xcsh_protected_application (Resource)

Manages applications protected by Bot Defense in F5 Distributed Cloud.

~> Note: For more information, see the F5 Distributed Cloud API documentation.

Example Usage

# ProtectedApplication Resource Example
# Manages applications protected by Bot Defense in F5 Distributed Cloud.

terraform {
  required_version = ">= 1.0"

  required_providers {
    xcsh = {
      source  = "f5-sales-demo/xcsh"
      version = ">= 0.1.0"
    }
  }
}

# Basic ProtectedApplication configuration
resource "xcsh_protected_application" "example" {
  name      = "example-protected-application"
  namespace = "staging"
}

Argument Reference

-> Syntax Rule: This provider uses OneOf groups for mutually exclusive options. Fields documented as “Optional Block” use block syntax field_name { ... }. Empty OneOf object attributes use field_name = {}; conditional selection uses condition ? {} : null. Boolean attributes (such as add_hsts and http_redirect) use = true or = false.

🔶 High Risk Operations — Some operations on this resource have high danger level. Destructive operations may require confirmation.

Metadata Argument Reference

• name - Required String
Name of the Protected Application. Must be unique within the namespace

• namespace - Required String
Namespace where the Protected Application is created

• annotations - Optional Map
Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata

• description - Optional String
Human readable description for the object

• disable - Optional Bool
A value of true administratively disables the object

• labels - Optional Map
Labels is a user defined key value map that can be attached to resources for organization and filtering

Spec Argument Reference

-> One of the following: • adobe_commerce_connector - Optional Object
Configuration parameter for adobe commerce connector

• big_ip_iapp - Optional Object
Enable this option

• cloudflare - Optional Block
Bot Defense policy configuration for Cloudflare
See Cloudflare below for details.

• cloudfront - Optional Block
Bot Defense policy configuration for AWS Cloudfront
See Cloudfront below for details.

• custom_connector - Optional Object
Configuration parameter for custom connector

• f5_big_ip - Optional Object
Enable this option

• salesforce_commerce_connector - Optional Object
Configuration parameter for salesforce commerce connector

• region - Optional String Defaults to US
Possible values are US, EU, ASIA, CA
[Enum: US|EU|ASIA|CA] Defines a selection for Bot Defense region - US: US United States of America - EU: EU European Union - ASIA: ASIA Asia - CA: CA Canada

• timeouts - Optional Block

Attributes Reference

In addition to all arguments above, the following attributes are exported:

• id - Optional String
Unique identifier for the resource

Cloudflare

A cloudflare block supports the following:

• continue_mitigation_action_hdr - Optional String
Case-insensitive HTTP header name for Continue Mitigation Action when add header selected

• disable_js_insert - Optional Object
Configuration parameter for disable js insert

• disable_mobile_sdk - Optional Object
Enable this option

• js_insertion_rules - Optional Block
Defines custom JavaScript insertion rules for Bot Defense Policy
See Js Insertion Rules below.

• loglevel - Optional String Defaults to LOG_UNDEFINED
Possible values are LOG_UNDEFINED, LOG_ERROR, LOG_WARNING, LOG_INFO, LOG_DEBUG
[Enum: LOG_UNDEFINED|LOG_ERROR|LOG_WARNING|LOG_INFO|LOG_DEBUG] Select the level of logging desired. Levels are cumulative (e.g. Debug includes Error, Warning, and Informational) - LOG_UNDEFINED: Undefined - LOG_ERROR: Error Log only errors - LOG_WARNING: Warning Log malicious requests - LOG_INFO: Info Log all requests - LOG_DEBUG: Debug Log debugging data

• manual_js_insert - Optional Block
Insert JavaScript Manually. Insert JavaScript manually
See Manual Js Insert below.

• mobile_sdk_config - Optional Block
Mobile SDK Configuration. Mobile SDK configuration
See Mobile SDK Config below.

• protected_endpoints - Optional Block
List of protected endpoints (max 128 items)
See Protected Endpoints below.

• timeout - Optional Number
The timeout for the inference check, in milliseconds

• trusted_clients - Optional Block
Define your allowlists to skip Bot Defense inference processing
See Trusted Clients below.

Cloudflare Disable Js Insert

A disable_js_insert block (within cloudflare) supports the following:

Cloudflare Disable Mobile SDK

A disable_mobile_sdk block (within cloudflare) supports the following:

Cloudflare Js Insertion Rules

A js_insertion_rules block (within cloudflare) supports the following:

• exclude_list - Optional Block
Optional JavaScript insertions exclude list of domain and path matchers
See Exclude List below.

