@huaweicloudos/pulumi
Version:
A Pulumi package for creating and managing Huaweicloud cloud resources.
676 lines (675 loc) • 28.6 kB
TypeScript
import * as pulumi from "@pulumi/pulumi";
import { input as inputs, output as outputs } from "../types";
/**
* Manages a WAF domain resource within HuaweiCloud.
*
* > **NOTE:** All WAF resources depend on WAF instances, and the WAF instances need to be purchased before they can be
* used. The domain name resource can be used in Cloud Mode.
*
* ## Example Usage
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as pulumi from "@huaweicloudos/pulumi";
*
* const config = new pulumi.Config();
* const enterpriseProjectId = config.requireObject("enterpriseProjectId");
* const certificateId = config.requireObject("certificateId");
* const certificateName = config.requireObject("certificateName");
* const test = new huaweicloud.waf.Domain("test", {
* domain: "www.example.com",
* certificateId: certificateId,
* certificateName: certificateName,
* proxy: true,
* enterpriseProjectId: enterpriseProjectId,
* description: "test description",
* websiteName: "websiteName",
* protectStatus: 1,
* forwardHeaderMap: {
* key1: `$time_local`,
* key2: `$tenant_id`,
* },
* customPage: {
* httpReturnCode: "404",
* blockPageType: "application/json",
* pageContent: `{
* "event_id": "${waf_event_id}",
* "error_msg": "error message"
* }
* `,
* },
* timeoutSettings: {
* connectionTimeout: 100,
* readTimeout: 1000,
* writeTimeout: 1000,
* },
* trafficMark: {
* ipTags: ["ip_tag"],
* sessionTag: "session_tag",
* userTag: "user_tag",
* },
* servers: [{
* clientProtocol: "HTTPS",
* serverProtocol: "HTTP",
* address: "119.8.0.13",
* port: 8080,
* type: "ipv4",
* }],
* });
* ```
*
* ## Import
*
* There are two ways to import WAF domain state. * Using the `id`, e.g. bash
*
* ```sh
* $ pulumi import huaweicloud:Waf/domain:Domain test <id>
* ```
*
* * Using `id` and `enterprise_project_id`, separated by a slash, e.g. bash
*
* ```sh
* $ pulumi import huaweicloud:Waf/domain:Domain test <id>/<enterprise_project_id>
* ```
*
* Note that the imported state may not be identical to your resource definition, due to some attributes missing from the API response, security or some other reason. The missing attributes include`keep_policy`, `charging_mode`, `ipv6_enable`. It is generally recommended running `terraform plan` after importing a resource. You can then decide if changes should be applied to the resource, or the resource definition should be updated to align with the resource. Also, you can ignore changes as below. hcl resource "huaweicloud_waf_domain" "test" {
*
* ...
*
* lifecycle {
*
* ignore_changes = [
*
* keep_policy,
*
* charging_mode,
*
* ipv6_enable,
*
* ]
*
* } }
*/
export declare class Domain extends pulumi.CustomResource {
/**
* Get an existing Domain resource's state with the given name, ID, and optional extra
* properties used to qualify the lookup.
*
* @param name The _unique_ name of the resulting resource.
* @param id The _unique_ provider ID of the resource to lookup.
* @param state Any extra arguments used during the lookup.
* @param opts Optional settings to control the behavior of the CustomResource.
*/
static get(name: string, id: pulumi.Input<pulumi.ID>, state?: DomainState, opts?: pulumi.CustomResourceOptions): Domain;
/**
* Returns true if the given object is an instance of Domain. This is designed to work even
* when multiple copies of the Pulumi SDK have been loaded into the same process.
*/
static isInstance(obj: any): obj is Domain;
/**
* The CNAME prefix. The CNAME suffix is `.vip1.huaweicloudwaf.com`.
*/
readonly accessCode: pulumi.Output<string>;
/**
* Whether a domain name is connected to WAF. 0: The domain name is not connected to WAF, 1: The domain
* name is connected to WAF.
*/
readonly accessStatus: pulumi.Output<number>;
/**
* Specifies the certificate ID. This parameter is mandatory when `clientProtocol`
* is set to **HTTPS**.
*/
readonly certificateId: pulumi.Output<string | undefined>;
/**
* Specifies the certificate name. This parameter is mandatory
* when `clientProtocol` is set to **HTTPS**.
