使用 Terraform 配置 DDoS 托管规则集

本页面提供了使用 Terraform 在您的区域或账户中配置 DDoS 托管规则集的示例。它涵盖以下配置：

示例：配置 HTTP DDoS 攻击保护
示例：配置网络层 DDoS 攻击保护
用例：缓解大型 HTTP DDoS 攻击并监控标记流量

DDoS 托管规则集始终处于启用状态。根据您的 Cloudflare 服务，您或许能够调整其行为。

如果您正在使用 Cloudflare API，请参考以下资源：

有关使用规则集 API 部署和配置规则集的更多信息，请参考规则集引擎文档中的使用托管规则集。

开始之前

获取必要的账户、区域和托管规则集 ID

本页提供的 Terraform 配置需要您将部署托管规则集的区域 ID（或账户 ID）。

要检索您有权访问的账户列表（包括其 ID），请使用列出账户操作。
要检索您有权访问的区域列表（包括其 ID），请使用列出区域操作。

通过 Terraform 部署托管规则集需要使用规则集 ID。要查找托管规则集的 ID，请使用列出账户规则集操作。响应将包含现有托管规则集的描述和 ID。

（可选）删除现有规则集以从头开始

Terraform 假定其对账户和区域规则集拥有完全控制权。如果您的账户或区域中已配置了规则集，请执行以下操作之一：

使用 cf-terraforming 工具将现有规则集导入 Terraform。该工具的最新版本可以为现有规则集生成资源定义，并将其配置导入 Terraform 状态。
通过删除现有规则集（分别为 "kind": "root" 的账户规则集和 "kind": "zone" 的区域规则集）从头开始，然后在 Terraform 中定义您的规则集配置。

示例：配置 HTTP DDoS 攻击保护

此示例使用 Terraform 为区域配置 HTTP DDoS 攻击保护托管规则集。

所需的 API 令牌权限

需要以下至少一项令牌权限：

HTTP DDoS Managed Ruleset Write

配置 cloudflare_ruleset ↗ 资源：

resource "cloudflare_ruleset" "zone_level_http_ddos_config" {
  zone_id     = var.cloudflare_zone_id
  name        = "HTTP DDoS Attack Protection entry point ruleset"
  description = ""
  kind        = "zone"
  phase       = "ddos_l7"

  rules = [{
    action = "execute"
    action_parameters = {
      # Cloudflare L7 DDoS Attack Protection Ruleset
      id = "4d21379b4f9f4bb088e0729962c8b3cf"
      overrides = {
        action            = "block"
        sensitivity_level = "default"
        rules = [
          {
            # Adaptive DDoS Protection based on Locations (Available only to Enterprise zones with Advanced DDoS service)
            id                = "a8c6333711ff4b0a81371d1c444be2c3"
            sensitivity_level = "default"
            action            = "managed_challenge"
          },
          {
            # Adaptive DDoS Protection based on User-Agents (Available only to Enterprise zones with Advanced DDoS service)
            id                = "7709d496081e458899c1e3a6e4fe8e55"
            sensitivity_level = "default"
            action            = "managed_challenge"
          },
          {
            # HTTP requests causing a high number of origin errors.
            id                = "dd42da7baabe4e518eaf11c393596a9d"
            sensitivity_level = "default"
            action            = "managed_challenge"
          },
        ]
      }
    }
    expression  = "true"
    description = "Zone-wide HTTP DDoS Override"
    enabled     = true
  }]
}

resource "cloudflare_ruleset" "zone_level_http_ddos_config" {
  zone_id     = "<ZONE_ID>"
  name        = "HTTP DDoS Attack Protection entry point ruleset"
  description = ""
  kind        = "zone"
  phase       = "ddos_l7"

  rules {
    action = "execute"
    action_parameters {
      # Cloudflare L7 DDoS Attack Protection Ruleset
      id = "4d21379b4f9f4bb088e0729962c8b3cf"
      overrides {
        action = "block"
        sensitivity_level = "default"
        rules {
          # Adaptive DDoS Protection based on Locations (Available only to Enterprise zones with Advanced DDoS service)
          id = "a8c6333711ff4b0a81371d1c444be2c3"
          sensitivity_level = "default"
          action = "managed_challenge"
        }
        rules {
          # Adaptive DDoS Protection based on User-Agents (Available only to Enterprise zones with Advanced DDoS service)
          id = "7709d496081e458899c1e3a6e4fe8e55"
          sensitivity_level = "default"
          action = "managed_challenge"
        }
        rules {
          # HTTP requests causing a high number of origin errors.
          id = "dd42da7baabe4e518eaf11c393596a9d"
          sensitivity_level = "default"
          action = "managed_challenge"
        }
      }
    }
    expression = "true"
    description = "Zone-wide HTTP DDoS Override"
    enabled = true
  }
}

