xcsh_protected_application (Resource)

Manages applications protected by Bot Defense. in F5 Distributed Cloud.

~> Note For more information about this resource, please refer to the F5 XC API Documentation.

Example Usage

# ProtectedApplication Resource Example
# Manages applications protected by Bot Defense.

terraform {
  required_version = ">= 1.0"

  required_providers {
    xcsh = {
      source  = "f5-sales-demo/xcsh"
      version = ">= 0.1.0"
    }
  }
}

# Basic ProtectedApplication configuration
resource "xcsh_protected_application" "example" {
  name      = "example-protected-application"
  namespace = "staging"

  region = "US"
}

Argument Reference

-> Syntax Rule: This provider uses OneOf groups for mutually exclusive options. Fields documented as “Optional Block” use empty block syntax field_name {}, never field_name = true. Boolean attributes (like add_hsts, http_redirect) use = true/false as normal.

🔶 High Risk Operations — Some operations on this resource have high danger level. Destructive operations may require confirmation.

Metadata Argument Reference

• name - Required String
Name of the Protected Application. Must be unique within the namespace

• namespace - Required String
Namespace where the Protected Application will be created

• annotations - Optional Map
Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata

• description - Optional String
Human readable description for the object

• disable - Optional Bool
A value of true will administratively disable the object

• labels - Optional Map
Labels is a user defined key value map that can be attached to resources for organization and filtering

Spec Argument Reference

-> One of the following: • adobe_commerce_connector - Optional Block
Configuration parameter for adobe commerce connector

• big_ip_iapp - Optional Block
Enable this option

• cloudflare - Optional Block
Bot Defense policy configuration for Cloudflare
See Cloudflare below for details.

• cloudfront - Optional Block
Bot Defense policy configuration for AWS Cloudfront
See Cloudfront below for details.

• custom_connector - Optional Block
Configuration parameter for custom connector

• f5_big_ip - Optional Block
Enable this option

• salesforce_commerce_connector - Optional Block
Configuration parameter for salesforce commerce connector

• region - Required String Defaults to US
Possible values are US, EU, ASIA, CA
[Enum: US|EU|ASIA|CA] Defines a selection for Bot Defense region - US: US United States of America - EU: EU European Union - ASIA: ASIA Asia - CA: CA Canada

• timeouts - Optional Block

Attributes Reference

In addition to all arguments above, the following attributes are exported:

• id - Optional String
Unique identifier for the resource

Cloudflare

A cloudflare block supports the following:

• continue_mitigation_action_hdr - Optional String
Case-insensitive HTTP header name for Continue Mitigation Action when add header selected

• disable_js_insert - Optional Block
Configuration parameter for disable js insert

• disable_mobile_sdk - Optional Block
Enable this option

• js_insertion_rules - Optional Block
Defines custom JavaScript insertion rules for Bot Defense Policy
See Js Insertion Rules below.

• loglevel - Optional String Defaults to LOG_UNDEFINED
Possible values are LOG_UNDEFINED, LOG_ERROR, LOG_WARNING, LOG_INFO, LOG_DEBUG
[Enum: LOG_UNDEFINED|LOG_ERROR|LOG_WARNING|LOG_INFO|LOG_DEBUG] Select the level of logging desired. Levels are cumulative (e.g. Debug includes Error, Warning, and Informational) - LOG_UNDEFINED: Undefined - LOG_ERROR: Error Log only errors - LOG_WARNING: Warning Log malicious requests - LOG_INFO: Info Log all requests - LOG_DEBUG: Debug Log debugging data

• manual_js_insert - Optional Block
Insert JavaScript Manually. Insert JavaScript manually
See Manual Js Insert below.

• mobile_sdk_config - Optional Block
Mobile SDK Configuration. Mobile SDK configuration
See Mobile SDK Config below.

• protected_endpoints - Optional Block
List of protected endpoints (max 128 items)
See Protected Endpoints below.

• timeout - Optional Number
The timeout for the inference check, in milliseconds

• trusted_clients - Optional Block
Define your allowlists to skip Bot Defense inference processing
See Trusted Clients below.

Cloudflare Js Insertion Rules

A js_insertion_rules block (within cloudflare) supports the following:

• exclude_list - Optional Block
Optional JavaScript insertions exclude list of domain and path matchers
See Exclude List below.