*/
readonly certificateName: pulumi.Output<string | undefined>;
/**
* Specifies the charging mode of the domain. Valid values are **prePaid**
* and **postPaid**, defaults to **prePaid**. Changing this creates a new instance.
*/
readonly chargingMode: pulumi.Output<string | undefined>;
/**
* Specifies the cipher suite of domain.
* The options include **cipher_1**, **cipher_2**,**cipher_3**, **cipher_4**, **cipher_default**.
*/
readonly cipher: pulumi.Output<string>;
/**
* Specifies the custom page. Only supports one custom alarm page.
* The customPage structure is documented below.
*/
readonly customPage: pulumi.Output<outputs.Waf.DomainCustomPage | undefined>;
/**
* Specifies the description of the WAF domain.
*/
readonly description: pulumi.Output<string>;
/**
* Specifies the domain name to be protected. For example, `www.example.com` or
* `*.example.com`. Changing this creates a new domain.
*/
readonly domain: pulumi.Output<string>;
/**
* Specifies the enterprise project ID of WAF domain.
* For enterprise users, if omitted, default enterprise project will be used.
* Changing this parameter will create a new resource.
*/
readonly enterpriseProjectId: pulumi.Output<string | undefined>;
/**
* Specifies the field forwarding configuration. WAF inserts the added fields into
* the header and forwards the header to the origin server. The key cannot be the same as the native Nginx field.
* The options of value are as follows:
* + **$time_local**
* + **$request_id**
* + **$connection_requests**
* + **$tenant_id**
* + **$project_id**
* + **$remote_addr**
* + **$remote_port**
* + **$scheme**
* + **$request_method**
* + **$http_host**
* + **$origin_uri**
* + **$request_length**
* + **$ssl_server_name**
* + **$ssl_protocol**
* + **$ssl_curves**
* + **$ssl_session_reused**
*/
readonly forwardHeaderMap: pulumi.Output<{
[key: string]: string;
}>;
/**
* Specifies whether to use the http2 protocol.
* This field is only used for communication between clients and WAF.
* Defaults to **false**.
* Things to note when using this field are as follows:
* + There must be at least one server configuration with client protocol set to **HTTPS**, or this configuration is unable
* to work.
* + This field cannot not work if the client supports **TLS 1.3**.
* + This field can work only when the client supports **TLS 1.2** or earlier versions.
* + If you want to use HTTP/2 forwarding, use a dedicated WAF instance.
*/
readonly http2Enable: pulumi.Output<boolean>;
/**
* Specifies whether IPv6 protection is enabled.
* Enable IPv6 protection if the domain name is accessible using an IPv6 address.
* After you enable it, WAF assigns an IPv6 address to the domain name.
* This field must be set to **true** when `server` contains a value of type **ipv6**.
* Defaults to false.
*/
readonly ipv6Enable: pulumi.Output<boolean>;
/**
* Specifies whether to retain the policy when deleting a domain name.
* Defaults to **true**.
*/
readonly keepPolicy: pulumi.Output<boolean | undefined>;
/**
* Specifies the load balancing algorithms used to
* distribute requests across origin servers.
* Only the professional edition (original enterprise edition) and platinum edition
* (original ultimate edition) support configuring the load balancing algorithm.
* The options of value are as follows:
* + **ip_hash** : Requests from the same IP address are routed to the same backend server.
* + **round_robin** : Requests are distributed across backend servers in turn based on the
* weight you assign to each server.
* + **session_hash** : Direct requests with the same session ID to the same origin server.
* Before using this configuration, please make sure to configure the traffic identifier for
* attack punishment after adding the domain name, otherwise the session hash configuration will not take effect.
*/
readonly lbAlgorithm: pulumi.Output<string>;
/**
* Specifies the status of the PCI 3DS compliance certification check.
* This parameter must be used together with `tls` and `cipher`.
*/
readonly pci3ds: pulumi.Output<boolean>;
/**
* Specifies the status of the PCI DSS compliance certification check.
* This parameter must be used together with `tls` and `cipher`.
*/
readonly pciDss: pulumi.Output<boolean>;
/**
* Specifies the policy ID associated with the domain. If not specified, a new
* policy will be created automatically.
