xcsh_cdn_loadbalancer (Data Source)

Retrieves information about a CDN Load Balancer resource in F5 Distributed Cloud for content delivery and edge caching with load balancing. This is a read-only data source.

~> Note: For more information, see the CDN Loadbalancer API documentation.

Example Usage

# CDNLoadBalancer Data Source Example

terraform {
  required_version = ">= 1.0"

  required_providers {
    xcsh = {
      source  = "f5-sales-demo/xcsh"
      version = ">= 0.1.0"
    }
  }
}

# Look up an existing CDNLoadBalancer by name
data "xcsh_cdn_loadbalancer" "example" {
  name      = "example-cdn-loadbalancer"
  namespace = "staging"
}

output "cdn_loadbalancer_id" {
  value = data.xcsh_cdn_loadbalancer.example.id
}

Argument Reference

-> Syntax Rule: This provider uses OneOf groups for mutually exclusive options. Fields documented as “Optional Block” use block syntax field_name { ... }. Empty OneOf object attributes use field_name = {}; conditional selection uses condition ? {} : null. Boolean attributes (such as add_hsts and http_redirect) use = true or = false.

🔶 High Risk Operations — Some operations on this resource have high danger level. Destructive operations may require confirmation.

~> Dependencies — This resource requires: cdn_origin_pool.

Metadata Argument Reference

• name - Required String
Name of the CDNLoadBalancer

• namespace - Required String
Namespace where the CDNLoadBalancer exists

Attributes Reference

In addition to all arguments above, the following attributes are exported:

• active_service_policies - Optional String
Configuration parameter for active service policies

• annotations - Optional Map
Annotations applied to this resource

• api_rate_limit - Optional String
APIRateLimit

• api_specification - Optional String
Settings for API specification (API definition, OpenAPI validation, etc.)

• app_firewall - Optional String
Type establishes a direct reference from one object(the referrer) to another(the referred). Such a reference is in form of tenant/namespace/name

• blocked_clients - Optional List
Define rules to block IP Prefixes or AS numbers

• bot_defense - Optional String
Defines various configuration OPTIONS for Bot Defense Policy

• captcha_challenge - Optional String
Enables loadbalancer to perform captcha challenge Captcha challenge will be based on Google Recaptcha. With this feature enabled, only clients that pass the captcha challenge will be allowed to complete the HTTP request. When loadbalancer is configured to do Captcha Challenge, it will redirect

• client_side_defense - Optional String
Defines various configuration OPTIONS for Client-Side Defense Policy

• cors_policy - Optional String
Cross-Origin Resource Sharing requests configuration specified at Virtual-host or Route level. Route level configuration takes precedence. An example of an Cross origin HTTP request GET /resources/public-data/ HTTP/1.1 Host: bar.other User-Agent: Mozilla/5.0 (Macintosh; U; Intel macOS X 10.5

• csrf_policy - Optional String
To mitigate CSRF attack , the policy checks where a request is coming from to determine if the request’s origin is the same as its destination.the policy relies on two pieces of information used in determining if a request originated from the same host. 1. The origin that caused the user agent

• custom_cache_rule - Optional String
Custom Cache Rules. Caching policies for CDN

• data_guard_rules - Optional List
Data Guard prevents responses from exposing sensitive information by masking the data. The system masks credit card numbers and social security numbers leaked from the application from within the HTTP response with a string of asterisks (*)

• ddos_mitigation_rules - Optional List
Define manual mitigation rules to block L7 DDOS attacks

• default_cache_action - Optional String
Default Cache Behaviour. This defines a Default Cache Action

• default_sensitive_data_policy - Optional Object
Policy configuration for this feature

• description - Optional String
Description of the CDNLoadBalancer

• disable_api_definition - Optional Object
Enable this option

• disable_api_discovery - Optional Object
Enable this option

• disable_client_side_defense - Optional Object
Enable this option

• disable_ip_reputation - Optional Object
Enable this option

• disable_malicious_user_detection - Optional Object
Configuration parameter for disable malicious user detection

• disable_rate_limit - Optional Object
Configuration parameter for disable rate limit

• disable_threat_mesh - Optional Object
Enable this option

• disable_waf - Optional Object
Configuration parameter for disable WAF

• domains - Optional List
List of fully qualified domain names. The CDN Distribution will be setup for these FQDN name(s). [This can be a domain or a sub-domain]

• enable_api_discovery - Optional String
Specifies the settings used for API discovery

