导航|地址|刷新
WAF custom rules configuration using Ter…

Skip to contentDocumentation Index
Fetch the complete documentation index at: https://developers.cloudflare.com/terraform/llms.txt
Use this file to discover all available pages before exploring further.

Docs Directory API SDKs Changelog

Search

Log in

Terraform

/

Overview

Get started

Tutorials

Overview

1 – Initialize Terraform

2 – Track your history

3 – Configure HTTPS settings

4 – Improve performance

5 – Add exceptions with Page Rules

6 – Revert configuration

Additional configurations

WAF Managed Rules

DDoS managed rulesets

Rate limiting rules

WAF custom rules

Transform Rules

Single Redirects ↗

Bulk Redirects ↗

Configuration Rules ↗

Origin Rules ↗

Cache Rules ↗

Snippets ↗

Workers ↗

How-to guides

Create a partial zone

Create a subdomain zone

Advanced topics

Best practices

Import Cloudflare resources

Provider customization

Remote R2 backend

Troubleshooting

Create DNS records error

Rule IDs change when making updates

Agent resources

Agent setup ↗

Cloudflare Skills ↗

Code Mode MCP Server ↗

Domain-specific MCP Servers ↗MCP

Terraform llms.txt ↗

Terraform llms-full.txt ↗

Cloudflare Docs llms.txt ↗

Cloudflare Docs llms-full.txt ↗

Home

/Terraform

/Additional configurations

/WAF custom rules

WAF custom rules configuration using Terraform

Last updated Apr 29, 2026|Copy as Markdown|View as Markdown|Agent setup

OverviewBefore you start Obtain the necessary account or zone IDs Import or delete existing rulesetsAdd a custom rule to a zoneCreate and deploy a custom rulesetMore resources

This page provides examples of creating WAF custom rules in a zone or account using Terraform. The examples cover the following scenarios:

Add a custom rule to a zone

Create and deploy a custom ruleset

The WAF documentation includes additional Terraform examples — refer to More resources.

If you are using the Cloudflare API, refer to the following resources in the WAF documentation:

Create a custom rule via API

Create a custom ruleset using the API

For more information on deploying and configuring custom rulesets using the Rulesets API, refer to Work with custom rulesets in the Ruleset Engine documentation.

Before you start

Obtain the necessary account or zone IDs

The Terraform configurations provided in this page need the zone ID (or account ID) of the zone/account where you will deploy rulesets.

To retrieve the list of accounts you have access to, including their IDs, use the List accounts operation.

To retrieve the list of zones you have access to, including their IDs, use the List zones operation.

Import or delete existing rulesets

Terraform assumes that it has complete control over account and zone rulesets. If you already have rulesets configured in your account or zone, do one of the following:

Import existing rulesets to Terraform using the cf-terraforming tool. Recent versions of the tool can generate resource definitions for existing rulesets and import their configuration to Terraform state.

Start from scratch by deleting existing rulesets (account and zone rulesets with "kind": "root" and "kind": "zone", respectively) and then defining your rulesets configuration in Terraform.

------

Add a custom rule to a zone

The following example configures a custom rule in the zone entry point ruleset for the http_request_firewall_custom phase for zone with ID <ZONE_ID>. The rule will block all traffic on non-standard HTTP(S) ports:

Required API token permissions

At least one of the following token permissions is required:

Zone WAF Write

Configure the cloudflare_ruleset ↗ resource:
resource "cloudflare_ruleset" "zone_custom_firewall" { zone_id = var.cloudflare_zone_id name = "Phase entry point ruleset for custom rules in my zone" description = "" kind = "zone" phase = "http_request_firewall_custom" rules = [{ ref = "block_non_default_ports" description = "Block ports other than 80 and 443" expression = "(not cf.edge.server_port in {80 443})" action = "block" }]}

resource "cloudflare_ruleset" "zone_custom_firewall" { zone_id = "<ZONE_ID>" name = "Phase entry point ruleset for custom rules in my zone" description = "" kind = "zone" phase = "http_request_firewall_custom" rules { ref = "block_non_default_ports" description = "Block ports other than 80 and 443" expression = "(not cf.edge.server_port in {80 443})" action = "block" }}
To create another custom rule, add a new rules object to the same cloudflare_ruleset resource.

Create and deploy a custom ruleset

Note

All customers can create custom rulesets at the zone level.
Custom rulesets at the account level require an Enterprise plan with a paid add-on.