• javascript_location - Optional String Defaults to JAVA_SCRIPT_LOCATION_UNDEFINED
Possible values are JAVA_SCRIPT_LOCATION_UNDEFINED, AFTER_HEAD, AFTER_TITLE_END, BEFORE_SCRIPT
[Enum: JAVA_SCRIPT_LOCATION_UNDEFINED|AFTER_HEAD|AFTER_TITLE_END|BEFORE_SCRIPT] All inside networks. - JAVA_SCRIPT_LOCATION_UNDEFINED: JAVA_SCRIPT_LOCATION_UNDEFINED Undefined Insert JavaScript after <HEAD> tag Insert JavaScript after </title> tag. Insert JavaScript before first tag

• js_download_path - Optional String
Web client will fetch F5 Client JavaScript from this path. This path must not conflict with any other website/application paths. If not specified, default to ‘/common.js’

• rules - Optional Block
Required list of pages to insert Bot Defense client JavaScript
See Rules below.

Cloudflare Js Insertion Rules Exclude List

An exclude_list block (within cloudflare.js_insertion_rules) supports the following:

• any_domain - Optional Object
Enable this option

• domain - Optional Block
Domain name for routing and identification
See Domain below.

• metadata - Optional Block
MessageMetaType is metadata (common attributes) of a message that only certain messages have. This information is propagated to the metadata of a child object that gets created from the containing message during view processing. The information in this type can be specified by user during create
See Metadata below.

• path - Optional Block
Path match of the URI can be either be, Prefix match or exact match or regular expression match
See Path below.

Cloudflare Js Insertion Rules Exclude List Any Domain

Deeply nested Domain block collapsed for readability.

Cloudflare Js Insertion Rules Exclude List Domain

A domain block (within cloudflare.js_insertion_rules.exclude_list) supports the following:

• exact_value - Optional String
Exact domain name

• regex_value - Optional String
Regular Expression value for the domain name

• suffix_value - Optional String
Suffix of domain name e.g ‘xyz.com’ will match ‘*.xyz.com’ and ‘xyz.com’

Cloudflare Js Insertion Rules Exclude List Metadata

A metadata block (within cloudflare.js_insertion_rules.exclude_list) supports the following:

• description_spec - Optional String
Description. Human readable description

• name - Optional String
Name of the message. The value of name has to follow DNS-1035 format

Cloudflare Js Insertion Rules Exclude List Path

A path block (within cloudflare.js_insertion_rules.exclude_list) supports the following:

• path - Optional String
Exact path value to match

• prefix - Optional String
Path prefix to match (e.g. The value / will match on all paths)

• regex - Optional String
Regular expression of path match (e.g. The value .* will match on all paths)

Cloudflare Js Insertion Rules Rules

A rules block (within cloudflare.js_insertion_rules) supports the following:

• any_domain - Optional Object
Enable this option

• domain - Optional Block
Domain name for routing and identification
See Domain below.

• exact_path - Optional String
Exact path value to match

• glob - Optional String
Accepts wildcards * to match multiple characters or ? To match a single character

• prefix - Optional String
Path prefix to match (e.g. The value / will match on all paths)

Cloudflare Js Insertion Rules Rules Any Domain

An any_domain block (within cloudflare.js_insertion_rules.rules) supports the following:

Cloudflare Js Insertion Rules Rules Domain

A domain block (within cloudflare.js_insertion_rules.rules) supports the following:

• exact_value - Optional String
Exact domain name

• regex_value - Optional String
Regular Expression value for the domain name

• suffix_value - Optional String
Suffix of domain name e.g ‘xyz.com’ will match ‘*.xyz.com’ and ‘xyz.com’

Cloudflare Js Insertion Rules Rules Metadata

A metadata block (within cloudflare.js_insertion_rules.rules) supports the following:

• description_spec - Optional String
Description. Human readable description

• name - Optional String
Name of the message. The value of name has to follow DNS-1035 format

Cloudflare Manual Js Insert

A manual_js_insert block (within cloudflare) supports the following:

Cloudflare Mobile SDK Config

A mobile_sdk_config block (within cloudflare) supports the following:

• mobile_identifier - Optional Block
Mobile Traffic Identifier. Mobile traffic identifier type
See Mobile Identifier below.

Cloudflare Mobile SDK Config Mobile Identifier

A mobile_identifier block (within cloudflare.mobile_sdk_config) supports the following:

• headers - Optional Block
List of headers that can be used to identify mobile traffic
See Headers below.

Cloudflare Mobile SDK Config Mobile Identifier Headers

A headers block (within cloudflare.mobile_sdk_config.mobile_identifier) supports the following:

• exact - Optional String
Header value to match exactly

• name - Optional String
Name. Name of the header

• regex - Optional String
Regex match of the header value in re2 format

Cloudflare Protected Endpoints

A protected_endpoints block (within cloudflare) supports the following:

• any_domain - Optional Object
Enable this option

• domain - Optional Block
Domain name for routing and identification
See Domain below.

• http_methods - Optional List Defaults to METHOD_ANY
Possible values are METHOD_ANY, METHOD_GET, METHOD_POST, METHOD_PUT, METHOD_PATCH, METHOD_DELETE, METHOD_GET_DOCUMENT
[Enum: METHOD_ANY|METHOD_GET|METHOD_POST|METHOD_PUT|METHOD_PATCH|METHOD_DELETE|METHOD_GET_DOCUMENT] HTTP Methods. List of HTTP methods

• mobile_client - Optional Block
Mobile Client. Mobile client configuration OPTIONS
See Mobile Client below.