*/
readonly policyId: pulumi.Output<string>;
/**
* The protection status of domain. Valid values are:
* + `0`: The WAF protection is suspended. WAF only forwards requests destined for the domain name and does not detect attacks.
* + `1`: The WAF protection is enabled. WAF detects attacks based on the policy you configure.
* + `-1`: The WAF protection is bypassed. Requests of the domain name are directly sent to the backend server and do
* not pass through WAF.
*/
readonly protectStatus: pulumi.Output<number>;
/**
* The protocol type of the client. The options are HTTP, HTTPS, and HTTP&HTTPS.
*/
readonly protocol: pulumi.Output<string>;
/**
* Specifies whether a proxy is configured.
*/
readonly proxy: pulumi.Output<boolean | undefined>;
/**
* Specifies the URL of the redirected page. The root domain name of the redirection
* address must be the name of the currently protected domain (including a wildcard domain name).
* The available **${http_host}** can be used to indicate the currently protected domain name and port.
* For example: **${http_host}/error.html**.
*/
readonly redirectUrl: pulumi.Output<string | undefined>;
/**
* Specifies the region in which to create the WAF domain resource.
* If omitted, the provider-level region will be used. Changing this setting will push a new certificate.
*/
readonly region: pulumi.Output<string>;
/**
* Specifies an array of origin web servers.
* The server structure is documented below.
*/
readonly servers: pulumi.Output<outputs.Waf.DomainServer[]>;
/**
* Specifies the timeout setting. Only supports one timeout setting.
* The timeoutSettings structure is documented below.
*/
readonly timeoutSettings: pulumi.Output<outputs.Waf.DomainTimeoutSettings>;
/**
* Specifies the minimum required TLS version. The options include **TLS v1.0**, **TLS v1.1**,
* **TLS v1.2**.
*/
readonly tls: pulumi.Output<string>;
/**
* Specifies the traffic identifier.
* WAF uses the configurations to identify the malicious client IP address (proxy mode) in the header,
* session in the cookie, and user attribute in the parameter,
* and then triggers the corresponding known attack source rules to block attack sources.
* Only supports one traffic identifier.
* The trafficMark structure is documented below.
*/
readonly trafficMark: pulumi.Output<outputs.Waf.DomainTrafficMark>;
/**
* Specifies the website name.
* This website name must start with a letter and only letters, digits, underscores (_),
* hyphens (-), colons (:) and periods (.) are allowed.
* The value contains `1` to `128` characters.
* The website name must be unique within this account.
*/
readonly websiteName: pulumi.Output<string>;
/**
* Create a Domain resource with the given unique name, arguments, and options.
*
* @param name The _unique_ name of the resource.
* @param args The arguments to use to populate this resource's properties.
* @param opts A bag of options that control this resource's behavior.
*/
constructor(name: string, args: DomainArgs, opts?: pulumi.CustomResourceOptions);
}
/**
* Input properties used for looking up and filtering Domain resources.
*/
export interface DomainState {
/**
* The CNAME prefix. The CNAME suffix is `.vip1.huaweicloudwaf.com`.
*/
accessCode?: pulumi.Input<string>;
/**
* Whether a domain name is connected to WAF. 0: The domain name is not connected to WAF, 1: The domain
* name is connected to WAF.
*/
accessStatus?: pulumi.Input<number>;
/**
* Specifies the certificate ID. This parameter is mandatory when `clientProtocol`
* is set to **HTTPS**.
*/
certificateId?: pulumi.Input<string>;
/**
* Specifies the certificate name. This parameter is mandatory
* when `clientProtocol` is set to **HTTPS**.
*/
certificateName?: pulumi.Input<string>;
/**
* Specifies the charging mode of the domain. Valid values are **prePaid**
* and **postPaid**, defaults to **prePaid**. Changing this creates a new instance.
*/
chargingMode?: pulumi.Input<string>;
/**
* Specifies the cipher suite of domain.
* The options include **cipher_1**, **cipher_2**,**cipher_3**, **cipher_4**, **cipher_default**.
*/
cipher?: pulumi.Input<string>;
/**
* Specifies the custom page. Only supports one custom alarm page.
* The customPage structure is documented below.
