": "Equals",
              "selector": "User-Agent"
            }
          ],
          "ruleGroupOverrides": [
            {
              "ruleGroupName": "SQLI",
              "exclusions": [
                {
                  "matchVariable": "RequestCookieNames",
                  "selectorMatchOperator": "StartsWith",
                  "selector": "token"
                }
              ],
              "rules": [
                {
                  "ruleId": "942100",
                  "enabledState": "Enabled",
                  "action": "Redirect",
                  "exclusions": [
                    {
                      "matchVariable": "QueryStringArgNames",
                      "selectorMatchOperator": "Equals",
                      "selector": "query"
                    }
                  ]
                },
                {
                  "ruleId": "942110",
                  "enabledState": "Disabled"
                }
              ]
            }
          ]
        }
      ]
    },
    "frontendEndpointLinks": [],
    "securityPolicyLinks": []
  },
  "sku": {
    "name": "Premium_AzureFrontDoor"
  }
}

定义

名称	说明
scrubbingRuleEntryMatchOperator	如果 matchVariable 是集合，请对选择器进行操作，以指定此规则应用于的集合中的哪些元素。
scrubbingRuleEntryState	定义日志清理规则的状态。默认值处于启用状态。
ActionType	定义对规则匹配执行的操作。
CustomRule	定义 Web 应用程序规则的内容
CustomRuleEnabledState	描述自定义规则是否处于启用或禁用状态。如果未指定，则默认为 Enabled。
CustomRuleList	定义自定义规则的内容
ErrorResponse	错误响应指示 Front Door 服务无法处理传入请求。错误消息中提供了原因。
FrontendEndpointLink	定义前端终结点的资源 ID。
GroupByVariable	描述可用于对速率限制请求进行分组的变量
ManagedRuleEnabledState	描述托管规则是否处于启用或禁用状态。
ManagedRuleExclusion	从托管规则评估中排除变量。
ManagedRuleExclusionMatchVariable	要排除的变量类型。
ManagedRuleExclusionSelectorMatchOperator	在指定此排除项应用于的集合中的元素时，要应用于选择器的比较运算符。
ManagedRuleGroupOverride	定义托管规则组替代设置。
ManagedRuleOverride	定义托管规则组替代设置。
ManagedRuleSet	定义托管规则集。
ManagedRuleSetActionType	定义满足托管规则集分数阈值时要执行的操作。
ManagedRuleSetList	定义策略的托管规则集列表。
MatchCondition	定义匹配条件。
MatchVariable	要与之进行比较的请求变量。
Operator	要用于与变量值匹配的比较类型。
PolicyEnabledState	描述策略是否处于启用或禁用状态。如果未指定，则默认为 Enabled。
PolicyMode	描述它在策略级别是否处于检测模式或预防模式。
PolicyRequestBodyCheck	描述策略托管规则是否会检查请求正文内容。
PolicyResourceState	策略的资源状态。
PolicySettings	定义顶级 WebApplicationFirewallPolicy 配置设置。
RoutingRuleLink	定义路由规则的资源 ID。
RuleType	描述规则的类型。
scrubbingRuleEntryMatchVariable	要从日志中清理的变量。
SecurityPolicyLink	定义安全策略的资源 ID。
Sku	Web 应用程序防火墙策略的定价层。
SkuName	定价层的名称。
TransformType	描述匹配之前应用的转换。
VariableName	介绍组依据的受支持变量
WebApplicationFirewallPolicy	定义 Web 应用程序防火墙策略。
WebApplicationFirewallScrubbingRules	定义日志清理规则的内容。
WebApplicationFirewallScrubbingState	日志清理配置的状态。默认值为“已启用”。