• javascript_location - Optional String Defaults to JAVA_SCRIPT_LOCATION_UNDEFINED
Possible values are JAVA_SCRIPT_LOCATION_UNDEFINED, AFTER_HEAD, AFTER_TITLE_END, BEFORE_SCRIPT
[Enum: JAVA_SCRIPT_LOCATION_UNDEFINED|AFTER_HEAD|AFTER_TITLE_END|BEFORE_SCRIPT] All inside networks. - JAVA_SCRIPT_LOCATION_UNDEFINED: JAVA_SCRIPT_LOCATION_UNDEFINED Undefined Insert JavaScript after <HEAD> tag Insert JavaScript after </title> tag. Insert JavaScript before first tag

• js_download_path - Optional String
Web client will fetch F5 Client JavaScript from this path. This path must not conflict with any other website/application paths. If not specified, default to ‘/common.js’

• rules - Optional Block
Required list of pages to insert Bot Defense client JavaScript
See Rules below.

Cloudflare Js Insertion Rules Exclude List

An exclude_list block (within cloudflare.js_insertion_rules) supports the following:

• any_domain - Optional Block
Enable this option

• domain - Optional Block
Domain name for routing and identification
See Domain below.

• metadata - Optional Block
MessageMetaType is metadata (common attributes) of a message that only certain messages have. This information is propagated to the metadata of a child object that gets created from the containing message during view processing. The information in this type can be specified by user during create
See Metadata below.

• path - Optional Block
Path match of the URI can be either be, Prefix match or exact match or regular expression match
See Path below.

Cloudflare Js Insertion Rules Exclude List Domain

A domain block (within cloudflare.js_insertion_rules.exclude_list) supports the following:

• exact_value - Optional String
Exact domain name

• regex_value - Optional String
Regular Expression value for the domain name

• suffix_value - Optional String
Suffix of domain name e.g ‘xyz.com’ will match ‘*.xyz.com’ and ‘xyz.com’

Cloudflare Js Insertion Rules Exclude List Metadata

A metadata block (within cloudflare.js_insertion_rules.exclude_list) supports the following:

• description_spec - Optional String
Description. Human readable description

• name - Optional String
Name of the message. The value of name has to follow DNS-1035 format

Cloudflare Js Insertion Rules Exclude List Path

A path block (within cloudflare.js_insertion_rules.exclude_list) supports the following:

• path - Optional String
Exact path value to match

• prefix - Optional String
Path prefix to match (e.g. The value / will match on all paths)

• regex - Optional String
Regular expression of path match (e.g. The value .* will match on all paths)

Cloudflare Js Insertion Rules Rules

A rules block (within cloudflare.js_insertion_rules) supports the following:

• any_domain - Optional Block
Enable this option

• domain - Optional Block
Domain name for routing and identification
See Domain below.

• exact_path - Optional String
Exact path value to match

• glob - Optional String
Accepts wildcards * to match multiple characters or ? To match a single character

• prefix - Optional String
Path prefix to match (e.g. The value / will match on all paths)

Cloudflare Js Insertion Rules Rules Domain

A domain block (within cloudflare.js_insertion_rules.rules) supports the following:

• exact_value - Optional String
Exact domain name

• regex_value - Optional String
Regular Expression value for the domain name

• suffix_value - Optional String
Suffix of domain name e.g ‘xyz.com’ will match ‘*.xyz.com’ and ‘xyz.com’

Cloudflare Js Insertion Rules Rules Metadata

A metadata block (within cloudflare.js_insertion_rules.rules) supports the following:

• description_spec - Optional String
Description. Human readable description

• name - Optional String
Name of the message. The value of name has to follow DNS-1035 format

Cloudflare Manual Js Insert

A manual_js_insert block (within cloudflare) supports the following:

Cloudflare Mobile SDK Config

A mobile_sdk_config block (within cloudflare) supports the following:

• mobile_identifier - Optional Block
Mobile Traffic Identifier. Mobile traffic identifier type
See Mobile Identifier below.

Cloudflare Mobile SDK Config Mobile Identifier

A mobile_identifier block (within cloudflare.mobile_sdk_config) supports the following:

• headers - Optional Block
List of headers that can be used to identify mobile traffic
See Headers below.

Cloudflare Mobile SDK Config Mobile Identifier Headers

A headers block (within cloudflare.mobile_sdk_config.mobile_identifier) supports the following:

• exact - Optional String
Header value to match exactly

• name - Optional String
Name. Name of the header

• regex - Optional String
Regex match of the header value in re2 format

Cloudflare Protected Endpoints

A protected_endpoints block (within cloudflare) supports the following:

• any_domain - Optional Block
Enable this option

• domain - Optional Block
Domain name for routing and identification
See Domain below.