• path - Optional Block
Path. URI Path
See Path below.

• query - Optional String
Enter a regular expression to match your query parameters of interest

• web_client - Optional Block
Web Client. Web client configuration OPTIONS
See Web Client below.

• web_mobile_client - Optional Block
Web and Mobile client configuration OPTIONS
See Web Mobile Client below.

Cloudflare Protected Endpoints Any Domain

An any_domain block (within cloudflare.protected_endpoints) supports the following:

Cloudflare Protected Endpoints Domain

A domain block (within cloudflare.protected_endpoints) supports the following:

• exact_value - Optional String
Exact domain name

• regex_value - Optional String
Regular Expression value for the domain name

• suffix_value - Optional String
Suffix of domain name e.g ‘xyz.com’ will match ‘*.xyz.com’ and ‘xyz.com’

Cloudflare Protected Endpoints Metadata

A metadata block (within cloudflare.protected_endpoints) supports the following:

• description_spec - Optional String
Description. Human readable description

• name - Optional String
Name of the message. The value of name has to follow DNS-1035 format

Cloudflare Protected Endpoints Mobile Client

A mobile_client block (within cloudflare.protected_endpoints) supports the following:

• block - Optional Block
Block Response for Mobile. Block Response
See Block below.

• continue - Optional Block
Select Continue Bot Mitigation Action. Continue mitigation action
See Continue below.

Cloudflare Protected Endpoints Mobile Client Block

A block block (within cloudflare.protected_endpoints.mobile_client) supports the following:

• body - Optional String
Body. Custom body message

• content_type - Optional String
Content type to use in a block response

Cloudflare Protected Endpoints Mobile Client Continue

A continue block (within cloudflare.protected_endpoints.mobile_client) supports the following:

• add_header - Optional Object
Enable this option

• no_header - Optional Object
Enable this option

Cloudflare Protected Endpoints Mobile Client Continue Add Header

Deeply nested Header block collapsed for readability.

Cloudflare Protected Endpoints Mobile Client Continue No Header

Deeply nested Header block collapsed for readability.

Cloudflare Protected Endpoints Path

A path block (within cloudflare.protected_endpoints) supports the following:

• caseinsensitive - Optional Bool
Should path be searched case insensitive;

• path - Optional String
Path. URI Path

Cloudflare Protected Endpoints Web Client

A web_client block (within cloudflare.protected_endpoints) supports the following:

• block - Optional Block
Block Response. Block Response
See Block below.

• continue - Optional Block
Select Continue Bot Mitigation Action. Continue mitigation action
See Continue below.

• redirect - Optional Block
Redirect. Redirect
See Redirect below.

Cloudflare Protected Endpoints Web Client Block

A block block (within cloudflare.protected_endpoints.web_client) supports the following:

• body - Optional String
Body. Custom body message

• content_type - Optional String
Content type to use in a block response

Cloudflare Protected Endpoints Web Client Continue

A continue block (within cloudflare.protected_endpoints.web_client) supports the following:

• add_header - Optional Object
Enable this option

• no_header - Optional Object
Enable this option

Cloudflare Protected Endpoints Web Client Continue Add Header

Deeply nested Header block collapsed for readability.

Cloudflare Protected Endpoints Web Client Continue No Header

Deeply nested Header block collapsed for readability.

Cloudflare Protected Endpoints Web Client Redirect

A redirect block (within cloudflare.protected_endpoints.web_client) supports the following:

• location - Optional String
Location. URI location for redirect response

Cloudflare Protected Endpoints Web Mobile Client

A web_mobile_client block (within cloudflare.protected_endpoints) supports the following:

• block_mobile - Optional Block
Block Response for Mobile. Block Response
See Block Mobile below.

• block_web - Optional Block
Block Response. Block Response
See Block Web below.

• continue_mobile - Optional Block
Select Continue Bot Mitigation Action. Continue mitigation action
See Continue Mobile below.

• continue_web - Optional Block
Select Continue Bot Mitigation Action. Continue mitigation action
See Continue Web below.

• redirect_web - Optional Block
Redirect. Redirect
See Redirect Web below.

Cloudflare Protected Endpoints Web Mobile Client Block Mobile

Deeply nested Mobile block collapsed for readability.

Cloudflare Protected Endpoints Web Mobile Client Block Web

Deeply nested Web block collapsed for readability.

Cloudflare Protected Endpoints Web Mobile Client Continue Mobile

Deeply nested Mobile block collapsed for readability.

Cloudflare Protected Endpoints Web Mobile Client Continue Mobile Add Header

Deeply nested Header block collapsed for readability.

Cloudflare Protected Endpoints Web Mobile Client Continue Mobile No Header

Deeply nested Header block collapsed for readability.