scrubbingRuleEntryMatchOperator

枚举

如果 matchVariable 是集合，请对选择器进行操作，以指定此规则应用于的集合中的哪些元素。

值	说明
Equals
EqualsAny

scrubbingRuleEntryState

枚举

定义日志清理规则的状态。默认值处于启用状态。

值	说明
Disabled
Enabled

ActionType

枚举

定义对规则匹配执行的操作。

值	说明
Allow
AnomalyScoring
Block
JSChallenge
Log
Redirect

CustomRule

Object

定义 Web 应用程序规则的内容

名称	类型	说明
action	ActionType	描述规则匹配时要应用的作。
enabledState	CustomRuleEnabledState	描述自定义规则是否处于启用或禁用状态。如果未指定，则默认为 Enabled。
groupBy	GroupByVariable[]	描述用于对速率限制请求进行分组的变量列表
matchConditions	MatchCondition[]	匹配条件列表。
name	string maxLength: 128	描述规则的名称。
priority	integer	描述规则的优先级。在具有较高值的规则之前，将评估具有较低值的规则。
rateLimitDurationInMinutes	integer minimum: 0 maximum: 5	重置速率限制计数的时间范围。默认值为 1 分钟。
rateLimitThreshold	integer minimum: 0	时间范围内每个客户端允许的请求数。
ruleType	RuleType	描述规则的类型。

CustomRuleEnabledState

枚举

描述自定义规则是否处于启用或禁用状态。如果未指定，则默认为 Enabled。

值	说明
Disabled
Enabled

CustomRuleList

Object

定义自定义规则的内容

名称	类型	说明
rules	CustomRule[]	规则列表

ErrorResponse

Object

错误响应指示 Front Door 服务无法处理传入请求。错误消息中提供了原因。

名称	类型	说明
code	string	错误代码。
message	string	指示作失败的原因的错误消息。

FrontendEndpointLink

Object

定义前端终结点的资源 ID。

名称	类型	说明
id	string	资源 ID。

GroupByVariable

Object

描述可用于对速率限制请求进行分组的变量

名称	类型	说明
variableName	VariableName	介绍组依据的受支持变量

ManagedRuleEnabledState

枚举

描述托管规则是否处于启用或禁用状态。

值	说明
Disabled
Enabled

ManagedRuleExclusion

Object

从托管规则评估中排除变量。

名称	类型	说明
matchVariable	ManagedRuleExclusionMatchVariable	要排除的变量类型。
selector	string	此排除项应用于集合中的元素的选择器值。
selectorMatchOperator	ManagedRuleExclusionSelectorMatchOperator	在指定此排除项应用于的集合中的元素时，要应用于选择器的比较运算符。

ManagedRuleExclusionMatchVariable

枚举

要排除的变量类型。

值	说明
QueryStringArgNames
RequestBodyJsonArgNames
RequestBodyPostArgNames
RequestCookieNames
RequestHeaderNames

ManagedRuleExclusionSelectorMatchOperator

枚举

在指定此排除项应用于的集合中的元素时，要应用于选择器的比较运算符。

值	说明
Contains
EndsWith
Equals
EqualsAny
StartsWith

ManagedRuleGroupOverride

Object

定义托管规则组替代设置。

名称	类型	说明
exclusions	ManagedRuleExclusion[]	描述应用于组中所有规则的排除项。
ruleGroupName	string	描述要重写的托管规则组。
rules	ManagedRuleOverride[]	将禁用的规则列表。如果未指定任何规则，将禁用组中的所有规则。

ManagedRuleOverride

Object

定义托管规则组替代设置。

名称	类型	说明
action	ActionType	描述规则匹配时要应用的替代操作。
enabledState	ManagedRuleEnabledState	描述托管规则是否处于启用或禁用状态。如果未指定，则默认为 Disabled。
exclusions	ManagedRuleExclusion[]	描述应用于此特定规则的排除项。
ruleId	string	托管规则的标识符。