• http_methods - Optional List Defaults to METHOD_ANY
Possible values are METHOD_ANY, METHOD_GET, METHOD_POST, METHOD_PUT, METHOD_PATCH, METHOD_DELETE, METHOD_GET_DOCUMENT
[Enum: METHOD_ANY|METHOD_GET|METHOD_POST|METHOD_PUT|METHOD_PATCH|METHOD_DELETE|METHOD_GET_DOCUMENT] HTTP Methods. List of HTTP methods

• mobile_client - Optional Block
Mobile Client. Mobile client configuration OPTIONS
See Mobile Client below.

• path - Optional Block
Path. URI Path
See Path below.

• query - Optional String
Enter a regular expression to match your query parameters of interest

• web_client - Optional Block
Web Client. Web client configuration OPTIONS
See Web Client below.

• web_mobile_client - Optional Block
Web and Mobile client configuration OPTIONS
See Web Mobile Client below.

Cloudflare Protected Endpoints Domain

A domain block (within cloudflare.protected_endpoints) supports the following:

• exact_value - Optional String
Exact domain name

• regex_value - Optional String
Regular Expression value for the domain name

• suffix_value - Optional String
Suffix of domain name e.g ‘xyz.com’ will match ‘*.xyz.com’ and ‘xyz.com’

Cloudflare Protected Endpoints Metadata

A metadata block (within cloudflare.protected_endpoints) supports the following:

• description_spec - Optional String
Description. Human readable description

• name - Optional String
Name of the message. The value of name has to follow DNS-1035 format

Cloudflare Protected Endpoints Mobile Client

A mobile_client block (within cloudflare.protected_endpoints) supports the following:

• block - Optional Block
Block Response for Mobile. Block Response
See Block below.

• continue - Optional Block
Select Continue Bot Mitigation Action. Continue mitigation action
See Continue below.

Cloudflare Protected Endpoints Mobile Client Block

A block block (within cloudflare.protected_endpoints.mobile_client) supports the following:

• body - Optional String
Body. Custom body message

• content_type - Optional String
Content type to use in a block response

Cloudflare Protected Endpoints Mobile Client Continue

A continue block (within cloudflare.protected_endpoints.mobile_client) supports the following:

• add_header - Optional Block
Enable this option

• no_header - Optional Block
Enable this option

Cloudflare Protected Endpoints Path

A path block (within cloudflare.protected_endpoints) supports the following:

• caseinsensitive - Optional Bool
Should path be searched case insensitive;

• path - Optional String
Path. URI Path

Cloudflare Protected Endpoints Web Client

A web_client block (within cloudflare.protected_endpoints) supports the following:

• block - Optional Block
Block Response. Block Response
See Block below.

• continue - Optional Block
Select Continue Bot Mitigation Action. Continue mitigation action
See Continue below.

• redirect - Optional Block
Redirect. Redirect
See Redirect below.

Cloudflare Protected Endpoints Web Client Block

A block block (within cloudflare.protected_endpoints.web_client) supports the following:

• body - Optional String
Body. Custom body message

• content_type - Optional String
Content type to use in a block response

Cloudflare Protected Endpoints Web Client Continue

A continue block (within cloudflare.protected_endpoints.web_client) supports the following:

• add_header - Optional Block
Enable this option

• no_header - Optional Block
Enable this option

Cloudflare Protected Endpoints Web Client Redirect

A redirect block (within cloudflare.protected_endpoints.web_client) supports the following:

• location - Optional String
URI location for redirect response

Cloudflare Protected Endpoints Web Mobile Client

A web_mobile_client block (within cloudflare.protected_endpoints) supports the following:

• block_mobile - Optional Block
Block Response for Mobile. Block Response
See Block Mobile below.

• block_web - Optional Block
Block Response. Block Response
See Block Web below.

• continue_mobile - Optional Block
Select Continue Bot Mitigation Action. Continue mitigation action
See Continue Mobile below.

• continue_web - Optional Block
Select Continue Bot Mitigation Action. Continue mitigation action
See Continue Web below.

• redirect_web - Optional Block
Redirect. Redirect
See Redirect Web below.

Cloudflare Protected Endpoints Web Mobile Client Block Mobile

Deeply nested Mobile block collapsed for readability.

Cloudflare Protected Endpoints Web Mobile Client Block Web

Deeply nested Web block collapsed for readability.

Cloudflare Protected Endpoints Web Mobile Client Continue Mobile

Deeply nested Mobile block collapsed for readability.

Cloudflare Protected Endpoints Web Mobile Client Continue Web

Deeply nested Web block collapsed for readability.

Cloudflare Protected Endpoints Web Mobile Client Redirect Web

Deeply nested Web block collapsed for readability.

Cloudflare Trusted Clients

A trusted_clients block (within cloudflare) supports the following:

• http_header - Optional Block
Configuration parameter for HTTP header
See HTTP Header below.