Cloudflare Protected Endpoints Web Mobile Client Continue Web

Deeply nested Web block collapsed for readability.

Cloudflare Protected Endpoints Web Mobile Client Continue Web Add Header

Deeply nested Header block collapsed for readability.

Cloudflare Protected Endpoints Web Mobile Client Continue Web No Header

Deeply nested Header block collapsed for readability.

Cloudflare Protected Endpoints Web Mobile Client Redirect Web

Deeply nested Web block collapsed for readability.

Cloudflare Trusted Clients

A trusted_clients block (within cloudflare) supports the following:

• http_header - Optional Block
Configuration parameter for HTTP header
See HTTP Header below.

• ip_prefix - Optional String
IP prefix string

Cloudflare Trusted Clients HTTP Header

A http_header block (within cloudflare.trusted_clients) supports the following:

• headers - Optional Block
List of HTTP header name and value pairs
See Headers below.

Cloudflare Trusted Clients HTTP Header Headers

A headers block (within cloudflare.trusted_clients.http_header) supports the following:

• exact - Optional String
Header value to match exactly

• name - Optional String
Name. Name of the header

• regex - Optional String
Regex match of the header value in re2 format

Cloudflare Trusted Clients Metadata

A metadata block (within cloudflare.trusted_clients) supports the following:

• description_spec - Optional String
Description. Human readable description

• name - Optional String
Name of the message. The value of name has to follow DNS-1035 format

Cloudfront

A cloudfront block supports the following:

• aws_configuration_id_selector - Optional Block
Configuration parameter for AWS configuration ID selector
See AWS Configuration ID Selector below.

• aws_configuration_tag_selector - Optional Block
Distribution Tag List. CloudFront distribution tag list
See AWS Configuration Tag Selector below.

• continue_mitigation_action_hdr - Optional String
Case-insensitive HTTP header name for Continue Mitigation Action when add header selected

• data_sample - Optional Number
Limit on amount of request-body data (other than F5 telemetry) to send for analysis (limit 1,048,576 == 1 MiByte)

• disable_aws_configuration - Optional Object
Configuration parameter for disable AWS configuration

• disable_js_insert - Optional Object
Configuration parameter for disable js insert

• disable_mobile_sdk - Optional Object
Enable this option

• js_insertion_rules - Optional Block
Defines custom JavaScript insertion rules for Bot Defense Policy
See Js Insertion Rules below.

• manual_js_insert - Optional Block
Insert JavaScript Manually. Insert JavaScript manually
See Manual Js Insert below.

• mobile_sdk_config - Optional Block
Mobile SDK Configuration. Mobile SDK configuration
See Mobile SDK Config below.

• protected_endpoints - Optional Block
List of protected endpoints (max 128 items)
See Protected Endpoints below.

• timeout - Optional Number
The timeout for the inference check, in milliseconds

• trusted_clients - Optional Block
Define your allowlists to skip Bot Defense inference processing
See Trusted Clients below.

Cloudfront AWS Configuration ID Selector

An aws_configuration_id_selector block (within cloudfront) supports the following:

• ids - Optional List
Add AWS CloudFront distribution ID, e.g. ABCDEFGHI0JKLM

Cloudfront AWS Configuration Tag Selector

An aws_configuration_tag_selector block (within cloudfront) supports the following:

• tags - Optional Map
List contains the Cloudfront distribution selection by tags key is a AWS tag name, and the value is regular expression to match

Cloudfront Disable AWS Configuration

A disable_aws_configuration block (within cloudfront) supports the following:

Cloudfront Disable Js Insert

A disable_js_insert block (within cloudfront) supports the following:

Cloudfront Disable Mobile SDK

A disable_mobile_sdk block (within cloudfront) supports the following:

Cloudfront Js Insertion Rules

A js_insertion_rules block (within cloudfront) supports the following:

• exclude_list - Optional Block
Optional JavaScript insertions exclude list of domain and path matchers
See Exclude List below.

• javascript_mode - Optional String Defaults to ASYNC_JS_NO_CACHING
Possible values are ASYNC_JS_NO_CACHING, ASYNC_JS_CACHING, SYNC_JS_NO_CACHING, SYNC_JS_CACHING
[Enum: ASYNC_JS_NO_CACHING|ASYNC_JS_CACHING|SYNC_JS_NO_CACHING|SYNC_JS_CACHING] Web Client JavaScript Mode. Bot Defense JavaScript for telemetry collection is requested asynchronously, and it is non-cacheable Bot Defense JavaScript for telemetry collection is requested asynchronously, and it is cacheable Bot Defense JavaScript for telemetry collection is requested

• rules - Optional Block
Required list of pages to insert Bot Defense client JavaScript
See Rules below.

Cloudfront Js Insertion Rules Exclude List

An exclude_list block (within cloudfront.js_insertion_rules) supports the following:

• any_domain - Optional Object
Enable this option

• domain - Optional Block
Domain name for routing and identification
See Domain below.

