xcsh_waf_exclusion_policy (Data Source)

Retrieves information about WAF exclusion policy in F5 Distributed Cloud. This is a read-only data source.

~> Note: For more information, see the F5 Distributed Cloud API documentation.

Example Usage

# WAFExclusionPolicy Data Source Example

terraform {
  required_version = ">= 1.0"

  required_providers {
    xcsh = {
      source  = "f5-sales-demo/xcsh"
      version = ">= 0.1.0"
    }
  }
}

# Look up an existing WAFExclusionPolicy by name
data "xcsh_waf_exclusion_policy" "example" {
  name      = "example-waf-exclusion-policy"
  namespace = "staging"
}

output "waf_exclusion_policy_id" {
  value = data.xcsh_waf_exclusion_policy.example.id
}

Argument Reference

-> Syntax Rule: This provider uses OneOf groups for mutually exclusive options. Fields documented as “Optional Block” use block syntax field_name { ... }. Empty OneOf object attributes use field_name = {}; conditional selection uses condition ? {} : null. Boolean attributes (such as add_hsts and http_redirect) use = true or = false.

🔶 High Risk Operations — Some operations on this resource have high danger level. Destructive operations may require confirmation.

Minimum Configuration

Required fields:

name
namespace
waf_exclusion_rules

Example (API format):

apiVersion: v1
kind: waf_exclusion_policy
metadata:
  name: example-waf-exclusion
  namespace: demo-app
spec:
  waf_exclusion_rules:
    - metadata:
        name: exclude-health
      exact_path: "/health"

Metadata Argument Reference

• name - Required String
Name of the WAFExclusionPolicy

• namespace - Required String
Namespace where the WAFExclusionPolicy exists

Attributes Reference

In addition to all arguments above, the following attributes are exported:

• annotations - Optional Map
Annotations applied to this resource

• description - Optional String
Description of the WAFExclusionPolicy

• id - Optional String
Unique identifier for the resource

• labels - Optional Map
Labels applied to this resource

• waf_exclusion_rules - Optional List
WAF Exclusion Rules. An ordered list of rules

• any_domain - Optional Object
Enable this option

• any_path - Optional Object
Enable this option

• app_firewall_detection_control - Optional String
Define the list of Signature IDs, Violations, Attack Types and Bot Names that should be excluded from triggering on the defined match criteria

• exact_value - Optional String
Exact domain name

• expiration_timestamp - Optional String
Specifies expiration_timestamp the RFC 3339 format timestamp at which the containing rule is considered to be logically expired. The rule continues to exist in the configuration but is not applied anymore

• metadata - Optional String
MessageMetaType is metadata (common attributes) of a message that only certain messages have. This information is propagated to the metadata of a child object that gets created from the containing message during view processing. The information in this type can be specified by user during create

• methods - Optional List Defaults to ANY
See HTTP Methods
Methods. Methods to be matched

• path_prefix - Optional String
Path prefix to match (e.g. The value / will match on all paths)

• path_regex - Optional String
Define the regex for the path. For example, the regex ^/.*$ will match on all paths

• suffix_value - Optional String
Suffix of domain name e.g ‘xyz.com’ will match ‘*.xyz.com’ and ‘xyz.com’

• waf_skip_processing - Optional Object
Enable this option

• exclude_attack_type_contexts - Optional List
Exclude an entire attack type only in the named context. For migrated per-parameter exceptions, prefer this over signature-ID exclusions because one payload can trigger several signatures; unrelated parameters and attack types remain protected

• exclude_bot_name_contexts - Optional List
Bot Names to be excluded for the defined match criteria

• exclude_signature_contexts - Optional List
Signature IDs to be excluded for the defined match criteria

• exclude_violation_contexts - Optional List
Violations to be excluded for the defined match criteria

• context - Optional String Defaults to CONTEXT_ANY
Possible values are CONTEXT_ANY, CONTEXT_BODY, CONTEXT_REQUEST, CONTEXT_RESPONSE, CONTEXT_PARAMETER, CONTEXT_HEADER, CONTEXT_COOKIE, CONTEXT_URL, CONTEXT_URI
[Enum: CONTEXT_ANY|CONTEXT_BODY|CONTEXT_REQUEST|CONTEXT_RESPONSE|CONTEXT_PARAMETER|CONTEXT_HEADER|CONTEXT_COOKIE|CONTEXT_URL|CONTEXT_URI] The available contexts for Exclusion rules. - CONTEXT_ANY: CONTEXT_ANY Detection will be excluded for all contexts. - CONTEXT_BODY: CONTEXT_BODY Detection will be excluded for the request body. - CONTEXT_REQUEST: CONTEXT_REQUEST Detection will be excluded for the request. - CONTEXT_RESPONSE