• ip_prefix - Optional String
IP prefix string

Cloudflare Trusted Clients HTTP Header

A http_header block (within cloudflare.trusted_clients) supports the following:

• headers - Optional Block
List of HTTP header name and value pairs
See Headers below.

Cloudflare Trusted Clients HTTP Header Headers

A headers block (within cloudflare.trusted_clients.http_header) supports the following:

• exact - Optional String
Header value to match exactly

• name - Optional String
Name. Name of the header

• regex - Optional String
Regex match of the header value in re2 format

Cloudflare Trusted Clients Metadata

A metadata block (within cloudflare.trusted_clients) supports the following:

• description_spec - Optional String
Description. Human readable description

• name - Optional String
Name of the message. The value of name has to follow DNS-1035 format

Cloudfront

A cloudfront block supports the following:

• aws_configuration_id_selector - Optional Block
Configuration parameter for AWS configuration ID selector
See AWS Configuration ID Selector below.

• aws_configuration_tag_selector - Optional Block
Distribution Tag List. CloudFront distribution tag list
See AWS Configuration Tag Selector below.

• continue_mitigation_action_hdr - Optional String
Case-insensitive HTTP header name for Continue Mitigation Action when add header selected

• data_sample - Optional Number
Limit on amount of request-body data (other than F5 telemetry) to send for analysis (limit 1,048,576 == 1 MiByte)

• disable_aws_configuration - Optional Block
Configuration parameter for disable AWS configuration

• disable_js_insert - Optional Block
Configuration parameter for disable js insert

• disable_mobile_sdk - Optional Block
Enable this option

• js_insertion_rules - Optional Block
Defines custom JavaScript insertion rules for Bot Defense Policy
See Js Insertion Rules below.

• manual_js_insert - Optional Block
Insert JavaScript Manually. Insert JavaScript manually
See Manual Js Insert below.

• mobile_sdk_config - Optional Block
Mobile SDK Configuration. Mobile SDK configuration
See Mobile SDK Config below.

• protected_endpoints - Optional Block
List of protected endpoints (max 128 items)
See Protected Endpoints below.

• timeout - Optional Number
The timeout for the inference check, in milliseconds

• trusted_clients - Optional Block
Define your allowlists to skip Bot Defense inference processing
See Trusted Clients below.

Cloudfront AWS Configuration ID Selector

An aws_configuration_id_selector block (within cloudfront) supports the following:

• ids - Optional List
Add AWS CloudFront distribution ID, e.g. ABCDEFGHI0JKLM

Cloudfront AWS Configuration Tag Selector

An aws_configuration_tag_selector block (within cloudfront) supports the following:

• tags - Optional Map
List contains the Cloudfront distribution selection by tags key is a AWS tag name, and the value is regular expression to match

Cloudfront Js Insertion Rules

A js_insertion_rules block (within cloudfront) supports the following:

• exclude_list - Optional Block
Optional JavaScript insertions exclude list of domain and path matchers
See Exclude List below.

• javascript_mode - Optional String Defaults to ASYNC_JS_NO_CACHING
Possible values are ASYNC_JS_NO_CACHING, ASYNC_JS_CACHING, SYNC_JS_NO_CACHING, SYNC_JS_CACHING
[Enum: ASYNC_JS_NO_CACHING|ASYNC_JS_CACHING|SYNC_JS_NO_CACHING|SYNC_JS_CACHING] Web Client JavaScript Mode. Bot Defense JavaScript for telemetry collection is requested asynchronously, and it is non-cacheable Bot Defense JavaScript for telemetry collection is requested asynchronously, and it is cacheable Bot Defense JavaScript for telemetry collection is requested

• rules - Optional Block
Required list of pages to insert Bot Defense client JavaScript
See Rules below.

Cloudfront Js Insertion Rules Exclude List

An exclude_list block (within cloudfront.js_insertion_rules) supports the following:

• any_domain - Optional Block
Enable this option

• domain - Optional Block
Domain name for routing and identification
See Domain below.

• path - Optional Block
Path match of the URI can be either be, Prefix match or exact match or regular expression match
See Path below.

