xcsh_cloud_link (Resource)

Manages new CloudLink with configured parameters in F5 Distributed Cloud.

~> Note: For more information, see the F5 Distributed Cloud API documentation.

Example Usage

# CloudLink Resource Example
# Manages new CloudLink with configured parameters in F5 Distributed Cloud.

terraform {
  required_version = ">= 1.0"

  required_providers {
    xcsh = {
      source  = "f5-sales-demo/xcsh"
      version = ">= 0.1.0"
    }
  }
}

# Basic CloudLink configuration
resource "xcsh_cloud_link" "example" {
  name      = "example-cloud-link"
  namespace = "staging"
}

Argument Reference

-> Syntax Rule: This provider uses OneOf groups for mutually exclusive options. Fields documented as “Optional Block” use block syntax field_name { ... }. Empty OneOf object attributes use field_name = {}; conditional selection uses condition ? {} : null. Boolean attributes (such as add_hsts and http_redirect) use = true or = false.

🔶 High Risk Operations — Some operations on this resource have high danger level. Destructive operations may require confirmation.

Metadata Argument Reference

• name - Required String
Name of the Cloud Link. Must be unique within the namespace

• namespace - Required String
Namespace where the Cloud Link is created

• annotations - Optional Map
Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata

• description - Optional String
Human readable description for the object

• disable - Optional Bool
A value of true administratively disables the object

• labels - Optional Map
Labels is a user defined key value map that can be attached to resources for organization and filtering

Spec Argument Reference

-> One of the following: • aws - Optional Block
Amazon Web Services(AWS) CloudLink Provider. CloudLink for AWS Cloud Provider
See AWS below for details.

• gcp - Optional Block
Google Cloud Platform (GCP) CloudLink Provider. CloudLink for GCP Cloud Provider
See GCP below for details.

-> One of the following: • disabled - Optional Object
Enable this option

• enabled - Optional Block
CloudLink ADN Network Config
See Enabled below for details.

• timeouts - Optional Block
See Timeouts below for details.

Attributes Reference

In addition to all arguments above, the following attributes are exported:

• id - Optional String
Unique identifier for the resource

AWS

An aws block supports the following:

• aws_cred - Optional Block
Type establishes a direct reference from one object(the referrer) to another(the referred). Such a reference is in form of tenant/namespace/name
See AWS Cred below.

• byoc - Optional Block
Bring Your Own Connections. List of Bring You Own Connection
See Byoc below.

• custom_asn - Optional Number
F5XC will use custom ASN to create a Direct Connect Gateway

AWS AWS Cred

An aws_cred block (within aws) supports the following:

• name - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object’s(e.g. Route’s) name

• namespace - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object’s(e.g. Route’s) namespace

• tenant - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then tenant will hold the referred object’s(e.g. Route’s) tenant

AWS Byoc

A byoc block (within aws) supports the following:

• connections - Optional Block
List of Bring You Own Connections. These AWS Direct Connect connections are not managed by F5XC but will be used for connecting sites and REs
See Connections below.

AWS Byoc Connections

A connections block (within aws.byoc) supports the following:

• auth_key - Optional Block
SecretType is used in an object to indicate a sensitive/confidential field
See Auth Key below.

• bgp_asn - Optional Number
The Border Gateway Protocol (BGP) Autonomous System Number (ASN) of your on-premises router for the new virtual interface to be configured on AWS

• connection_id - Optional String
ID of the existing AWS Direct Connect Connection

• ipv4 - Optional Block
Configure BGP IPv4 peering for endpoints
See IPv4 below.

• metadata - Optional Block
MessageMetaType is metadata (common attributes) of a message that only certain messages have. This information is propagated to the metadata of a child object that gets created from the containing message during view processing. The information in this type can be specified by user during create
See Metadata below.

• system_generated_name - Optional Object
Enable this option

• tags - Optional Map
AWS Tags is a label consisting of a user-defined key and value. It helps to manage, identify, organize, search for, and filter resources in AWS console. Specified tags will be added to Virtual interface along with any F5XC specific tags

• user_assigned_name - Optional String
User is managing the AWS resource name

• virtual_interface_type - Optional String Defaults to PRIVATE
[Enum: PRIVATE] Defines the type of virtual interface that needs to be configured on AWS - PRIVATE: Private A private virtual interface should be used to access an Amazon VPC using private IP addresses. - TRANSIT: Transit A transit virtual interface is a VLAN that transports traffic from a Direct Connect.. The only possible value is PRIVATE

• vlan - Optional Number
Virtual Local Area Network number for the new virtual interface to be configured on the AWS. This tag is required for any traffic traversing the AWS Direct Connect connection

AWS Byoc Connections Auth Key

An auth_key block (within aws.byoc.connections) supports the following:

• blindfold_secret_info - Optional Block
BlindfoldSecretInfoType specifies information about the Secret managed by F5XC Secret Management
See Blindfold Secret Info below.

• clear_secret_info - Optional Block
ClearSecretInfoType specifies information about the Secret that is not encrypted
See Clear Secret Info below.

AWS Byoc Connections Auth Key Blindfold Secret Info

Deeply nested Info block collapsed for readability.

AWS Byoc Connections Auth Key Clear Secret Info

Deeply nested Info block collapsed for readability.

