xcsh_addon_service (Data Source)

Retrieves information about an F5 Distributed Cloud Addon Service. This is a read-only data source.

Addon services are system-managed resources that provide additional functionality such as Bot Defense, client-side Defense, and other security features. This data source allows you to query addon service details including tier requirements and activation type.

~> Note: Addon services cannot be created or modified via Terraform. To activate or subscribe to an addon service, please use the F5 Distributed Cloud Console or contact your account team.

~> Note For more information about this data source, please refer to the F5 XC API Documentation.

Example Usage

data "xcsh_addon_service" "example" {
  name      = "example-resource"
  namespace = "system"
}

Argument Reference

-> Syntax Rule: This provider uses OneOf groups for mutually exclusive options. Fields documented as “Optional Block” use empty block syntax field_name {}, never field_name = true. Boolean attributes (like add_hsts, http_redirect) use = true/false as normal.

Metadata Argument Reference

• name - Required String
Name of the addon service (e.g., bot_defense, client_side_defense)

• namespace - Optional String
Namespace where the addon service is defined. Usually shared

Attributes Reference

In addition to all arguments above, the following attributes are exported:

• activation_type - Optional String
How the addon service is activated. Possible values: self (user can activate directly), partial (requires partial SRE management), managed (requires full manual intervention)

• addon_service_group_display_name - Optional String
Display name of the addon service group

• addon_service_group_name - Optional String
Name of the addon service group this service belongs to

• display_name - Optional String
Human-readable display name of the addon service

• id - Optional String
Unique identifier for the data source

• tier - Optional String
Subscription tier required for this addon service. Possible values: NO_TIER, BASIC, STANDARD, ADVANCED, PREMIUM

Common Types

The following type definitions are used throughout this resource. See the full definition here rather than repeated inline.

Object Reference {#common-object-reference}

Object references establish a direct reference from one configuration object to another in F5 Distributed Cloud. References use the format tenant/namespace/name.

Field	Type	Description
`name`	String	Name of the referenced object
`namespace`	String	Namespace containing the referenced object
`tenant`	String	Tenant of the referenced object (system-managed)

Transformers {#common-transformers}

Transformers apply transformations to input values before matching. Multiple transformers can be applied in order.

Value	Description
`LOWER_CASE`	Convert to lowercase
`UPPER_CASE`	Convert to uppercase
`BASE64_DECODE`	Decodebase64 content
`NORMALIZE_PATH`	Normalize URL path
`REMOVE_WHITESPACE`	Remove whitespace characters
`URL_DECODE`	Decode URL-encoded characters
`TRIM_LEFT`	Trim leading whitespace
`TRIM_RIGHT`	Trim trailing whitespace
`TRIM`	Trim both leading and trailing whitespace

HTTP Methods {#common-http-methods}

HTTP methods used for request matching.

Value	Description
`ANY`	Match any HTTP method
`GET`	HTTP GET request
`HEAD`	HTTP HEAD request
`POST`	HTTP POST request
`PUT`	HTTP PUT request
`DELETE`	HTTP DELETE request
`CONNECT`	HTTP CONNECT request
`OPTIONS`	HTTP OPTIONS request
`TRACE`	HTTP TRACE request
`PATCH`	HTTP PATCH request
`COPY`	HTTP COPY request (WebDAV)

TLS Fingerprints {#common-tls-fingerprints}

TLS fingerprint categories for malicious client detection.

Value	Description
`TLS_FINGERPRINT_NONE`	No fingerprint matching
`ANY_MALICIOUS_FINGERPRINT`	Match any known malicious fingerprint
`ADWARE`	Adware-associated fingerprints
`DRIDEX`	Dridex malware fingerprints
`GOOTKIT`	Gootkit malware fingerprints
`RANSOMWARE`	Ransomware-associated fingerprints
`TRICKBOT`	Trickbot malware fingerprints

IP Threat Categories {#common-ip-threat-categories}

IP address threat categories for security filtering.

Value	Description
`SPAM_SOURCES`	Known spam sources
`WINDOWS_EXPLOITS`	Windows exploit sources
`WEB_ATTACKS`	Web attack sources
`BOTNETS`	Known botnet IPs
`SCANNERS`	Network scanner IPs
`REPUTATION`	Poor reputation IPs
`PHISHING`	Phishing-related IPs
`PROXY`	Anonymous proxy IPs
`MOBILE_THREATS`	Mobile threat sources
`TOR_PROXY`	Tor exit nodes
`DENIAL_OF_SERVICE`	DoS attack sources
`NETWORK`	Known bad network ranges