Cloudfront Js Insertion Rules Exclude List Domain

A domain block (within cloudfront.js_insertion_rules.exclude_list) supports the following:

• exact_value - Optional String
Exact domain name

• regex_value - Optional String
Regular Expression value for the domain name

• suffix_value - Optional String
Suffix of domain name e.g ‘xyz.com’ will match ‘*.xyz.com’ and ‘xyz.com’

Cloudfront Js Insertion Rules Exclude List Metadata

A metadata block (within cloudfront.js_insertion_rules.exclude_list) supports the following:

• description_spec - Optional String
Description. Human readable description

• name - Optional String
Name of the message. The value of name has to follow DNS-1035 format

Cloudfront Js Insertion Rules Exclude List Path

A path block (within cloudfront.js_insertion_rules.exclude_list) supports the following:

• path - Optional String
Exact path value to match

• prefix - Optional String
Path prefix to match (e.g. The value / will match on all paths)

• regex - Optional String
Regular expression of path match (e.g. The value .* will match on all paths)

Cloudfront Js Insertion Rules Rules

A rules block (within cloudfront.js_insertion_rules) supports the following:

• any_domain - Optional Block
Enable this option

• domain - Optional Block
Domain name for routing and identification
See Domain below.

• exact_path - Optional String
Exact path value to match

• glob - Optional String
Accepts wildcards * to match multiple characters or ? To match a single character

• prefix - Optional String
Path prefix to match (e.g. The value / will match on all paths)

Cloudfront Js Insertion Rules Rules Domain

A domain block (within cloudfront.js_insertion_rules.rules) supports the following:

• exact_value - Optional String
Exact domain name

• regex_value - Optional String
Regular Expression value for the domain name

• suffix_value - Optional String
Suffix of domain name e.g ‘xyz.com’ will match ‘*.xyz.com’ and ‘xyz.com’

Cloudfront Js Insertion Rules Rules Metadata

A metadata block (within cloudfront.js_insertion_rules.rules) supports the following:

• description_spec - Optional String
Description. Human readable description

• name - Optional String
Name of the message. The value of name has to follow DNS-1035 format

Cloudfront Manual Js Insert

A manual_js_insert block (within cloudfront) supports the following:

Cloudfront Mobile SDK Config

A mobile_sdk_config block (within cloudfront) supports the following:

• mobile_identifier - Optional Block
Mobile Traffic Identifier. Mobile traffic identifier type
See Mobile Identifier below.

Cloudfront Mobile SDK Config Mobile Identifier

A mobile_identifier block (within cloudfront.mobile_sdk_config) supports the following:

• headers - Optional Block
List of headers that can be used to identify mobile traffic
See Headers below.

Cloudfront Mobile SDK Config Mobile Identifier Headers

A headers block (within cloudfront.mobile_sdk_config.mobile_identifier) supports the following:

• exact - Optional String
Header value to match exactly

• name - Optional String
Name. Name of the header

• regex - Optional String
Regex match of the header value in re2 format

Cloudfront Protected Endpoints

A protected_endpoints block (within cloudfront) supports the following:

• any_domain - Optional Block
Enable this option

• domain - Optional Block
Domain name for routing and identification
See Domain below.

• flow_label - Optional Block
Bot Defense Flow Label Category allows to associate traffic with selected category
See Flow Label below.

• mobile_client - Optional Block
Mobile Client. Mobile client configuration OPTIONS
See Mobile Client below.

• path - Optional String
Accepts wildcards * to match multiple characters or ? To match a single character

• query - Optional String
Enter a regular expression to match your query parameters of interest

• undefined_flow_label - Optional Block
Enable this option

• web_client - Optional Block
Web Client. Web client configuration OPTIONS
See Web Client below.

• web_mobile_client - Optional Block
Web and Mobile client configuration OPTIONS
See Web Mobile Client below.

Cloudfront Protected Endpoints Domain

A domain block (within cloudfront.protected_endpoints) supports the following:

• exact_value - Optional String
Exact domain name

• regex_value - Optional String
Regular Expression value for the domain name

• suffix_value - Optional String
Suffix of domain name e.g ‘xyz.com’ will match ‘*.xyz.com’ and ‘xyz.com’

Cloudfront Protected Endpoints Flow Label

A flow_label block (within cloudfront.protected_endpoints) supports the following:

• account_management - Optional Block
Bot Defense Flow Label Account Management Category
See Account Management below.

• authentication - Optional Block
Bot Defense Flow Label Authentication Category
See Authentication below.

• financial_services - Optional Block
Bot Defense Flow Label Financial Services Category
See Financial Services below.

• flight - Optional Block
Bot Defense Flow Label Flight Category. Bot Defense Flow Label Flight Category
See Flight below.

• profile_management - Optional Block
Bot Defense Flow Label Profile Management Category
See Profile Management below.

• search - Optional Block
Bot Defense Flow Label Search Category. Bot Defense Flow Label Search Category
See Search below.

• shopping_gift_cards - Optional Block
Bot Defense Flow Label Shopping & Gift Cards Category
See Shopping Gift Cards below.