• context_name - Optional String
Parameter, cookie, or header name selected by context. For a parameter-scoped WAF exception, set context to CONTEXT_PARAMETER and name only the intended parameter

• exclude_attack_type - Optional String Defaults to ATTACK_TYPE_NONE
Possible values are ATTACK_TYPE_NONE, ATTACK_TYPE_NON_BROWSER_CLIENT, ATTACK_TYPE_OTHER_APPLICATION_ATTACKS, ATTACK_TYPE_TROJAN_BACKDOOR_SPYWARE, ATTACK_TYPE_DETECTION_EVASION, ATTACK_TYPE_VULNERABILITY_SCAN, ATTACK_TYPE_ABUSE_OF_FUNCTIONALITY, ATTACK_TYPE_AUTHENTICATION_AUTHORIZATION_ATTACKS, ATTACK_TYPE_BUFFER_OVERFLOW, ATTACK_TYPE_PREDICTABLE_RESOURCE_LOCATION, ATTACK_TYPE_INFORMATION_LEAKAGE, ATTACK_TYPE_DIRECTORY_INDEXING, ATTACK_TYPE_PATH_TRAVERSAL, ATTACK_TYPE_XPATH_INJECTION, ATTACK_TYPE_LDAP_INJECTION, ATTACK_TYPE_SERVER_SIDE_CODE_INJECTION, ATTACK_TYPE_COMMAND_EXECUTION, ATTACK_TYPE_SQL_INJECTION, ATTACK_TYPE_CROSS_SITE_SCRIPTING, ATTACK_TYPE_DENIAL_OF_SERVICE, ATTACK_TYPE_HTTP_PARSER_ATTACK, ATTACK_TYPE_SESSION_HIJACKING, ATTACK_TYPE_HTTP_RESPONSE_SPLITTING, ATTACK_TYPE_FORCEFUL_BROWSING, ATTACK_TYPE_REMOTE_FILE_INCLUDE, ATTACK_TYPE_MALICIOUS_FILE_UPLOAD, ATTACK_TYPE_GRAPHQL_PARSER_ATTACK
[Enum: ATTACK_TYPE_NONE|ATTACK_TYPE_NON_BROWSER_CLIENT|ATTACK_TYPE_OTHER_APPLICATION_ATTACKS|ATTACK_TYPE_TROJAN_BACKDOOR_SPYWARE|ATTACK_TYPE_DETECTION_EVASION|ATTACK_TYPE_VULNERABILITY_SCAN|ATTACK_TYPE_ABUSE_OF_FUNCTIONALITY|ATTACK_TYPE_AUTHENTICATION_AUTHORIZATION_ATTACKS|ATTACK_TYPE_BUFFER_OVERFLOW|ATTACK_TYPE_PREDICTABLE_RESOURCE_LOCATION|ATTACK_TYPE_INFORMATION_LEAKAGE|ATTACK_TYPE_DIRECTORY_INDEXING|ATTACK_TYPE_PATH_TRAVERSAL|ATTACK_TYPE_XPATH_INJECTION|ATTACK_TYPE_LDAP_INJECTION|ATTACK_TYPE_SERVER_SIDE_CODE_INJECTION|ATTACK_TYPE_COMMAND_EXECUTION|ATTACK_TYPE_SQL_INJECTION|ATTACK_TYPE_CROSS_SITE_SCRIPTING|ATTACK_TYPE_DENIAL_OF_SERVICE|ATTACK_TYPE_HTTP_PARSER_ATTACK|ATTACK_TYPE_SESSION_HIJACKING|ATTACK_TYPE_HTTP_RESPONSE_SPLITTING|ATTACK_TYPE_FORCEFUL_BROWSING|ATTACK_TYPE_REMOTE_FILE_INCLUDE|ATTACK_TYPE_MALICIOUS_FILE_UPLOAD|ATTACK_TYPE_GRAPHQL_PARSER_ATTACK] List of all Attack Types ATTACK_TYPE_NONE ATTACK_TYPE_NON_BROWSER_CLIENT ATTACK_TYPE_OTHER_APPLICATION_ATTACKS ATTACK_TYPE_TROJAN_BACKDOOR_SPYWARE ATTACK_TYPE_DETECTION_EVASION ATTACK_TYPE_VULNERABILITY_SCAN ATTACK_TYPE_ABUSE_OF_FUNCTIONALITY ATTACK_TYPE_AUTHENTICATION_AUTHORIZATION_ATTACKS

