xcsh_enhanced_firewall_policy (Data Source)

Retrieves information about an Enhanced Firewall Policy resource in F5 Distributed Cloud for enhanced firewall policy specification. configuration. This is a read-only data source.

~> Note: For more information, see the F5 Distributed Cloud API documentation.

Example Usage

# EnhancedFirewallPolicy Data Source Example

terraform {
  required_version = ">= 1.0"

  required_providers {
    xcsh = {
      source  = "f5-sales-demo/xcsh"
      version = ">= 0.1.0"
    }
  }
}

# Look up an existing EnhancedFirewallPolicy by name
data "xcsh_enhanced_firewall_policy" "example" {
  name      = "example-enhanced-firewall-policy"
  namespace = "staging"
}

output "enhanced_firewall_policy_id" {
  value = data.xcsh_enhanced_firewall_policy.example.id
}

Argument Reference

-> Syntax Rule: This provider uses OneOf groups for mutually exclusive options. Fields documented as “Optional Block” use block syntax field_name { ... }. Empty OneOf object attributes use field_name = {}; conditional selection uses condition ? {} : null. Boolean attributes (such as add_hsts and http_redirect) use = true or = false.

🔶 High Risk Operations — Some operations on this resource have high danger level. Destructive operations may require confirmation.

Minimum Configuration

Required fields:

name
namespace

Example (API format):

metadata:
  name: my-efp
  namespace: demo-app
spec: {}

Metadata Argument Reference

• name - Required String
Name of the EnhancedFirewallPolicy

• namespace - Required String
Namespace where the EnhancedFirewallPolicy exists

Attributes Reference

In addition to all arguments above, the following attributes are exported:

• allow_all - Optional Object Defaults to map[]
Enable this option. Server applies default when omitted

• allowed_destinations - Optional String
List of IP Address prefixes. Prefix must contain both prefix and prefix-length The list can contain mix of both IPv4 and IPv6 prefixes

• allowed_sources - Optional String
List of IP Address prefixes. Prefix must contain both prefix and prefix-length The list can contain mix of both IPv4 and IPv6 prefixes

• annotations - Optional Map
Annotations applied to this resource

• denied_destinations - Optional String
List of IP Address prefixes. Prefix must contain both prefix and prefix-length The list can contain mix of both IPv4 and IPv6 prefixes

• denied_sources - Optional String
List of IP Address prefixes. Prefix must contain both prefix and prefix-length The list can contain mix of both IPv4 and IPv6 prefixes

• deny_all - Optional Object
Enable this option

• description - Optional String
Description of the EnhancedFirewallPolicy

• id - Optional String
Unique identifier for the resource

• labels - Optional Map
Labels applied to this resource

• rule_list - Optional String
Custom Enhanced Firewall Policy Rules. Custom Enhanced Firewall Policy Rules

• prefix - Optional List
IP Address prefix in string format. String must contain both prefix and prefix-length

• rules - Optional List
Ordered List of Enhanced Firewall Policy Rules

• advanced_action - Optional String
Network Policy Rule Advanced Action provides additional OPTIONS along with RuleAction and PBRRuleAction

• all_destinations - Optional Object
Configuration parameter for all destinations

• all_sli_vips - Optional Object
Enable this option

• all_slo_vips - Optional Object
Enable this option

• all_sources - Optional Object
Configuration parameter for all sources

• all_tcp_traffic - Optional Object
Configuration parameter for all TCP traffic

• all_traffic - Optional Object
Configuration parameter for all traffic

• all_udp_traffic - Optional Object
Configuration parameter for all UDP traffic

• allow - Optional Object
Enable this option

• applications - Optional String
Configuration parameter for applications

• deny - Optional Object
Enable this option

• destination_aws_vpc_ids - Optional String
Configuration parameter for destination AWS VPC ids

• destination_ip_prefix_set - Optional String
List of references to ip_prefix_set objects

• destination_label_selector - Optional String
Type can be used to establish a ‘selector reference’ from one object(called selector) to a set of other objects(called selectees) based on the value of expressions. A label selector is a label query over a set of resources. An empty label selector matches all objects

• destination_prefix_list - Optional String
List of IPv4 prefixes that represent an endpoint

• insert_service - Optional String
Action to forward traffic to external service

• inside_destinations - Optional Object
Configuration parameter for inside destinations

• inside_sources - Optional Object
Configuration parameter for inside sources

• label_matcher - Optional String
Label matcher specifies a list of label keys whose values need to match for source/client and destination/server. Note that the actual label values are not specified and do not matter. This allows an ability to scope grouping by the label key name

• metadata - Optional String
MessageMetaType is metadata (common attributes) of a message that only certain messages have. This information is propagated to the metadata of a child object that gets created from the containing message during view processing. The information in this type can be specified by user during create

• outside_destinations - Optional Object
Configuration parameter for outside destinations

• outside_sources - Optional Object
Configuration parameter for outside sources

• protocol_port_range - Optional String
Protocol and Port. Protocol and Port ranges

• source_aws_vpc_ids - Optional String
Configuration parameter for source AWS VPC ids

• source_ip_prefix_set - Optional String
List of references to ip_prefix_set objects

• source_label_selector - Optional String
Type can be used to establish a ‘selector reference’ from one object(called selector) to a set of other objects(called selectees) based on the value of expressions. A label selector is a label query over a set of resources. An empty label selector matches all objects

• source_prefix_list - Optional String
List of IPv4 prefixes that represent an endpoint

• action - Optional String Defaults to NOLOG
Possible values are NOLOG, LOG
[Enum: NOLOG|LOG] Choice to choose logging or no logging This works together with option selected via NetworkPolicyRuleAction or any other action specified x-

• applications - Optional List Defaults to APPLICATION_HTTP
Possible values are APPLICATION_HTTP, APPLICATION_HTTPS, APPLICATION_SNMP, APPLICATION_DNS
[Enum: APPLICATION_HTTP|APPLICATION_HTTPS|APPLICATION_SNMP|APPLICATION_DNS] Application Protocols. Application protocols like HTTP, SNMP

• vpc_id - Optional List
AWS VPC List. List of VPC Identifiers in AWS

• ref - Optional List
List of references to ip_prefix_set objects

• kind - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then kind will hold the referred object’s kind (e.g. ‘route’)

• name - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object’s(e.g. Route’s) name

• namespace - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object’s(e.g. Route’s) namespace

• tenant - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then tenant will hold the referred object’s(e.g. Route’s) tenant

• uid - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then uid will hold the referred object’s(e.g. Route’s) uid

• expressions - Optional List
Expressions contains the Kubernetes style label expression for selections

• prefixes - Optional List
List of IPv4 prefixes that represent an endpoint

• nfv_service - Optional String
Type establishes a direct reference from one object(the referrer) to another(the referred). Such a reference is in form of tenant/namespace/name

• name - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object’s(e.g. Route’s) name

• namespace - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object’s(e.g. Route’s) namespace

• tenant - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then tenant will hold the referred object’s(e.g. Route’s) tenant

• keys - Optional List
The list of label key names that have to match

• description_spec - Optional String
Description. Human readable description

• name - Optional String
Name of the message. The value of name has to follow DNS-1035 format

• port_ranges - Optional List
List of port ranges. Each range is a single port or a pair of start and end ports e.g. 8080-8192

• protocol - Optional String
Possible values are ALL, TCP, UDP, ICMP
[Enum: ALL|TCP|UDP|ICMP] Protocol in IP packet to be used as match criteria Values are TCP, UDP, and ICMP