The following example creates a custom ruleset in the account with ID <ACCOUNT_ID> containing a single custom rule. This custom ruleset is then deployed using a separate cloudflare_ruleset Terraform resource. If you do not deploy a custom ruleset, it will not execute.

The following configuration creates a custom ruleset with a single rule:

Required API token permissions

All of the following token permissions are required:

Account WAF Write

Account Rulesets Write

Configure the cloudflare_ruleset ↗ resource:
resource "cloudflare_ruleset" "account_firewall_custom_ruleset" { account_id = var.cloudflare_account_id name = "Custom ruleset blocking traffic in non-standard HTTP(S) ports" description = "" kind = "custom" phase = "http_request_firewall_custom" rules = [{ ref = "block_non_default_ports" description = "Block ports other than 80 and 443" expression = "(not cf.edge.server_port in {80 443})" action = "block" }]}

resource "cloudflare_ruleset" "account_firewall_custom_ruleset" { account_id = "<ACCOUNT_ID>" name = "Custom ruleset blocking traffic in non-standard HTTP(S) ports" description = "" kind = "custom" phase = "http_request_firewall_custom" rules { ref = "block_non_default_ports" description = "Block ports other than 80 and 443" expression = "(not cf.edge.server_port in {80 443})" action = "block" }}
To create another custom rule in the custom ruleset, add a new rules object to the same cloudflare_ruleset resource.

The following configuration deploys the custom ruleset at the account level. It defines a dependency on the account_firewall_custom_ruleset resource and uses the ID of the created custom ruleset in action_parameters:

Required API token permissions

All of the following token permissions are required:

Account WAF Write

Account Rulesets Write

Configure the cloudflare_ruleset ↗ resource:
resource "cloudflare_ruleset" "account_firewall_custom_entrypoint" { account_id = var.cloudflare_account_id name = "Account-level entry point ruleset for the http_request_firewall_custom phase deploying a custom ruleset" description = "" kind = "root" phase = "http_request_firewall_custom" depends_on = [cloudflare_ruleset.account_firewall_custom_ruleset] rules = [{ ref = "deploy_custom_ruleset_example_com" description = "Deploy custom ruleset for example.com" expression = "(cf.zone.name eq \"example.com\") and (cf.zone.plan eq \"ENT\")" action = "execute" action_parameters = { id = cloudflare_ruleset.account_firewall_custom_ruleset.id } }]}

resource "cloudflare_ruleset" "account_firewall_custom_entrypoint" { account_id = "<ACCOUNT_ID>" name = "Account-level entry point ruleset for the http_request_firewall_custom phase deploying a custom ruleset" description = "" kind = "root" phase = "http_request_firewall_custom" depends_on = [cloudflare_ruleset.account_firewall_custom_ruleset] rules { ref = "deploy_custom_ruleset_example_com" description = "Deploy custom ruleset for example.com" expression = "(cf.zone.name eq \"example.com\") and (cf.zone.plan eq \"ENT\")" action = "execute" action_parameters { id = cloudflare_ruleset.account_firewall_custom_ruleset.id } }}

For more information on configuring and deploying custom rulesets, refer to Work with custom rulesets in the Ruleset Engine documentation.

More resources

Malicious uploads detection: Add a custom rule to block malicious uploads

Leaked credentials detection: Add a custom rule to challenge requests with leaked credentials

PreviousRate limiting rules NextTransform Rules

Was this helpful?

YesNo

Edit page Report issue

On this page

Overview

Before you start

Obtain the necessary account or zone IDs

Import or delete existing rulesets

Add a custom rule to a zone

Create and deploy a custom ruleset

More resources

Edit page Report issue

Getting started
Plans Contact sales Partners Find a partnerStartupsUnder attack?Domain name search

Company
AboutCareersInvestorsPressPress kitGlobal network

Public interest
Project GalileoAthenian ProjectCloudflare for CampaignsProject FairshotImpact/ESG

Compliance
Compliance resourcesTrust HubData ProtectionResponsible AITransparency reportReport abuse

Resources
App innovation reportCloudflare RadarCase studiesStatusSupportEventsBlog

Developers
DocumentationLearning centerCommunity

Solutions
SSE and SASE platformCloudflare AI CloudAI SecurityFrontend Development PlatformMulti-Tenant Platform DevelopmentWeb Security Platform

Start BuildingLog In

© 2026 Cloudflare, Inc.

Privacy policy|Report security issues|Terms of use|Trademark
|
Your privacy choices

Docs

------
导航页打开网址