ManagedRuleSet

Object

定义托管规则集。

名称	类型	说明
exclusions	ManagedRuleExclusion[]	描述应用于集中所有规则的排除项。
ruleGroupOverrides	ManagedRuleGroupOverride[]	定义要应用于规则集的规则组替代。
ruleSetAction	ManagedRuleSetActionType	ruleSetAction 定义规则集作。
ruleSetType	string	定义要使用的规则集类型。
ruleSetVersion	string	定义要使用的规则集的版本。

ManagedRuleSetActionType

枚举

定义满足托管规则集分数阈值时要执行的操作。

值	说明
Block
Log
Redirect

ManagedRuleSetList

Object

定义策略的托管规则集列表。

名称	类型	说明
managedRuleSets	ManagedRuleSet[]	规则集列表。

MatchCondition

Object

定义匹配条件。

名称	类型	说明
matchValue	string[]	可能的匹配值列表。
matchVariable	MatchVariable	要与之进行比较的请求变量。
negateCondition	boolean	描述是否应否定此条件的结果。
operator	Operator	要用于与变量值匹配的比较类型。
selector	string	与 QueryString、PostArgs、RequestHeader 或 Cookies 变量中的特定键匹配。默认值为 null。
transforms	TransformType[]	转换列表。

MatchVariable

枚举

要与之进行比较的请求变量。

值	说明
Cookies
PostArgs
QueryString
RemoteAddr
RequestBody
RequestHeader
RequestMethod
RequestUri
SocketAddr

Operator

枚举

要用于与变量值匹配的比较类型。

值	说明
Any
BeginsWith
Contains
EndsWith
Equal
GeoMatch
GreaterThan
GreaterThanOrEqual
IPMatch
LessThan
LessThanOrEqual
RegEx

PolicyEnabledState

枚举

描述策略是否处于启用或禁用状态。如果未指定，则默认为 Enabled。

值	说明
Disabled
Enabled

PolicyMode

枚举

描述它在策略级别是否处于检测模式或预防模式。

值	说明
Detection
Prevention

PolicyRequestBodyCheck

枚举

描述策略托管规则是否会检查请求正文内容。

值	说明
Disabled
Enabled

PolicyResourceState

枚举

策略的资源状态。

值	说明
Creating
Deleting
Disabled
Disabling
Enabled
Enabling

PolicySettings

Object

定义顶级 WebApplicationFirewallPolicy 配置设置。

名称	类型	说明
customBlockResponseBody	string pattern: ^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==\|[A-Za-z0-9+/]{3}=\|[A-Za-z0-9+/]{4})$	如果操作类型为块，客户可以替代响应正文。必须在 base64 编码中指定正文。
customBlockResponseStatusCode	integer	如果操作类型为块，客户可以替代响应状态代码。
enabledState	PolicyEnabledState	描述策略是否处于启用或禁用状态。如果未指定，则默认为 Enabled。
javascriptChallengeExpirationInMinutes	integer (int32) minimum: 5 maximum: 1440	定义 JavaScript 质询 Cookie 有效期（以分钟为单位）。此设置仅适用于Premium_AzureFrontDoor。值必须是介于 5 和 1440 之间的整数，默认值为 30。
logScrubbing.scrubbingRules	WebApplicationFirewallScrubbingRules[]	应用于 Web 应用程序防火墙日志的日志清理规则列表。
logScrubbing.state	WebApplicationFirewallScrubbingState	日志清理配置的状态。默认值为“已启用”。
mode	PolicyMode	描述它在策略级别是否处于检测模式或预防模式。
redirectUrl	string	如果作类型为重定向，此字段表示客户端的重定向 URL。
requestBodyCheck	PolicyRequestBodyCheck	描述策略托管规则是否会检查请求正文内容。

RoutingRuleLink

Object

定义路由规则的资源 ID。

名称	类型	说明
id	string	资源 ID。

RuleType

枚举

描述规则的类型。

值	说明
MatchRule
RateLimitRule

scrubbingRuleEntryMatchVariable

枚举

要从日志中清理的变量。

值	说明
QueryStringArgNames
RequestBodyJsonArgNames
RequestBodyPostArgNames
RequestCookieNames
RequestHeaderNames
RequestIPAddress
RequestUri