Cloudfront Protected Endpoints Flow Label Account Management

An account_management block (within cloudfront.protected_endpoints.flow_label) supports the following:

• create - Optional Block
Enable this option

• password_reset - Optional Block
Configuration parameter for password reset

Cloudfront Protected Endpoints Flow Label Authentication

An authentication block (within cloudfront.protected_endpoints.flow_label) supports the following:

• login - Optional Block
Bot Defense Transaction Result. Bot Defense Transaction Result
See Login below.

• login_mfa - Optional Block
Enable this option

• login_partner - Optional Block
Configuration parameter for login partner

• logout - Optional Block
Enable this option

• token_refresh - Optional Block
Configuration parameter for token refresh

A login block (within cloudfront.protected_endpoints.flow_label.authentication) supports the following:

• disable_transaction_result - Optional Block
Enable this option

• transaction_result - Optional Block
Bot Defense Transaction Result Type. Bot Defense Transaction ResultType
See Transaction Result below.

Deeply nested Result block collapsed for readability.

Deeply nested Conditions block collapsed for readability.

Cloudfront Protected Endpoints Flow Label Financial Services

A financial_services block (within cloudfront.protected_endpoints.flow_label) supports the following:

• apply - Optional Block
Enable this option

• money_transfer - Optional Block
Configuration parameter for money transfer

Cloudfront Protected Endpoints Flow Label Flight

A flight block (within cloudfront.protected_endpoints.flow_label) supports the following:

• checkin - Optional Block
Enable this option

Cloudfront Protected Endpoints Flow Label Profile Management

A profile_management block (within cloudfront.protected_endpoints.flow_label) supports the following:

• create - Optional Block
Enable this option

• update - Optional Block
Enable this option

• view - Optional Block
Enable this option

Cloudfront Protected Endpoints Flow Label Search

A search block (within cloudfront.protected_endpoints.flow_label) supports the following:

• flight_search - Optional Block
Configuration parameter for flight search

• product_search - Optional Block
Configuration parameter for product search

• reservation_search - Optional Block
Configuration parameter for reservation search

• room_search - Optional Block
Configuration parameter for room search

Cloudfront Protected Endpoints Flow Label Shopping Gift Cards

Deeply nested Cards block collapsed for readability.

Cloudfront Protected Endpoints Metadata

A metadata block (within cloudfront.protected_endpoints) supports the following:

• description_spec - Optional String
Description. Human readable description

• name - Optional String
Name of the message. The value of name has to follow DNS-1035 format

Cloudfront Protected Endpoints Mobile Client

A mobile_client block (within cloudfront.protected_endpoints) supports the following:

• block - Optional Block
Block Response for Mobile. Block Response
See Block below.

• continue - Optional Block
Select Continue Bot Mitigation Action. Continue mitigation action
See Continue below.

Cloudfront Protected Endpoints Mobile Client Block

A block block (within cloudfront.protected_endpoints.mobile_client) supports the following:

• body - Optional String
Body. Custom body message

• content_type - Optional String
Content type to use in a block response

Cloudfront Protected Endpoints Mobile Client Continue

A continue block (within cloudfront.protected_endpoints.mobile_client) supports the following:

• add_header - Optional Block
Enable this option

• no_header - Optional Block
Enable this option

Cloudfront Protected Endpoints Web Client

A web_client block (within cloudfront.protected_endpoints) supports the following:

• block - Optional Block
Block Response. Block Response
See Block below.

• continue - Optional Block
Select Continue Bot Mitigation Action. Continue mitigation action
See Continue below.

• redirect - Optional Block
Redirect. Redirect
See Redirect below.

Cloudfront Protected Endpoints Web Client Block

A block block (within cloudfront.protected_endpoints.web_client) supports the following:

• body - Optional String
Body. Custom body message

• content_type - Optional String
Content type to use in a block response

Cloudfront Protected Endpoints Web Client Continue

A continue block (within cloudfront.protected_endpoints.web_client) supports the following:

• add_header - Optional Block
Enable this option

• no_header - Optional Block
Enable this option

Cloudfront Protected Endpoints Web Client Redirect

A redirect block (within cloudfront.protected_endpoints.web_client) supports the following:

• location - Optional String
URI location for redirect response

Cloudfront Protected Endpoints Web Mobile Client

A web_mobile_client block (within cloudfront.protected_endpoints) supports the following:

• block_mobile - Optional Block
Block Response for Mobile. Block Response
See Block Mobile below.

• block_web - Optional Block
Block Response. Block Response
See Block Web below.

• continue_mobile - Optional Block
Select Continue Bot Mitigation Action. Continue mitigation action
See Continue Mobile below.

• continue_web - Optional Block
Select Continue Bot Mitigation Action. Continue mitigation action
See Continue Web below.