• enable_challenge - Optional String
Configure auto mitigation i.e risk based challenges for malicious users

• enable_ip_reputation - Optional String
IP Threat Category List. List of IP threat categories

• enable_malicious_user_detection - Optional Object
Configuration parameter for enable malicious user detection

• enable_threat_mesh - Optional Object
Enable this option

• graphql_rules - Optional List
GraphQL is a query language and server-side runtime for APIs which provides a complete and understandable description of the data in API. GraphQL gives clients the power to ask for exactly what they need, makes it easier to evolve APIs over time, and enables powerful developer tools. Policy

• http - Optional String
HTTP Choice. Choice for selecting HTTP proxy

• https - Optional String
Choice for selecting CDN Distribution with bring your own certificates

• https_auto_cert - Optional String
Choice for selecting HTTPS CDN distribution with bring your own certificates

• id - Optional String
Unique identifier for the resource

• js_challenge - Optional String
Enables loadbalancer to perform client browser compatibility test by redirecting to a page with JavaScript. With this feature enabled, only clients that are capable of executing JavaScript(mostly browsers) will be allowed to complete the HTTP request. When loadbalancer is configured to do

• jwt_validation - Optional String
JWT Validation stops JWT replay attacks and JWT tampering by cryptographically verifying incoming JWTs before they are passed to your API origin. JWT Validation will also stop requests with expired tokens or tokens that are not yet valid

• l7_ddos_action_block - Optional Object
Enable this option

• l7_ddos_action_default - Optional Object
Enable this option

• l7_ddos_action_js_challenge - Optional String
Enables loadbalancer to perform client browser compatibility test by redirecting to a page with JavaScript. With this feature enabled, only clients that are capable of executing JavaScript(mostly browsers) will be allowed to complete the HTTP request. When loadbalancer is configured to do

• labels - Optional Map
Labels applied to this resource

• no_challenge - Optional Object
Configuration parameter for no challenge

• no_service_policies - Optional Object
Configuration parameter for no service policies

• origin_pool - Optional String
Configuration parameter for origin pool

• other_settings - Optional String
Configuration parameter for other settings

• policy_based_challenge - Optional String
Specifies the settings for policy rule based challenge

• protected_cookies - Optional List
Allows setting attributes (SameSite, Secure, and HttpOnly) on cookies in responses. Cookie Tampering Protection prevents attackers from modifying the value of session cookies. For Cookie Tampering Protection, enabling a web app firewall (WAF) is a prerequisite

• rate_limit - Optional String
RateLimitConfigType

• sensitive_data_policy - Optional String
Policy configuration for this feature

• service_policies_from_namespace - Optional Object
Enable this option

• slow_ddos_mitigation - Optional String
’Slow and low’ attacks tie up server resources, leaving none available for servicing requests from actual users

• system_default_timeouts - Optional Object
Configuration parameter for system default timeouts

• trusted_clients - Optional List
Define rules to skip processing of one or more features such as WAF, Bot Defense etc

• user_id_client_ip - Optional Object
Enable this option

• user_identification - Optional String
Type establishes a direct reference from one object(the referrer) to another(the referred). Such a reference is in form of tenant/namespace/name

• waf_exclusion - Optional String
Configuration parameter for WAF exclusion

• policies - Optional List
Service Policies is a sequential engine where policies (and rules within the policy) are evaluated one after the other. It’s important to define the correct order (policies evaluated from top to bottom in the list) for service policies, to GET the intended result. For each request, its

• name - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object’s(e.g. Route’s) name

• namespace - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object’s(e.g. Route’s) namespace

• tenant - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then tenant will hold the referred object’s(e.g. Route’s) tenant

• api_endpoint_rules - Optional List
Ordered endpoint-specific rate-limit rules. Each rule must choose exactly one rate_limiter_choice: inline_rate_limiter or ref_rate_limiter

• bypass_rate_limiting_rules - Optional String
Category defines rules per URL or API group. If request matches any of these rules, skip Rate Limiting

• custom_ip_allowed_list - Optional String
IP Allowed list using existing ip_prefix_set objects

• ip_allowed_list - Optional String
List of IPv4 prefixes that represent an endpoint

• no_ip_allowed_list - Optional Object
Enable this option

• server_url_rules - Optional List
Ordered domain or base-path rules for path-scoped rate limiting. Each rule must choose exactly one rate_limiter_choice: inline_rate_limiter or ref_rate_limiter