SecurityPolicyLink

Object

定义安全策略的资源 ID。

名称	类型	说明
id	string	资源 ID。

Sku

Object

Web 应用程序防火墙策略的定价层。

名称	类型	说明
name	SkuName	定价层的名称。

SkuName

枚举

定价层的名称。

值	说明
Classic_AzureFrontDoor
Premium_AzureFrontDoor
Standard_AzureFrontDoor

TransformType

枚举

描述匹配之前应用的转换。

值	说明
Lowercase
RemoveNulls
Trim
Uppercase
UrlDecode
UrlEncode

VariableName

枚举

介绍组依据的受支持变量

值	说明
GeoLocation
None
SocketAddr

WebApplicationFirewallPolicy

Object

定义 Web 应用程序防火墙策略。

名称	类型	说明
etag	string	获取在更新资源时更改的唯一只读字符串。
id	string	资源 ID。
location	string	资源位置。
name	string	资源名称。
properties.customRules	CustomRuleList	描述策略中的自定义规则。
properties.frontendEndpointLinks	FrontendEndpointLink[]	介绍与此 Web 应用程序防火墙策略关联的前端终结点。
properties.managedRules	ManagedRuleSetList	描述策略中的托管规则。
properties.policySettings	PolicySettings	描述策略的设置。
properties.provisioningState	string	策略的预配状态。
properties.resourceState	PolicyResourceState	策略的资源状态。
properties.routingRuleLinks	RoutingRuleLink[]	介绍与此 Web 应用程序防火墙策略关联的路由规则。
properties.securityPolicyLinks	SecurityPolicyLink[]	介绍与此 Web 应用程序防火墙策略关联的安全策略。
sku	Sku	Web 应用程序防火墙策略的定价层。如果未指定，则默认为Classic_AzureFrontDoor。
tags	object	资源标记。
type	string	资源类型。

WebApplicationFirewallScrubbingRules

Object

定义日志清理规则的内容。

名称	类型	说明
matchVariable	scrubbingRuleEntryMatchVariable	要从日志中清理的变量。
selector	string	matchVariable 是集合时，运算符用于指定此规则应用于的集合中的哪些元素。
selectorMatchOperator	scrubbingRuleEntryMatchOperator	如果 matchVariable 是集合，请对选择器进行操作，以指定此规则应用于的集合中的哪些元素。
state	scrubbingRuleEntryState	定义日志清理规则的状态。默认值处于启用状态。

WebApplicationFirewallScrubbingState

枚举

日志清理配置的状态。默认值为“已启用”。

值	说明
Disabled
Enabled

通过

Policies - Create Or Update

URI 参数

请求正文

响应

安全性

azure_auth

作用域

示例

Creates specific policy

示例请求

示例响应

定义

scrubbingRuleEntryMatchOperator

scrubbingRuleEntryState

ActionType

CustomRule

CustomRuleEnabledState

CustomRuleList

ErrorResponse

FrontendEndpointLink

GroupByVariable

ManagedRuleEnabledState

ManagedRuleExclusion

ManagedRuleExclusionMatchVariable

ManagedRuleExclusionSelectorMatchOperator

ManagedRuleGroupOverride

ManagedRuleOverride

ManagedRuleSet

ManagedRuleSetActionType

ManagedRuleSetList

MatchCondition

MatchVariable

Operator

PolicyEnabledState

PolicyMode

PolicyRequestBodyCheck

PolicyResourceState

PolicySettings

RoutingRuleLink

RuleType

scrubbingRuleEntryMatchVariable

SecurityPolicyLink

Sku

SkuName

TransformType

VariableName

WebApplicationFirewallPolicy

WebApplicationFirewallScrubbingRules

WebApplicationFirewallScrubbingState

其他资源