• redirect_web - Optional Block
Redirect. Redirect
See Redirect Web below.

Cloudfront Protected Endpoints Web Mobile Client Block Mobile

Deeply nested Mobile block collapsed for readability.

Cloudfront Protected Endpoints Web Mobile Client Block Web

Deeply nested Web block collapsed for readability.

Cloudfront Protected Endpoints Web Mobile Client Continue Mobile

Deeply nested Mobile block collapsed for readability.

Cloudfront Protected Endpoints Web Mobile Client Continue Web

Deeply nested Web block collapsed for readability.

Cloudfront Protected Endpoints Web Mobile Client Redirect Web

Deeply nested Web block collapsed for readability.

Cloudfront Trusted Clients

A trusted_clients block (within cloudfront) supports the following:

• http_header - Optional Block
Configuration parameter for HTTP header
See HTTP Header below.

• ip_prefix - Optional String
IP prefix string

Cloudfront Trusted Clients HTTP Header

A http_header block (within cloudfront.trusted_clients) supports the following:

• headers - Optional Block
List of HTTP header name and value pairs
See Headers below.

Cloudfront Trusted Clients HTTP Header Headers

A headers block (within cloudfront.trusted_clients.http_header) supports the following:

• exact - Optional String
Header value to match exactly

• name - Optional String
Name. Name of the header

• regex - Optional String
Regex match of the header value in re2 format

Cloudfront Trusted Clients Metadata

A metadata block (within cloudfront.trusted_clients) supports the following:

• description_spec - Optional String
Description. Human readable description

• name - Optional String
Name of the message. The value of name has to follow DNS-1035 format

Timeouts

A timeouts block supports the following:

• create - Optional String (Defaults to 10 minutes)
Used when creating the resource

• delete - Optional String (Defaults to 10 minutes)
Used when deleting the resource

• read - Optional String (Defaults to 5 minutes)
Used when retrieving the resource

• update - Optional String (Defaults to 10 minutes)
Used when updating the resource

Common Types

The following type definitions are used throughout this resource. See the full definition here rather than repeated inline.

Object Reference {#common-object-reference}

Object references establish a direct reference from one configuration object to another in F5 Distributed Cloud. References use the format tenant/namespace/name.

Field	Type	Description
`name`	String	Name of the referenced object
`namespace`	String	Namespace containing the referenced object
`tenant`	String	Tenant of the referenced object (system-managed)

Transformers {#common-transformers}

Transformers apply transformations to input values before matching. Multiple transformers can be applied in order.

Value	Description
`LOWER_CASE`	Convert to lowercase
`UPPER_CASE`	Convert to uppercase
`BASE64_DECODE`	Decodebase64 content
`NORMALIZE_PATH`	Normalize URL path
`REMOVE_WHITESPACE`	Remove whitespace characters
`URL_DECODE`	Decode URL-encoded characters
`TRIM_LEFT`	Trim leading whitespace
`TRIM_RIGHT`	Trim trailing whitespace
`TRIM`	Trim both leading and trailing whitespace

HTTP Methods {#common-http-methods}

HTTP methods used for request matching.

Value	Description
`ANY`	Match any HTTP method
`GET`	HTTP GET request
`HEAD`	HTTP HEAD request
`POST`	HTTP POST request
`PUT`	HTTP PUT request
`DELETE`	HTTP DELETE request
`CONNECT`	HTTP CONNECT request
`OPTIONS`	HTTP OPTIONS request
`TRACE`	HTTP TRACE request
`PATCH`	HTTP PATCH request
`COPY`	HTTP COPY request (WebDAV)

TLS Fingerprints {#common-tls-fingerprints}

TLS fingerprint categories for malicious client detection.

Value	Description
`TLS_FINGERPRINT_NONE`	No fingerprint matching
`ANY_MALICIOUS_FINGERPRINT`	Match any known malicious fingerprint
`ADWARE`	Adware-associated fingerprints
`DRIDEX`	Dridex malware fingerprints
`GOOTKIT`	Gootkit malware fingerprints
`RANSOMWARE`	Ransomware-associated fingerprints
`TRICKBOT`	Trickbot malware fingerprints

IP Threat Categories {#common-ip-threat-categories}

IP address threat categories for security filtering.