AWS Byoc Connections IPv4

An ipv4 block (within aws.byoc.connections) supports the following:

• aws_router_peer_address - Optional String
The BGP peer IP configured on the AWS endpoint

• router_peer_address - Optional String
The BGP peer IP configured on your (customer) endpoint

AWS Byoc Connections Metadata

A metadata block (within aws.byoc.connections) supports the following:

• description_spec - Optional String
Description. Human readable description

• name - Optional String
Name of the message. The value of name has to follow DNS-1035 format

AWS Byoc Connections System Generated Name

A system_generated_name block (within aws.byoc.connections) supports the following:

Enabled

An enabled block supports the following:

• cloudlink_network_name - Optional String
Establish private connectivity with the F5 Distributed Cloud Global Network using a Private ADN network. To provision a Private ADN network, please contact F5 Distributed Cloud support

GCP

A gcp block supports the following:

• byoc - Optional Block
GCP Bring Your Own Connections. List of GCP Bring You Own Connections
See Byoc below.

• gcp_cred - Optional Block
Type establishes a direct reference from one object(the referrer) to another(the referred). Such a reference is in form of tenant/namespace/name
See GCP Cred below.

GCP Byoc

A byoc block (within gcp) supports the following:

• connections - Optional Block
Each ‘Bring Your Own Connection’ represents a virtual connection that the customer has provisioned in the Cloud (
See Connections below.

GCP Byoc Connections

A connections block (within gcp.byoc) supports the following:

• interconnect_attachment_name - Optional String
Name of already-existing GCP Cloud Interconnect Attachment

• project - Optional String
Specify a GCP Project for the interconnect attachment

• same_as_credential - Optional Object
Configuration parameter for same as credential

GCP Byoc Connections Metadata

A metadata block (within gcp.byoc.connections) supports the following:

• description_spec - Optional String
Description. Human readable description

• name - Optional String
Name of the message. The value of name has to follow DNS-1035 format

GCP Byoc Connections Same As Credential

A same_as_credential block (within gcp.byoc.connections) supports the following:

GCP GCP Cred

A gcp_cred block (within gcp) supports the following:

• name - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then name will hold the referred object’s(e.g. Route’s) name

• namespace - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then namespace will hold the referred object’s(e.g. Route’s) namespace

• tenant - Optional String
When a configuration object(e.g. Virtual_host) refers to another(e.g route) then tenant will hold the referred object’s(e.g. Route’s) tenant

Timeouts

A timeouts block supports the following:

• create - Optional String (Defaults to 10 minutes)
Used when creating the resource

• delete - Optional String (Defaults to 10 minutes)
Used when deleting the resource

• read - Optional String (Defaults to 5 minutes)
Used when retrieving the resource

• update - Optional String (Defaults to 10 minutes)
Used when updating the resource

Common Types

The following type definitions are used throughout this resource. See the full definition here rather than repeated inline.

Object Reference {#common-object-reference}

Object references establish a direct reference from one configuration object to another in F5 Distributed Cloud. References use the format tenant/namespace/name.

Field	Type	Description
`name`	String	Name of the referenced object
`namespace`	String	Namespace containing the referenced object
`tenant`	String	Tenant of the referenced object (system-managed)

Transformers {#common-transformers}

Transformers apply transformations to input values before matching. Multiple transformers can be applied in order.

Value	Description
`LOWER_CASE`	Convert to lowercase
`UPPER_CASE`	Convert to uppercase
`BASE64_DECODE`	Decodebase64 content
`NORMALIZE_PATH`	Normalize URL path
`REMOVE_WHITESPACE`	Remove whitespace characters
`URL_DECODE`	Decode URL-encoded characters
`TRIM_LEFT`	Trim leading whitespace
`TRIM_RIGHT`	Trim trailing whitespace
`TRIM`	Trim both leading and trailing whitespace

HTTP Methods {#common-http-methods}

HTTP methods used for request matching.

Value	Description
`ANY`	Match any HTTP method
`GET`	HTTP GET request
`HEAD`	HTTP HEAD request
`POST`	HTTP POST request
`PUT`	HTTP PUT request
`DELETE`	HTTP DELETE request
`CONNECT`	HTTP CONNECT request
`OPTIONS`	HTTP OPTIONS request
`TRACE`	HTTP TRACE request
`PATCH`	HTTP PATCH request
`COPY`	HTTP COPY request (WebDAV)

TLS Fingerprints {#common-tls-fingerprints}

TLS fingerprint categories for malicious client detection.

Value	Description
`TLS_FINGERPRINT_NONE`	No fingerprint matching
`ANY_MALICIOUS_FINGERPRINT`	Match any known malicious fingerprint
`ADWARE`	Adware-associated fingerprints
`DRIDEX`	Dridex malware fingerprints
`GOOTKIT`	Gootkit malware fingerprints
`RANSOMWARE`	Ransomware-associated fingerprints
`TRICKBOT`	Trickbot malware fingerprints

IP Threat Categories {#common-ip-threat-categories}

IP address threat categories for security filtering.

Value	Description
`SPAM_SOURCES`	Known spam sources
`WINDOWS_EXPLOITS`	Windows exploit sources
`WEB_ATTACKS`	Web attack sources
`BOTNETS`	Known botnet IPs
`SCANNERS`	Network scanner IPs
`REPUTATION`	Poor reputation IPs
`PHISHING`	Phishing-related IPs
`PROXY`	Anonymous proxy IPs
`MOBILE_THREATS`	Mobile threat sources
`TOR_PROXY`	Tor exit nodes
`DENIAL_OF_SERVICE`	DoS attack sources
`NETWORK`	Known bad network ranges

Import

Import is supported using the following syntax:

# Import using namespace/name format
terraform import xcsh_cloud_link.example system/example