有关 HTTP DDoS 攻击保护的更多信息，请参考 HTTP DDoS 攻击保护托管规则集。

示例：配置网络层 DDoS 攻击保护

此示例使用 Terraform 为账户配置网络层 DDoS 攻击保护托管规则集，使用覆盖将 ID 为的规则的敏感度级别更改为 low。

所需的 API 令牌权限

需要以下至少一项令牌权限：

L4 DDoS Managed Ruleset Write

配置 cloudflare_ruleset ↗ 资源：

resource "cloudflare_ruleset" "account_level_network_ddos_config" {
  account_id  = var.cloudflare_account_id
  name        = "Network-layer DDoS Attack Protection entry point ruleset"
  description = ""
  kind        = "root"
  phase       = "ddos_l4"

  rules = [{
    ref         = "override_l7_ddos_ruleset_dst_ip"
    description = "Override the HTTP DDoS Attack Protection managed ruleset"
    expression  = "ip.dst in { 192.0.2.0/24 }"
    action      = "execute"
    action_parameters = {
      # Cloudflare L3/4 DDoS Attack Protection Ruleset
      id = "3b64149bfa6e4220bbbc2bd6db589552"
      overrides = {
        rules = [{
          # Rule: Generic high-volume UDP traffic flows.
          id                = "599dab0942ff4898ac1b7797e954e98b"
          sensitivity_level = "low"
        }]
      }
    }
  }]
}

resource "cloudflare_ruleset" "account_level_network_ddos_config" {
  account_id  = "<ACCOUNT_ID>"
  name        = "Network-layer DDoS Attack Protection entry point ruleset"
  description = ""
  kind        = "root"
  phase       = "ddos_l4"

  rules {
    ref         = "override_l7_ddos_ruleset_dst_ip"
    description = "Override the HTTP DDoS Attack Protection managed ruleset"
    expression  = "ip.dst in { 192.0.2.0/24 }"
    action      = "execute"
    action_parameters {
      # Cloudflare L3/4 DDoS Attack Protection Ruleset
      id = "3b64149bfa6e4220bbbc2bd6db589552"
      overrides {
        rules {
          # Rule: Generic high-volume UDP traffic flows.
          id                = "599dab0942ff4898ac1b7797e954e98b"
          sensitivity_level = "low"
        }
      }
    }
  }
}

有关网络层 DDoS 攻击保护的更多信息，请参考网络层 DDoS 攻击保护托管规则集。

用例：缓解大型 HTTP DDoS 攻击并监控标记流量

在以下示例中，客户担心误报，但希望获得针对大型 HTTP DDoS 攻击的保护。他们的 HTTP DDoS 保护配置中的两条规则（每条包含两个覆盖）将具有以下行为：

通过配置具有 Low（低）敏感度级别和 Block（阻止）操作的规则，缓解任何大型 HTTP DDoS 攻击。
通过配置具有默认敏感度级别 (High) 和 Log 操作的规则，监控被 DDoS 保护系统标记的流量。

规则的顺序很重要：敏感度级别最高的规则必须位于敏感度级别最低的规则之后，否则它将永远不会被评估。

所需的 API 令牌权限

需要以下至少一项令牌权限：

HTTP DDoS Managed Ruleset Write

配置 cloudflare_ruleset ↗ 资源：

resource "cloudflare_ruleset" "zone_level_http_ddos_config" {
  zone_id     = var.cloudflare_zone_id
  name        = "HTTP DDoS - Terraform managed"
  description = ""
  kind        = "zone"
  phase       = "ddos_l7"

  # The resource configuration contains two rules:
  #  1. The first rule has the lowest sensitivity level (highest threshold)
  #     and it will block attacks.
  #  2. The second rule has a higher sensitivity level (lower threshold) and
  #     will only apply a Log action.
  #
  # In practice, evaluation stops whenever a rule matches both the expression
  # and the threshold, so the rule order is important:
  #   - When the traffic rate is below the (low) threshold of the default
  #     sensitivity level ('High'), no rules match (no action is applied).
  #   - When the traffic rate is between the thresholds of the 'Low' and
  #     default ('High') sensitivity levels, the first rule does not match,
  #     but the second rule does (traffic gets logged).
  #   - When the traffic rate goes above the (high) threshold of the 'Low'
  #     sensitivity level, the first rule matches (traffic gets blocked).
  #
  # The DDoS protection systems will still apply mitigation actions to incoming
  # traffic when rates exceed the threshold of the _Essentially Off_ sensitivity
  # level.