• path - Optional Block
Path match of the URI can be either be, Prefix match or exact match or regular expression match
See Path below.

Cloudfront Js Insertion Rules Exclude List Any Domain

Deeply nested Domain block collapsed for readability.

Cloudfront Js Insertion Rules Exclude List Domain

A domain block (within cloudfront.js_insertion_rules.exclude_list) supports the following:

• exact_value - Optional String
Exact domain name

• regex_value - Optional String
Regular Expression value for the domain name

• suffix_value - Optional String
Suffix of domain name e.g ‘xyz.com’ will match ‘*.xyz.com’ and ‘xyz.com’

Cloudfront Js Insertion Rules Exclude List Metadata

A metadata block (within cloudfront.js_insertion_rules.exclude_list) supports the following:

• description_spec - Optional String
Description. Human readable description

• name - Optional String
Name of the message. The value of name has to follow DNS-1035 format

Cloudfront Js Insertion Rules Exclude List Path

A path block (within cloudfront.js_insertion_rules.exclude_list) supports the following:

• path - Optional String
Exact path value to match

• prefix - Optional String
Path prefix to match (e.g. The value / will match on all paths)

• regex - Optional String
Regular expression of path match (e.g. The value .* will match on all paths)

Cloudfront Js Insertion Rules Rules

A rules block (within cloudfront.js_insertion_rules) supports the following:

• any_domain - Optional Object
Enable this option

• domain - Optional Block
Domain name for routing and identification
See Domain below.

• exact_path - Optional String
Exact path value to match

• glob - Optional String
Accepts wildcards * to match multiple characters or ? To match a single character

• prefix - Optional String
Path prefix to match (e.g. The value / will match on all paths)

Cloudfront Js Insertion Rules Rules Any Domain

An any_domain block (within cloudfront.js_insertion_rules.rules) supports the following:

Cloudfront Js Insertion Rules Rules Domain

A domain block (within cloudfront.js_insertion_rules.rules) supports the following:

• exact_value - Optional String
Exact domain name

• regex_value - Optional String
Regular Expression value for the domain name

• suffix_value - Optional String
Suffix of domain name e.g ‘xyz.com’ will match ‘*.xyz.com’ and ‘xyz.com’

Cloudfront Js Insertion Rules Rules Metadata

A metadata block (within cloudfront.js_insertion_rules.rules) supports the following:

• description_spec - Optional String
Description. Human readable description

• name - Optional String
Name of the message. The value of name has to follow DNS-1035 format

Cloudfront Manual Js Insert

A manual_js_insert block (within cloudfront) supports the following:

Cloudfront Mobile SDK Config

A mobile_sdk_config block (within cloudfront) supports the following:

• mobile_identifier - Optional Block
Mobile Traffic Identifier. Mobile traffic identifier type
See Mobile Identifier below.

Cloudfront Mobile SDK Config Mobile Identifier

A mobile_identifier block (within cloudfront.mobile_sdk_config) supports the following:

• headers - Optional Block
List of headers that can be used to identify mobile traffic
See Headers below.

Cloudfront Mobile SDK Config Mobile Identifier Headers

A headers block (within cloudfront.mobile_sdk_config.mobile_identifier) supports the following:

• exact - Optional String
Header value to match exactly

• name - Optional String
Name. Name of the header

• regex - Optional String
Regex match of the header value in re2 format

Cloudfront Protected Endpoints

A protected_endpoints block (within cloudfront) supports the following:

• any_domain - Optional Object
Enable this option

• domain - Optional Block
Domain name for routing and identification
See Domain below.

• flow_label - Optional Block
Bot Defense Flow Label Category allows to associate traffic with selected category
See Flow Label below.

• mobile_client - Optional Block
Mobile Client. Mobile client configuration OPTIONS
See Mobile Client below.

• path - Optional String
Accepts wildcards * to match multiple characters or ? To match a single character

• query - Optional String
Enter a regular expression to match your query parameters of interest

• undefined_flow_label - Optional Object
Enable this option

• web_client - Optional Block
Web Client. Web client configuration OPTIONS
See Web Client below.

• web_mobile_client - Optional Block
Web and Mobile client configuration OPTIONS
See Web Mobile Client below.

Cloudfront Protected Endpoints Any Domain

An any_domain block (within cloudfront.protected_endpoints) supports the following:

Cloudfront Protected Endpoints Domain

A domain block (within cloudfront.protected_endpoints) supports the following:

• exact_value - Optional String
Exact domain name

• regex_value - Optional String
Regular Expression value for the domain name

• suffix_value - Optional String
Suffix of domain name e.g ‘xyz.com’ will match ‘*.xyz.com’ and ‘xyz.com’

Cloudfront Protected Endpoints Flow Label

A flow_label block (within cloudfront.protected_endpoints) supports the following:

• account_management - Optional Block
Bot Defense Flow Label Account Management Category
See Account Management below.

• authentication - Optional Block
Bot Defense Flow Label Authentication Category
See Authentication below.

