使用 API 部署 WAF 托管规则集（账户级）

使用 Rulesets API 在账户级将 WAF 托管规则集部署到 http_request_firewall_managed 阶段。

WAF 托管规则集页面包含各规则集的 ID，您在通过 API 部署时需要用到这些 ID。

若您使用 Terraform，请参阅 通过 Terraform 配置 WAF 托管规则集。

以下示例通过创建一个执行托管规则集的规则，将 Cloudflare Managed Ruleset 部署到给定账户（$ACCOUNT_ID）的 http_request_firewall_managed 阶段：当区域名称与 example.com 或 anotherexample.com 之一匹配时，将执行托管规则集中的规则。

1. 调用获取账户入口点规则集操作，以获取 http_request_firewall_managed 阶段的入口点规则集定义。您将需要账户 ID来执行此任务。

   Required API token permissions

   At least one of the following token permissions is required:

   • Account WAF Write
   • Account WAF Read
   • Account Rulesets Read
   • Account Rulesets Write

   curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/rulesets/phases/http_request_firewall_managed/entrypoint" \
   	--request GET \
   	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN"

   {
   	"result": {
   		"description": "Account-level phase entry point",
   		"id": "<RULESET_ID>",
   		"kind": "root",
   		"last_updated": "2024-03-16T15:40:08.202335Z",
   		"name": "root",
   		"phase": "http_request_firewall_managed",
   		"rules": [
   			// ...
   		],
   		"source": "firewall_managed",
   		"version": "10"
   	},
   	"success": true,
   	"errors": [],
   	"messages": []
   }

2. 如果入口点规则集已存在（即，如果您收到 200 OK 状态代码和规则集定义），请记下响应中的规则集 ID。然后，调用创建账户规则集规则操作，向现有规则集中添加一条 execute 规则，以部署 Cloudflare Managed Ruleset（ID 为 efb7b8c949ac4650a09736fc376e9aee）。默认情况下，该规则将添加到规则集中已有规则列表的末尾。

   Required API token permissions

   At least one of the following token permissions is required:

   • Account WAF Write
   • Account Rulesets Write

   curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/rulesets/$RULESET_ID/rules" \
   	--request POST \
   	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
   	--json '{
   		"action": "execute",
   		"action_parameters": {
   				"id": "efb7b8c949ac4650a09736fc376e9aee"
   		},
   		"expression": "(cf.zone.name in {\"example.com\" \"anotherexample.com\"}) and cf.zone.plan eq \"ENT\"",
   		"description": "Execute the Cloudflare Managed Ruleset"
   	}'

   {
   	"result": {
   		"id": "<RULESET_ID>",
   		"name": "Account-level phase entry point",
   		"description": "",
   		"kind": "root",
   		"version": "11",
   		"rules": [
   			// ... any existing rules
   			{
   				"id": "<RULE_ID>",
   				"version": "1",
   				"action": "execute",
   				"action_parameters": {
   					"id": "efb7b8c949ac4650a09736fc376e9aee",
   					"version": "latest"
   				},
   				"expression": "(cf.zone.name in {\"example.com\" \"anotherexample.com\"}) and cf.zone.plan eq \"ENT\"",
   				"description": "Execute the Cloudflare Managed Ruleset",
   				"last_updated": "2024-03-18T18:30:08.122758Z",
   				"ref": "<RULE_REF>",
   				"enabled": true
   			}
   		],
   		"last_updated": "2024-03-18T18:30:08.122758Z",
   		"phase": "http_request_firewall_managed"
   	},
   	"success": true,
   	"errors": [],
   	"messages": []
   }

3. 如果入口点规则集不存在（即，如果您在第 1 步中收到 404 Not Found 状态代码），请使用创建账户规则集操作来创建它。在 rules 数组中包含一条单一规则，以便为 区域名称匹配 example.com 或 anotherexample.com 之一的所有传入请求 执行 Cloudflare Managed Ruleset（ID 为 efb7b8c949ac4650a09736fc376e9aee）。

   Required API token permissions

   At least one of the following token permissions is required:

   • Account WAF Write
   • Account Rulesets Write

   curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/rulesets" \
   	--request POST \
   	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
   	--json '{
   		"name": "My ruleset",
   		"description": "Entry point ruleset for WAF managed rulesets",
   		"kind": "root",
   		"phase": "http_request_firewall_managed",
   		"rules": [
   				{
   						"action": "execute",
   						"action_parameters": {
   								"id": "efb7b8c949ac4650a09736fc376e9aee"
   						},
   						"expression": "(cf.zone.name in {\"example.com\" \"anotherexample.com\"}) and cf.zone.plan eq \"ENT\"",
   						"description": "Execute the Cloudflare Managed Ruleset"
   				}
   		]
   	}'

要自定义托管规则集中的规则行为，请执行 创建覆盖（override）。

如需跳过 WAF 托管规则集或其部分规则的执行，请 创建例外（也称 skip 规则）。

例外（exceptions）的优先级高于覆盖（overrides）。

有关如何通过 API 在 zone 级部署托管规则集的说明，请参阅 使用 API 部署 WAF 托管规则集（zone 级）。

有关通过 API 使用托管规则集的更多信息，请参阅规则集引擎文档中的 使用托管规则集。