*/
customPage?: pulumi.Input<inputs.Waf.DomainCustomPage>;
/**
* Specifies the description of the WAF domain.
*/
description?: pulumi.Input<string>;
/**
* Specifies the domain name to be protected. For example, `www.example.com` or
* `*.example.com`. Changing this creates a new domain.
*/
domain?: pulumi.Input<string>;
/**
* Specifies the enterprise project ID of WAF domain.
* For enterprise users, if omitted, default enterprise project will be used.
* Changing this parameter will create a new resource.
*/
enterpriseProjectId?: pulumi.Input<string>;
/**
* Specifies the field forwarding configuration. WAF inserts the added fields into
* the header and forwards the header to the origin server. The key cannot be the same as the native Nginx field.
* The options of value are as follows:
* + **$time_local**
* + **$request_id**
* + **$connection_requests**
* + **$tenant_id**
* + **$project_id**
* + **$remote_addr**
* + **$remote_port**
* + **$scheme**
* + **$request_method**
* + **$http_host**
* + **$origin_uri**
* + **$request_length**
* + **$ssl_server_name**
* + **$ssl_protocol**
* + **$ssl_curves**
* + **$ssl_session_reused**
*/
forwardHeaderMap?: pulumi.Input<{
[key: string]: pulumi.Input<string>;
}>;
/**
* Specifies whether to use the http2 protocol.
* This field is only used for communication between clients and WAF.
* Defaults to **false**.
* Things to note when using this field are as follows:
* + There must be at least one server configuration with client protocol set to **HTTPS**, or this configuration is unable
* to work.
* + This field cannot not work if the client supports **TLS 1.3**.
* + This field can work only when the client supports **TLS 1.2** or earlier versions.
* + If you want to use HTTP/2 forwarding, use a dedicated WAF instance.
*/
http2Enable?: pulumi.Input<boolean>;
/**
* Specifies whether IPv6 protection is enabled.
* Enable IPv6 protection if the domain name is accessible using an IPv6 address.
* After you enable it, WAF assigns an IPv6 address to the domain name.
* This field must be set to **true** when `server` contains a value of type **ipv6**.
* Defaults to false.
*/
ipv6Enable?: pulumi.Input<boolean>;
/**
* Specifies whether to retain the policy when deleting a domain name.
* Defaults to **true**.
*/
keepPolicy?: pulumi.Input<boolean>;
/**
* Specifies the load balancing algorithms used to
* distribute requests across origin servers.
* Only the professional edition (original enterprise edition) and platinum edition
* (original ultimate edition) support configuring the load balancing algorithm.
* The options of value are as follows:
* + **ip_hash** : Requests from the same IP address are routed to the same backend server.
* + **round_robin** : Requests are distributed across backend servers in turn based on the
* weight you assign to each server.
* + **session_hash** : Direct requests with the same session ID to the same origin server.
* Before using this configuration, please make sure to configure the traffic identifier for
* attack punishment after adding the domain name, otherwise the session hash configuration will not take effect.
*/
lbAlgorithm?: pulumi.Input<string>;
/**
* Specifies the status of the PCI 3DS compliance certification check.
* This parameter must be used together with `tls` and `cipher`.
*/
pci3ds?: pulumi.Input<boolean>;
/**
* Specifies the status of the PCI DSS compliance certification check.
* This parameter must be used together with `tls` and `cipher`.
*/
pciDss?: pulumi.Input<boolean>;
/**
* Specifies the policy ID associated with the domain. If not specified, a new
* policy will be created automatically.
*/
policyId?: pulumi.Input<string>;
/**
* The protection status of domain. Valid values are:
* + `0`: The WAF protection is suspended. WAF only forwards requests destined for the domain name and does not detect attacks.
* + `1`: The WAF protection is enabled. WAF detects attacks based on the policy you configure.
* + `-1`: The WAF protection is bypassed. Requests of the domain name are directly sent to the backend server and do
* not pass through WAF.
*/
protectStatus?: pulumi.Input<number>;
/**
* The protocol type of the client. The options are HTTP, HTTPS, and HTTP&HTTPS.
*/
protocol?: pulumi.Input<string>;
/**
* Specifies whether a proxy is configured.
*/
proxy?: pulumi.Input<boolean>;
/**
* Specifies the URL of the redirected page. The root domain name of the redirection
* address must be the name of the currently protected domain (including a wildcard domain name).