• financial_services - Optional Block
Bot Defense Flow Label Financial Services Category
See Financial Services below.

• flight - Optional Block
Bot Defense Flow Label Flight Category. Bot Defense Flow Label Flight Category
See Flight below.

• profile_management - Optional Block
Bot Defense Flow Label Profile Management Category
See Profile Management below.

• search - Optional Block
Bot Defense Flow Label Search Category. Bot Defense Flow Label Search Category
See Search below.

• shopping_gift_cards - Optional Block
Bot Defense Flow Label Shopping & Gift Cards Category
See Shopping Gift Cards below.

Cloudfront Protected Endpoints Flow Label Account Management

An account_management block (within cloudfront.protected_endpoints.flow_label) supports the following:

• create - Optional Object
Enable this option

• password_reset - Optional Object
Configuration parameter for password reset

Cloudfront Protected Endpoints Flow Label Account Management Create

Deeply nested Create block collapsed for readability.

Cloudfront Protected Endpoints Flow Label Account Management Password Reset

Deeply nested Reset block collapsed for readability.

Cloudfront Protected Endpoints Flow Label Authentication

An authentication block (within cloudfront.protected_endpoints.flow_label) supports the following:

• login - Optional Block
Bot Defense Transaction Result. Bot Defense Transaction Result
See Login below.

• login_mfa - Optional Object
Enable this option

• login_partner - Optional Object
Configuration parameter for login partner

• logout - Optional Object
Enable this option

• token_refresh - Optional Object
Configuration parameter for token refresh

A login block (within cloudfront.protected_endpoints.flow_label.authentication) supports the following:

• disable_transaction_result - Optional Object
Enable this option

• transaction_result - Optional Block
Bot Defense Transaction Result Type. Bot Defense Transaction ResultType
See Transaction Result below.

Deeply nested Result block collapsed for readability.

Deeply nested Conditions block collapsed for readability.

Deeply nested MFA block collapsed for readability.

Deeply nested Partner block collapsed for readability.

Cloudfront Protected Endpoints Flow Label Authentication Logout

A logout block (within cloudfront.protected_endpoints.flow_label.authentication) supports the following:

Cloudfront Protected Endpoints Flow Label Authentication Token Refresh

Deeply nested Refresh block collapsed for readability.

Cloudfront Protected Endpoints Flow Label Financial Services

A financial_services block (within cloudfront.protected_endpoints.flow_label) supports the following:

• apply - Optional Object
Enable this option

• money_transfer - Optional Object
Configuration parameter for money transfer

Cloudfront Protected Endpoints Flow Label Financial Services Apply

Deeply nested Apply block collapsed for readability.

Cloudfront Protected Endpoints Flow Label Financial Services Money Transfer

Deeply nested Transfer block collapsed for readability.

Cloudfront Protected Endpoints Flow Label Flight

A flight block (within cloudfront.protected_endpoints.flow_label) supports the following:

• checkin - Optional Block
Enable this option

Cloudfront Protected Endpoints Flow Label Profile Management

A profile_management block (within cloudfront.protected_endpoints.flow_label) supports the following:

• create - Optional Object
Enable this option

• update - Optional Object
Enable this option

• view - Optional Object
Enable this option

Cloudfront Protected Endpoints Flow Label Profile Management Create

Deeply nested Create block collapsed for readability.

Cloudfront Protected Endpoints Flow Label Profile Management Update

Deeply nested Update block collapsed for readability.

Cloudfront Protected Endpoints Flow Label Profile Management View

Deeply nested View block collapsed for readability.

Cloudfront Protected Endpoints Flow Label Search

A search block (within cloudfront.protected_endpoints.flow_label) supports the following:

• flight_search - Optional Object
Configuration parameter for flight search

• product_search - Optional Object
Configuration parameter for product search

• reservation_search - Optional Object
Configuration parameter for reservation search

• room_search - Optional Object
Configuration parameter for room search

Cloudfront Protected Endpoints Flow Label Search Flight Search

Deeply nested Search block collapsed for readability.

Cloudfront Protected Endpoints Flow Label Search Product Search

Deeply nested Search block collapsed for readability.

Cloudfront Protected Endpoints Flow Label Search Reservation Search

Deeply nested Search block collapsed for readability.

Cloudfront Protected Endpoints Flow Label Search Room Search

Deeply nested Search block collapsed for readability.

Cloudfront Protected Endpoints Flow Label Shopping Gift Cards

Deeply nested Cards block collapsed for readability.

Cloudfront Protected Endpoints Flow Label Shopping Gift Cards Gift Card Make Purchase With Gift Card

Deeply nested Card block collapsed for readability.

Cloudfront Protected Endpoints Flow Label Shopping Gift Cards Gift Card Validation

Deeply nested Validation block collapsed for readability.

Cloudfront Protected Endpoints Flow Label Shopping Gift Cards Shop Add To Cart

Deeply nested Cart block collapsed for readability.