Value	Description
`SPAM_SOURCES`	Known spam sources
`WINDOWS_EXPLOITS`	Windows exploit sources
`WEB_ATTACKS`	Web attack sources
`BOTNETS`	Known botnet IPs
`SCANNERS`	Network scanner IPs
`REPUTATION`	Poor reputation IPs
`PHISHING`	Phishing-related IPs
`PROXY`	Anonymous proxy IPs
`MOBILE_THREATS`	Mobile threat sources
`TOR_PROXY`	Tor exit nodes
`DENIAL_OF_SERVICE`	DoS attack sources
`NETWORK`	Known bad network ranges

Import

Import is supported using the following syntax:

# Import using namespace/name format
terraform import xcsh_protected_application.example system/example

xcsh_protected_application (Resource)

Example Usage

Argument Reference

Metadata Argument Reference

Spec Argument Reference

Attributes Reference

Cloudflare

Cloudflare Js Insertion Rules

Cloudflare Js Insertion Rules Exclude List

Cloudflare Js Insertion Rules Exclude List Domain

Cloudflare Js Insertion Rules Exclude List Metadata

Cloudflare Js Insertion Rules Exclude List Path

Cloudflare Js Insertion Rules Rules

Cloudflare Js Insertion Rules Rules Domain

Cloudflare Js Insertion Rules Rules Metadata

Cloudflare Manual Js Insert

Cloudflare Mobile SDK Config

Cloudflare Mobile SDK Config Mobile Identifier

Cloudflare Mobile SDK Config Mobile Identifier Headers

Cloudflare Protected Endpoints

Cloudflare Protected Endpoints Domain

Cloudflare Protected Endpoints Metadata

Cloudflare Protected Endpoints Mobile Client

Cloudflare Protected Endpoints Mobile Client Block

Cloudflare Protected Endpoints Mobile Client Continue

Cloudflare Protected Endpoints Path

Cloudflare Protected Endpoints Web Client

Cloudflare Protected Endpoints Web Client Block

Cloudflare Protected Endpoints Web Client Continue

Cloudflare Protected Endpoints Web Client Redirect

Cloudflare Protected Endpoints Web Mobile Client

Cloudflare Protected Endpoints Web Mobile Client Block Mobile

Cloudflare Protected Endpoints Web Mobile Client Block Web

Cloudflare Protected Endpoints Web Mobile Client Continue Mobile

Cloudflare Protected Endpoints Web Mobile Client Continue Web

Cloudflare Protected Endpoints Web Mobile Client Redirect Web

Cloudflare Trusted Clients

Cloudflare Trusted Clients HTTP Header

Cloudflare Trusted Clients HTTP Header Headers

Cloudflare Trusted Clients Metadata

Cloudfront

Cloudfront AWS Configuration ID Selector

Cloudfront AWS Configuration Tag Selector

Cloudfront Js Insertion Rules

Cloudfront Js Insertion Rules Exclude List

Cloudfront Js Insertion Rules Exclude List Domain

Cloudfront Js Insertion Rules Exclude List Metadata

Cloudfront Js Insertion Rules Exclude List Path

Cloudfront Js Insertion Rules Rules

Cloudfront Js Insertion Rules Rules Domain

Cloudfront Js Insertion Rules Rules Metadata

Cloudfront Manual Js Insert

Cloudfront Mobile SDK Config

Cloudfront Mobile SDK Config Mobile Identifier

Cloudfront Mobile SDK Config Mobile Identifier Headers

Cloudfront Protected Endpoints

Cloudfront Protected Endpoints Domain

Cloudfront Protected Endpoints Flow Label

Cloudfront Protected Endpoints Flow Label Account Management

Cloudfront Protected Endpoints Flow Label Authentication

Cloudfront Protected Endpoints Flow Label Authentication Login

Cloudfront Protected Endpoints Flow Label Authentication Login Transaction Result

Cloudfront Protected Endpoints Flow Label Authentication Login Transaction Result Failure Conditions

Cloudfront Protected Endpoints Flow Label Authentication Login Transaction Result Success Conditions

Cloudfront Protected Endpoints Flow Label Financial Services

Cloudfront Protected Endpoints Flow Label Flight

Cloudfront Protected Endpoints Flow Label Profile Management

Cloudfront Protected Endpoints Flow Label Search

Cloudfront Protected Endpoints Flow Label Shopping Gift Cards

Cloudfront Protected Endpoints Metadata

Cloudfront Protected Endpoints Mobile Client

Cloudfront Protected Endpoints Mobile Client Block

Cloudfront Protected Endpoints Mobile Client Continue

Cloudfront Protected Endpoints Web Client

Cloudfront Protected Endpoints Web Client Block

Cloudfront Protected Endpoints Web Client Continue

Cloudfront Protected Endpoints Web Client Redirect

Cloudfront Protected Endpoints Web Mobile Client

Cloudfront Protected Endpoints Web Mobile Client Block Mobile

Cloudfront Protected Endpoints Web Mobile Client Block Web