• bot_name - Optional String
Bot Name. Human-readable name for the resource

• context_name - Optional String
Relevant only for contexts: Header, Cookie and Parameter. Name of the Context that the WAF Exclusion Rules will check. Wildcard matching can be used by prefixing or suffixing the context name with an wildcard asterisk (*)

• signature_id - Optional Number
The allowed values for signature ID are 0 and in the range of 200000001-299999999. 0 implies that all signatures will be excluded for the specified context

• exclude_violation - Optional String Defaults to VIOL_NONE
Possible values are VIOL_NONE, VIOL_FILETYPE, VIOL_METHOD, VIOL_MANDATORY_HEADER, VIOL_HTTP_RESPONSE_STATUS, VIOL_REQUEST_MAX_LENGTH, VIOL_FILE_UPLOAD, VIOL_FILE_UPLOAD_IN_BODY, VIOL_XML_MALFORMED, VIOL_JSON_MALFORMED, VIOL_ASM_COOKIE_MODIFIED, VIOL_HTTP_PROTOCOL_MULTIPLE_HOST_HEADERS, VIOL_HTTP_PROTOCOL_BAD_HOST_HEADER_VALUE, VIOL_HTTP_PROTOCOL_UNPARSABLE_REQUEST_CONTENT, VIOL_HTTP_PROTOCOL_NULL_IN_REQUEST, VIOL_HTTP_PROTOCOL_BAD_HTTP_VERSION, VIOL_HTTP_PROTOCOL_SEVERAL_CONTENT_LENGTH_HEADERS, VIOL_EVASION_DIRECTORY_TRAVERSALS, VIOL_MALFORMED_REQUEST, VIOL_EVASION_MULTIPLE_DECODING, VIOL_DATA_GUARD, VIOL_EVASION_APACHE_WHITESPACE, VIOL_COOKIE_MODIFIED, VIOL_EVASION_IIS_UNICODE_CODEPOINTS, VIOL_EVASION_IIS_BACKSLASHES, VIOL_EVASION_PERCENT_U_DECODING, VIOL_EVASION_BARE_BYTE_DECODING, VIOL_EVASION_BAD_UNESCAPE, VIOL_HTTP_PROTOCOL_BODY_IN_GET_OR_HEAD_REQUEST, VIOL_ENCODING, VIOL_COOKIE_MALFORMED, VIOL_GRAPHQL_FORMAT, VIOL_GRAPHQL_MALFORMED, VIOL_GRAPHQL_INTROSPECTION_QUERY
[Enum: VIOL_NONE|VIOL_FILETYPE|VIOL_METHOD|VIOL_MANDATORY_HEADER|VIOL_HTTP_RESPONSE_STATUS|VIOL_REQUEST_MAX_LENGTH|VIOL_FILE_UPLOAD|VIOL_FILE_UPLOAD_IN_BODY|VIOL_XML_MALFORMED|VIOL_JSON_MALFORMED|VIOL_ASM_COOKIE_MODIFIED|VIOL_HTTP_PROTOCOL_MULTIPLE_HOST_HEADERS|VIOL_HTTP_PROTOCOL_BAD_HOST_HEADER_VALUE|VIOL_HTTP_PROTOCOL_UNPARSABLE_REQUEST_CONTENT|VIOL_HTTP_PROTOCOL_NULL_IN_REQUEST|VIOL_HTTP_PROTOCOL_BAD_HTTP_VERSION|VIOL_HTTP_PROTOCOL_SEVERAL_CONTENT_LENGTH_HEADERS|VIOL_EVASION_DIRECTORY_TRAVERSALS|VIOL_MALFORMED_REQUEST|VIOL_EVASION_MULTIPLE_DECODING|VIOL_DATA_GUARD|VIOL_EVASION_APACHE_WHITESPACE|VIOL_COOKIE_MODIFIED|VIOL_EVASION_IIS_UNICODE_CODEPOINTS|VIOL_EVASION_IIS_BACKSLASHES|VIOL_EVASION_PERCENT_U_DECODING|VIOL_EVASION_BARE_BYTE_DECODING|VIOL_EVASION_BAD_UNESCAPE|VIOL_HTTP_PROTOCOL_BODY_IN_GET_OR_HEAD_REQUEST|VIOL_ENCODING|VIOL_COOKIE_MALFORMED|VIOL_GRAPHQL_FORMAT|VIOL_GRAPHQL_MALFORMED|VIOL_GRAPHQL_INTROSPECTION_QUERY] List of all supported Violation Types VIOL_NONE VIOL_FILETYPE VIOL_METHOD VIOL_MANDATORY_HEADER VIOL_HTTP_RESPONSE_STATUS VIOL_REQUEST_MAX_LENGTH VIOL_FILE_UPLOAD VIOL_FILE_UPLOAD_IN_BODY VIOL_XML_MALFORMED VIOL_JSON_MALFORMED VIOL_ASM_COOKIE_MODIFIED VIOL_HTTP_PROTOCOL_MULTIPLE_HOST_HEADERS