Cloudfront Protected Endpoints Flow Label Shopping Gift Cards Shop Checkout

Deeply nested Checkout block collapsed for readability.

Cloudfront Protected Endpoints Flow Label Shopping Gift Cards Shop Choose Seat

Deeply nested Seat block collapsed for readability.

Cloudfront Protected Endpoints Flow Label Shopping Gift Cards Shop Enter Drawing Submission

Deeply nested Submission block collapsed for readability.

Cloudfront Protected Endpoints Flow Label Shopping Gift Cards Shop Make Payment

Deeply nested Payment block collapsed for readability.

Cloudfront Protected Endpoints Flow Label Shopping Gift Cards Shop Order

Deeply nested Order block collapsed for readability.

Cloudfront Protected Endpoints Flow Label Shopping Gift Cards Shop Price Inquiry

Deeply nested Inquiry block collapsed for readability.

Deeply nested Validation block collapsed for readability.

Cloudfront Protected Endpoints Flow Label Shopping Gift Cards Shop Purchase Gift Card

Deeply nested Card block collapsed for readability.

Cloudfront Protected Endpoints Flow Label Shopping Gift Cards Shop Update Quantity

Deeply nested Quantity block collapsed for readability.

Cloudfront Protected Endpoints Metadata

A metadata block (within cloudfront.protected_endpoints) supports the following:

• description_spec - Optional String
Description. Human readable description

• name - Optional String
Name of the message. The value of name has to follow DNS-1035 format

Cloudfront Protected Endpoints Mobile Client

A mobile_client block (within cloudfront.protected_endpoints) supports the following:

• block - Optional Block
Block Response for Mobile. Block Response
See Block below.

• continue - Optional Block
Select Continue Bot Mitigation Action. Continue mitigation action
See Continue below.

Cloudfront Protected Endpoints Mobile Client Block

A block block (within cloudfront.protected_endpoints.mobile_client) supports the following:

• body - Optional String
Body. Custom body message

• content_type - Optional String
Content type to use in a block response

Cloudfront Protected Endpoints Mobile Client Continue

A continue block (within cloudfront.protected_endpoints.mobile_client) supports the following:

• add_header - Optional Object
Enable this option

• no_header - Optional Object
Enable this option

Cloudfront Protected Endpoints Mobile Client Continue Add Header

Deeply nested Header block collapsed for readability.

Cloudfront Protected Endpoints Mobile Client Continue No Header

Deeply nested Header block collapsed for readability.

Cloudfront Protected Endpoints Undefined Flow Label

An undefined_flow_label block (within cloudfront.protected_endpoints) supports the following:

Cloudfront Protected Endpoints Web Client

A web_client block (within cloudfront.protected_endpoints) supports the following:

• block - Optional Block
Block Response. Block Response
See Block below.

• continue - Optional Block
Select Continue Bot Mitigation Action. Continue mitigation action
See Continue below.

• redirect - Optional Block
Redirect. Redirect
See Redirect below.

Cloudfront Protected Endpoints Web Client Block

A block block (within cloudfront.protected_endpoints.web_client) supports the following:

• body - Optional String
Body. Custom body message

• content_type - Optional String
Content type to use in a block response

Cloudfront Protected Endpoints Web Client Continue

A continue block (within cloudfront.protected_endpoints.web_client) supports the following:

• add_header - Optional Object
Enable this option

• no_header - Optional Object
Enable this option

Cloudfront Protected Endpoints Web Client Continue Add Header

Deeply nested Header block collapsed for readability.

Cloudfront Protected Endpoints Web Client Continue No Header

Deeply nested Header block collapsed for readability.

Cloudfront Protected Endpoints Web Client Redirect

A redirect block (within cloudfront.protected_endpoints.web_client) supports the following:

• location - Optional String
Location. URI location for redirect response

Cloudfront Protected Endpoints Web Mobile Client

A web_mobile_client block (within cloudfront.protected_endpoints) supports the following:

• block_mobile - Optional Block
Block Response for Mobile. Block Response
See Block Mobile below.

• block_web - Optional Block
Block Response. Block Response
See Block Web below.

• continue_mobile - Optional Block
Select Continue Bot Mitigation Action. Continue mitigation action
See Continue Mobile below.

• continue_web - Optional Block
Select Continue Bot Mitigation Action. Continue mitigation action
See Continue Web below.

• redirect_web - Optional Block
Redirect. Redirect
See Redirect Web below.

Cloudfront Protected Endpoints Web Mobile Client Block Mobile

Deeply nested Mobile block collapsed for readability.

Cloudfront Protected Endpoints Web Mobile Client Block Web

Deeply nested Web block collapsed for readability.

Cloudfront Protected Endpoints Web Mobile Client Continue Mobile

Deeply nested Mobile block collapsed for readability.

Cloudfront Protected Endpoints Web Mobile Client Continue Mobile Add Header

Deeply nested Header block collapsed for readability.

Cloudfront Protected Endpoints Web Mobile Client Continue Mobile No Header

Deeply nested Header block collapsed for readability.