* The available **${http_host}** can be used to indicate the currently protected domain name and port.
* For example: **${http_host}/error.html**.
*/
redirectUrl?: pulumi.Input<string>;
/**
* Specifies the region in which to create the WAF domain resource.
* If omitted, the provider-level region will be used. Changing this setting will push a new certificate.
*/
region?: pulumi.Input<string>;
/**
* Specifies an array of origin web servers.
* The server structure is documented below.
*/
servers?: pulumi.Input<pulumi.Input<inputs.Waf.DomainServer>[]>;
/**
* Specifies the timeout setting. Only supports one timeout setting.
* The timeoutSettings structure is documented below.
*/
timeoutSettings?: pulumi.Input<inputs.Waf.DomainTimeoutSettings>;
/**
* Specifies the minimum required TLS version. The options include **TLS v1.0**, **TLS v1.1**,
* **TLS v1.2**.
*/
tls?: pulumi.Input<string>;
/**
* Specifies the traffic identifier.
* WAF uses the configurations to identify the malicious client IP address (proxy mode) in the header,
* session in the cookie, and user attribute in the parameter,
* and then triggers the corresponding known attack source rules to block attack sources.
* Only supports one traffic identifier.
* The trafficMark structure is documented below.
*/
trafficMark?: pulumi.Input<inputs.Waf.DomainTrafficMark>;
/**
* Specifies the website name.
* This website name must start with a letter and only letters, digits, underscores (_),
* hyphens (-), colons (:) and periods (.) are allowed.
* The value contains `1` to `128` characters.
* The website name must be unique within this account.
*/
websiteName?: pulumi.Input<string>;
}
/**
* The set of arguments for constructing a Domain resource.
*/
export interface DomainArgs {
/**
* Specifies the certificate ID. This parameter is mandatory when `clientProtocol`
* is set to **HTTPS**.
*/
certificateId?: pulumi.Input<string>;
/**
* Specifies the certificate name. This parameter is mandatory
* when `clientProtocol` is set to **HTTPS**.
*/
certificateName?: pulumi.Input<string>;
/**
* Specifies the charging mode of the domain. Valid values are **prePaid**
* and **postPaid**, defaults to **prePaid**. Changing this creates a new instance.
*/
chargingMode?: pulumi.Input<string>;
/**
* Specifies the cipher suite of domain.
* The options include **cipher_1**, **cipher_2**,**cipher_3**, **cipher_4**, **cipher_default**.
*/
cipher?: pulumi.Input<string>;
/**
* Specifies the custom page. Only supports one custom alarm page.
* The customPage structure is documented below.
*/
customPage?: pulumi.Input<inputs.Waf.DomainCustomPage>;
/**
* Specifies the description of the WAF domain.
*/
description?: pulumi.Input<string>;
/**
* Specifies the domain name to be protected. For example, `www.example.com` or
* `*.example.com`. Changing this creates a new domain.
*/
domain: pulumi.Input<string>;
/**
* Specifies the enterprise project ID of WAF domain.
* For enterprise users, if omitted, default enterprise project will be used.
* Changing this parameter will create a new resource.
*/
enterpriseProjectId?: pulumi.Input<string>;
/**
* Specifies the field forwarding configuration. WAF inserts the added fields into
* the header and forwards the header to the origin server. The key cannot be the same as the native Nginx field.
* The options of value are as follows:
* + **$time_local**
* + **$request_id**
* + **$connection_requests**
* + **$tenant_id**
* + **$project_id**
* + **$remote_addr**
* + **$remote_port**
* + **$scheme**
* + **$request_method**
* + **$http_host**
* + **$origin_uri**
* + **$request_length**
* + **$ssl_server_name**
* + **$ssl_protocol**
* + **$ssl_curves**
* + **$ssl_session_reused**
*/
forwardHeaderMap?: pulumi.Input<{
[key: string]: pulumi.Input<string>;
}>;
/**
* Specifies whether to use the http2 protocol.
* This field is only used for communication between clients and WAF.
* Defaults to **false**.
* Things to note when using this field are as follows:
* + There must be at least one server configuration with client protocol set to **HTTPS**, or this configuration is unable
* to work.