• any_domain - Optional Object
Enable this option

• api_endpoint_method - Optional String
HTTP method matcher specifies a list of methods to match an input HTTP method. The match is considered successful if the input method is a member of the list. The result of the match based on the method list is inverted if invert_matcher is true

• api_endpoint_path - Optional String
API Endpoint. The endpoint (path) of the request

• client_matcher - Optional String
Client Matcher. Client conditions for matching a rule

• inline_rate_limiter - Optional String
Configuration parameter for inline rate limiter

• ref_rate_limiter - Optional String
Type establishes a direct reference from one object(the referrer) to another(the referred). Such a reference is in form of tenant/namespace/name

• request_matcher - Optional String
Configuration parameter for request matcher

• specific_domain - Optional String
The rule will apply for a specific domain

• invert_matcher - Optional Bool
Invert Method Matcher. Invert the match result

• methods - Optional List Defaults to ANY
See HTTP Methods
List of methods values to match against

• any_client - Optional Object
Enable this option

• any_ip - Optional Object
Enable this option

• asn_list - Optional String
Unordered set of RFC 6793 defined 4-byte AS numbers that can be used to create allow or deny lists for use in network policy or service policy. It can be used to create the allow list only for DNS Load Balancer

• asn_matcher - Optional String
Match any AS number contained in the list of bgp_asn_sets

• client_selector - Optional String
Type can be used to establish a ‘selector reference’ from one object(called selector) to a set of other objects(called selectees) based on the value of expressions. A label selector is a label query over a set of resources. An empty label selector matches all objects

• ip_matcher - Optional String
Match any IP prefix contained in the list of ip_prefix_sets. The result of the match is inverted if invert_matcher is true

• ip_prefix_list - Optional String
List of IP Prefix strings to match against

• ip_threat_category_list - Optional String
IP Threat Category List Type. List of IP threat categories

• tls_fingerprint_matcher - Optional String
TLS fingerprint matcher specifies multiple criteria for matching a TLS fingerprint. The set of supported positive match criteria includes a list of known classes of TLS fingerprints and a list of exact values. The match is considered successful if either of these positive criteria are satisfied

• as_numbers - Optional List
Unordered set of RFC 6793 defined 4-byte AS numbers that can be used to create allow or deny lists for use in network policy or service policy. It can be used to create the allow list only for DNS Load Balancer

• asn_sets - Optional List
List of references to bgp_asn_set objects

• kind - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then kind will hold the referred object’s kind (e.g. ‘route’)

• name - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object’s(e.g. Route’s) name

• namespace - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object’s(e.g. Route’s) namespace

• tenant - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then tenant will hold the referred object’s(e.g. Route’s) tenant

• uid - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then uid will hold the referred object’s(e.g. Route’s) uid

• expressions - Optional List
Expressions contains the Kubernetes style label expression for selections

• invert_matcher - Optional Bool
Invert IP Matcher. Invert the match result

• prefix_sets - Optional List
List of references to ip_prefix_set objects

• kind - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then kind will hold the referred object’s kind (e.g. ‘route’)

• name - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object’s(e.g. Route’s) name

• namespace - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object’s(e.g. Route’s) namespace

• tenant - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then tenant will hold the referred object’s(e.g. Route’s) tenant

• uid - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then uid will hold the referred object’s(e.g. Route’s) uid

• invert_match - Optional Bool
Invert Match Result. Invert the match result

• ip_prefixes - Optional List
IPv4 Prefix List. List of IPv4 prefix strings

• exact_values - Optional List
List of exact TLS JA3 fingerprints to match the input TLS JA3 fingerprint against

• excluded_values - Optional List
List of TLS JA3 fingerprints to be excluded when matching the input TLS JA3 fingerprint. This can be used to skip known false positives when using one or more known TLS fingerprint classes in the enclosing matcher

• ref_user_id - Optional String
Type establishes a direct reference from one object(the referrer) to another(the referred). Such a reference is in form of tenant/namespace/name

• threshold - Optional Number
The total number of allowed requests for 1 unit (e.g. SECOND/MINUTE/HOUR etc.) of the specified period

• unit - Optional String Defaults to SECOND
Possible values are SECOND, MINUTE, HOUR
[Enum: SECOND|MINUTE|HOUR] Unit for the period per which the rate limit is applied. - SECOND: Second Rate limit period unit is seconds - MINUTE: Minute Rate limit period unit is minutes - HOUR: Hour Rate limit period unit is hours - DAY: Day Rate limit period unit is days