Cloudfront Protected Endpoints Web Mobile Client Continue Web

Deeply nested Web block collapsed for readability.

Cloudfront Protected Endpoints Web Mobile Client Continue Web Add Header

Deeply nested Header block collapsed for readability.

Cloudfront Protected Endpoints Web Mobile Client Continue Web No Header

Deeply nested Header block collapsed for readability.

Cloudfront Protected Endpoints Web Mobile Client Redirect Web

Deeply nested Web block collapsed for readability.

Cloudfront Trusted Clients

A trusted_clients block (within cloudfront) supports the following:

• http_header - Optional Block
Configuration parameter for HTTP header
See HTTP Header below.

• ip_prefix - Optional String
IP prefix string

Cloudfront Trusted Clients HTTP Header

A http_header block (within cloudfront.trusted_clients) supports the following:

• headers - Optional Block
List of HTTP header name and value pairs
See Headers below.

Cloudfront Trusted Clients HTTP Header Headers

A headers block (within cloudfront.trusted_clients.http_header) supports the following:

• exact - Optional String
Header value to match exactly

• name - Optional String
Name. Name of the header

• regex - Optional String
Regex match of the header value in re2 format

Cloudfront Trusted Clients Metadata

A metadata block (within cloudfront.trusted_clients) supports the following:

• description_spec - Optional String
Description. Human readable description

• name - Optional String
Name of the message. The value of name has to follow DNS-1035 format

Custom Connector

A custom_connector block supports the following:

F5 Big IP

A f5_big_ip block supports the following:

Salesforce Commerce Connector

A salesforce_commerce_connector block supports the following:

Timeouts

A timeouts block supports the following:

• create - Optional String (Defaults to 10 minutes)
Used when creating the resource

• delete - Optional String (Defaults to 10 minutes)
Used when deleting the resource

• read - Optional String (Defaults to 5 minutes)
Used when retrieving the resource

• update - Optional String (Defaults to 10 minutes)
Used when updating the resource

Common Types

The following type definitions are used throughout this resource. See the full definition here rather than repeated inline.

Object Reference {#common-object-reference}

Object references establish a direct reference from one configuration object to another in F5 Distributed Cloud. References use the format tenant/namespace/name.

Field	Type	Description
`name`	String	Name of the referenced object
`namespace`	String	Namespace containing the referenced object
`tenant`	String	Tenant of the referenced object (system-managed)

Transformers {#common-transformers}

Transformers apply transformations to input values before matching. Multiple transformers can be applied in order.

Value	Description
`LOWER_CASE`	Convert to lowercase
`UPPER_CASE`	Convert to uppercase
`BASE64_DECODE`	Decodebase64 content
`NORMALIZE_PATH`	Normalize URL path
`REMOVE_WHITESPACE`	Remove whitespace characters
`URL_DECODE`	Decode URL-encoded characters
`TRIM_LEFT`	Trim leading whitespace
`TRIM_RIGHT`	Trim trailing whitespace
`TRIM`	Trim both leading and trailing whitespace

HTTP Methods {#common-http-methods}

HTTP methods used for request matching.

Value	Description
`ANY`	Match any HTTP method
`GET`	HTTP GET request
`HEAD`	HTTP HEAD request
`POST`	HTTP POST request
`PUT`	HTTP PUT request
`DELETE`	HTTP DELETE request
`CONNECT`	HTTP CONNECT request
`OPTIONS`	HTTP OPTIONS request
`TRACE`	HTTP TRACE request
`PATCH`	HTTP PATCH request
`COPY`	HTTP COPY request (WebDAV)

TLS Fingerprints {#common-tls-fingerprints}

TLS fingerprint categories for malicious client detection.

Value	Description
`TLS_FINGERPRINT_NONE`	No fingerprint matching
`ANY_MALICIOUS_FINGERPRINT`	Match any known malicious fingerprint
`ADWARE`	Adware-associated fingerprints
`DRIDEX`	Dridex malware fingerprints
`GOOTKIT`	Gootkit malware fingerprints
`RANSOMWARE`	Ransomware-associated fingerprints
`TRICKBOT`	Trickbot malware fingerprints

IP Threat Categories {#common-ip-threat-categories}

IP address threat categories for security filtering.

Value	Description
`SPAM_SOURCES`	Known spam sources
`WINDOWS_EXPLOITS`	Windows exploit sources
`WEB_ATTACKS`	Web attack sources
`BOTNETS`	Known botnet IPs
`SCANNERS`	Network scanner IPs
`REPUTATION`	Poor reputation IPs
`PHISHING`	Phishing-related IPs
`PROXY`	Anonymous proxy IPs
`MOBILE_THREATS`	Mobile threat sources
`TOR_PROXY`	Tor exit nodes
`DENIAL_OF_SERVICE`	DoS attack sources
`NETWORK`	Known bad network ranges

Import

Import is supported using the following syntax:

# Import using namespace/name format
terraform import xcsh_protected_application.example system/example