* + This field cannot not work if the client supports **TLS 1.3**.
* + This field can work only when the client supports **TLS 1.2** or earlier versions.
* + If you want to use HTTP/2 forwarding, use a dedicated WAF instance.
*/
http2Enable?: pulumi.Input<boolean>;
/**
* Specifies whether IPv6 protection is enabled.
* Enable IPv6 protection if the domain name is accessible using an IPv6 address.
* After you enable it, WAF assigns an IPv6 address to the domain name.
* This field must be set to **true** when `server` contains a value of type **ipv6**.
* Defaults to false.
*/
ipv6Enable?: pulumi.Input<boolean>;
/**
* Specifies whether to retain the policy when deleting a domain name.
* Defaults to **true**.
*/
keepPolicy?: pulumi.Input<boolean>;
/**
* Specifies the load balancing algorithms used to
* distribute requests across origin servers.
* Only the professional edition (original enterprise edition) and platinum edition
* (original ultimate edition) support configuring the load balancing algorithm.
* The options of value are as follows:
* + **ip_hash** : Requests from the same IP address are routed to the same backend server.
* + **round_robin** : Requests are distributed across backend servers in turn based on the
* weight you assign to each server.
* + **session_hash** : Direct requests with the same session ID to the same origin server.
* Before using this configuration, please make sure to configure the traffic identifier for
* attack punishment after adding the domain name, otherwise the session hash configuration will not take effect.
*/
lbAlgorithm?: pulumi.Input<string>;
/**
* Specifies the status of the PCI 3DS compliance certification check.
* This parameter must be used together with `tls` and `cipher`.
*/
pci3ds?: pulumi.Input<boolean>;
/**
* Specifies the status of the PCI DSS compliance certification check.
* This parameter must be used together with `tls` and `cipher`.
*/
pciDss?: pulumi.Input<boolean>;
/**
* Specifies the policy ID associated with the domain. If not specified, a new
* policy will be created automatically.
*/
policyId?: pulumi.Input<string>;
/**
* The protection status of domain. Valid values are:
* + `0`: The WAF protection is suspended. WAF only forwards requests destined for the domain name and does not detect attacks.
* + `1`: The WAF protection is enabled. WAF detects attacks based on the policy you configure.
* + `-1`: The WAF protection is bypassed. Requests of the domain name are directly sent to the backend server and do
* not pass through WAF.
*/
protectStatus?: pulumi.Input<number>;
/**
* Specifies whether a proxy is configured.
*/
proxy?: pulumi.Input<boolean>;
/**
* Specifies the URL of the redirected page. The root domain name of the redirection
* address must be the name of the currently protected domain (including a wildcard domain name).
* The available **${http_host}** can be used to indicate the currently protected domain name and port.
* For example: **${http_host}/error.html**.
*/
redirectUrl?: pulumi.Input<string>;
/**
* Specifies the region in which to create the WAF domain resource.
* If omitted, the provider-level region will be used. Changing this setting will push a new certificate.
*/
region?: pulumi.Input<string>;
/**
* Specifies an array of origin web servers.
* The server structure is documented below.
*/
servers: pulumi.Input<pulumi.Input<inputs.Waf.DomainServer>[]>;
/**
* Specifies the timeout setting. Only supports one timeout setting.
* The timeoutSettings structure is documented below.
*/
timeoutSettings?: pulumi.Input<inputs.Waf.DomainTimeoutSettings>;
/**
* Specifies the minimum required TLS version. The options include **TLS v1.0**, **TLS v1.1**,
* **TLS v1.2**.
*/
tls?: pulumi.Input<string>;
/**
* Specifies the traffic identifier.
* WAF uses the configurations to identify the malicious client IP address (proxy mode) in the header,
* session in the cookie, and user attribute in the parameter,
* and then triggers the corresponding known attack source rules to block attack sources.
* Only supports one traffic identifier.
* The trafficMark structure is documented below.
*/
trafficMark?: pulumi.Input<inputs.Waf.DomainTrafficMark>;
/**
* Specifies the website name.
* This website name must start with a letter and only letters, digits, underscores (_),
* hyphens (-), colons (:) and periods (.) are allowed.
* The value contains `1` to `128` characters.
* The website name must be unique within this account.
*/
websiteName?: pulumi.Input<string>;
}