  rules = [
    {
      ref         = "l7_ddos_block_traffic_low_threshold"
      description = "At the low sensitivity threshold, block the traffic"
      expression  = "true"
      action      = "execute"
      action_parameters = {
        # Cloudflare L7 DDoS Attack Protection Ruleset
        id = "4d21379b4f9f4bb088e0729962c8b3cf"
        overrides = {
          rules = [
            {
              # Rule: HTTP requests from known botnet (signature #4).
              id                = "29d170ba2f004cc787b1ac272c9e04e7"
              sensitivity_level = "low"
              action            = "block"
            },
            {
              # Rule: HTTP requests with unusual HTTP headers or URI path (signature #16).
              id                = "60a48054bbcf4014ac63c44f1712a123"
              sensitivity_level = "low"
              action            = "block"
            },
          ]
        }
      }
    },
    {
      ref         = "l7_ddos_log_default_threshold"
      description = "At the default sensitivity threshold, log to see if any legitimate traffic gets caught"
      expression  = "true"
      action      = "execute"
      action_parameters = {
        # Cloudflare L7 DDoS Attack Protection Ruleset
        id = "4d21379b4f9f4bb088e0729962c8b3cf"
        overrides = {
          rules = [
            {
              # Rule: HTTP requests from known botnet (signature #4).
              id                = "29d170ba2f004cc787b1ac272c9e04e7"
              sensitivity_level = "default"
              action            = "log"
            },
            {
              # Rule: HTTP requests with unusual HTTP headers or URI path (signature #16).
              id                = "60a48054bbcf4014ac63c44f1712a123"
              sensitivity_level = "default"
              action            = "log"
            },
          ]
        }
      }
    },
  ]
}

variable "zone_id" {
  default = "<ZONE_ID>"
}

resource "cloudflare_ruleset" "zone_level_http_ddos_config" {
  zone_id     = var.zone_id
  name        = "HTTP DDoS - Terraform managed"
  description = ""
  kind        = "zone"
  phase       = "ddos_l7"

  # The resource configuration contains two rules:
  #  1. The first rule has the lowest sensitivity level (highest threshold)
  #     and it will block attacks.
  #  2. The second rule has a higher sensitivity level (lower threshold) and
  #     will only apply a Log action.
  #
  # In practice, evaluation stops whenever a rule matches both the expression
  # and the threshold, so the rule order is important:
  #   - When the traffic rate is below the (low) threshold of the default
  #     sensitivity level ('High'), no rules match (no action is applied).
  #   - When the traffic rate is between the thresholds of the 'Low' and
  #     default ('High') sensitivity levels, the first rule does not match,
  #     but the second rule does (traffic gets logged).
  #   - When the traffic rate goes above the (high) threshold of the 'Low'
  #     sensitivity level, the first rule matches (traffic gets blocked).
  #
  # The DDoS protection systems will still apply mitigation actions to incoming
  # traffic when rates exceed the threshold of the _Essentially Off_ sensitivity
  # level.

  rules {
    ref         = "l7_ddos_block_traffic_low_threshold"
    description = "At the low sensitivity threshold, block the traffic"
    expression  = "true"
    action      = "execute"
    action_parameters {
      # Cloudflare L7 DDoS Attack Protection Ruleset
      id = "4d21379b4f9f4bb088e0729962c8b3cf"
      overrides {
        rules {
          # Rule: HTTP requests from known botnet (signature #4).
          id                = "29d170ba2f004cc787b1ac272c9e04e7"
          sensitivity_level = "low"
          action            = "block"
        }
        rules {
          # Rule: HTTP requests with unusual HTTP headers or URI path (signature #16).
          id                = "60a48054bbcf4014ac63c44f1712a123"
          sensitivity_level = "low"
          action            = "block"
        }
      }
    }
  }

  rules {
    ref         = "l7_ddos_log_default_threshold"
    description = "At the default sensitivity threshold, log to see if any legitimate traffic gets caught"
    expression  = "true"
    action      = "execute"
    action_parameters {
      # Cloudflare L7 DDoS Attack Protection Ruleset
      id = "4d21379b4f9f4bb088e0729962c8b3cf"
      overrides {
        rules {
          # Rule: HTTP requests from known botnet (signature #4).
          id                = "29d170ba2f004cc787b1ac272c9e04e7"
          sensitivity_level = "default"
          action            = "log"
        }
        rules {
          # Rule: HTTP requests with unusual HTTP headers or URI path (signature #16).
          id                = "60a48054bbcf4014ac63c44f1712a123"
          sensitivity_level = "default"
          action            = "log"
        }
      }
    }
  }
}