• description_spec - Optional String
Description. Human readable description

• name - Optional String
Name of the message. The value of name has to follow DNS-1035 format

Common Types

The following type definitions are used throughout this resource. See the full definition here rather than repeated inline.

Object Reference {#common-object-reference}

Object references establish a direct reference from one configuration object to another in F5 Distributed Cloud. References use the format tenant/namespace/name.

Field	Type	Description
`name`	String	Name of the referenced object
`namespace`	String	Namespace containing the referenced object
`tenant`	String	Tenant of the referenced object (system-managed)

Transformers {#common-transformers}

Transformers apply transformations to input values before matching. Multiple transformers can be applied in order.

Value	Description
`LOWER_CASE`	Convert to lowercase
`UPPER_CASE`	Convert to uppercase
`BASE64_DECODE`	Decodebase64 content
`NORMALIZE_PATH`	Normalize URL path
`REMOVE_WHITESPACE`	Remove whitespace characters
`URL_DECODE`	Decode URL-encoded characters
`TRIM_LEFT`	Trim leading whitespace
`TRIM_RIGHT`	Trim trailing whitespace
`TRIM`	Trim both leading and trailing whitespace

HTTP Methods {#common-http-methods}

HTTP methods used for request matching.

Value	Description
`ANY`	Match any HTTP method
`GET`	HTTP GET request
`HEAD`	HTTP HEAD request
`POST`	HTTP POST request
`PUT`	HTTP PUT request
`DELETE`	HTTP DELETE request
`CONNECT`	HTTP CONNECT request
`OPTIONS`	HTTP OPTIONS request
`TRACE`	HTTP TRACE request
`PATCH`	HTTP PATCH request
`COPY`	HTTP COPY request (WebDAV)

TLS Fingerprints {#common-tls-fingerprints}

TLS fingerprint categories for malicious client detection.

Value	Description
`TLS_FINGERPRINT_NONE`	No fingerprint matching
`ANY_MALICIOUS_FINGERPRINT`	Match any known malicious fingerprint
`ADWARE`	Adware-associated fingerprints
`DRIDEX`	Dridex malware fingerprints
`GOOTKIT`	Gootkit malware fingerprints
`RANSOMWARE`	Ransomware-associated fingerprints
`TRICKBOT`	Trickbot malware fingerprints

IP Threat Categories {#common-ip-threat-categories}

IP address threat categories for security filtering.

Value	Description
`SPAM_SOURCES`	Known spam sources
`WINDOWS_EXPLOITS`	Windows exploit sources
`WEB_ATTACKS`	Web attack sources
`BOTNETS`	Known botnet IPs
`SCANNERS`	Network scanner IPs
`REPUTATION`	Poor reputation IPs
`PHISHING`	Phishing-related IPs
`PROXY`	Anonymous proxy IPs
`MOBILE_THREATS`	Mobile threat sources
`TOR_PROXY`	Tor exit nodes
`DENIAL_OF_SERVICE`	DoS attack sources
`NETWORK`	Known bad network ranges