• use_http_lb_user_id - Optional Object
Enable this option

• name - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object’s(e.g. Route’s) name

• namespace - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object’s(e.g. Route’s) namespace

• tenant - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then tenant will hold the referred object’s(e.g. Route’s) tenant

• name - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object’s(e.g. Route’s) name

• namespace - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object’s(e.g. Route’s) namespace

• tenant - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then tenant will hold the referred object’s(e.g. Route’s) tenant

• cookie_matchers - Optional List
List of predicates for all cookies that need to be matched. The criteria for matching each cookie is described in individual instances of CookieMatcherType. The actual cookie values are extracted from the request API as a list of strings for each cookie name

• headers - Optional List
List of predicates for various HTTP headers that need to match. The criteria for matching each HTTP header are described in individual HeaderMatcherType instances. The actual HTTP header values are extracted from the request API as a list of strings for each HTTP header type

• jwt_claims - Optional List
List of predicates for various JWT claims that need to match. The criteria for matching each JWT claim are described in individual JWTClaimMatcherType instances. The actual JWT claims values are extracted from the JWT payload as a list of strings

• query_params - Optional List
List of predicates for all query parameters that need to be matched. The criteria for matching each query parameter are described in individual instances of QueryParameterMatcherType. The actual query parameter values are extracted from the request API as a list of strings for each query

• check_not_present - Optional Object
Configuration parameter for check not present

• check_present - Optional Object
Configuration parameter for check present

• invert_matcher - Optional Bool
Invert Matcher. Invert Match of the expression defined

• item - Optional String
Matcher specifies multiple criteria for matching an input string. The match is considered successful if any of the criteria are satisfied. The set of supported match criteria includes a list of exact values and a list of regular expressions

• name - Optional String
Cookie Name. A case-sensitive cookie name

• exact_values - Optional List
List of exact values to match the input against

• regex_values - Optional List
List of regular expressions to match the input against

• transformers - Optional List
See Transformers
Ordered list of transformers (starting from index 0) to be applied to the path before matching

• check_not_present - Optional Object
Configuration parameter for check not present

• check_present - Optional Object
Configuration parameter for check present

• invert_matcher - Optional Bool
Invert Header Matcher. Invert the match result

• name - Optional String
Header Name. A case-insensitive HTTP header name

• exact_values - Optional List
List of exact values to match the input against

• regex_values - Optional List
List of regular expressions to match the input against

• transformers - Optional List
See Transformers
Ordered list of transformers (starting from index 0) to be applied to the path before matching

• check_not_present - Optional Object
Configuration parameter for check not present

• check_present - Optional Object
Configuration parameter for check present

• invert_matcher - Optional Bool
Invert Matcher. Invert the match result

• name - Optional String
JWT Claim Name. JWT claim name

• exact_values - Optional List
List of exact values to match the input against

• regex_values - Optional List
List of regular expressions to match the input against

• transformers - Optional List
See Transformers
Ordered list of transformers (starting from index 0) to be applied to the path before matching

• check_not_present - Optional Object
Configuration parameter for check not present

• check_present - Optional Object
Configuration parameter for check present

• invert_matcher - Optional Bool
Invert Query Parameter Matcher. Invert the match result

• key - Optional String
Case-sensitive HTTP query parameter name

• exact_values - Optional List
List of exact values to match the input against

• regex_values - Optional List
List of regular expressions to match the input against

• transformers - Optional List
See Transformers
Ordered list of transformers (starting from index 0) to be applied to the path before matching

• bypass_rate_limiting_rules - Optional List
Category defines rules per URL or API group. If request matches any of these rules, skip Rate Limiting

• any_domain - Optional Object
Enable this option

• any_url - Optional Object
Enable this option

• api_endpoint - Optional String
API Endpoint. This defines API endpoint

• api_groups - Optional String
API Groups

• base_path - Optional String
The base path which this validation applies to

• client_matcher - Optional String
Client Matcher. Client conditions for matching a rule

• request_matcher - Optional String
Configuration parameter for request matcher

• specific_domain - Optional String
The rule will apply for a specific domain. For

• methods - Optional List Defaults to ANY
See HTTP Methods
Methods. Methods to be matched

• path - Optional String
Path. Path to be matched

• api_groups - Optional List
API Groups. Group or collection configuration