Adding a WAF exclusion rule

With Terraform, you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.

Terraform is distributed under the Business Source License. The Yandex Cloud provider for Terraform is distributed under the MPL-2.0 license.

For more information about the provider resources, see the guides on the Terraform website or its mirror.

If you do not have Terraform yet, install it and configure the Yandex Cloud provider.

To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), authenticate using the appropriate method.

1. Open the Terraform configuration file and edit the yandex_sws_waf_profile description: add the exclusion_rule section with a WAF exclusion rule.

   # WAF profile
   resource "yandex_sws_waf_profile" "default" {
     name = "waf-profile-default"
     core_rule_set {
       inbound_anomaly_score = 2
       paranoia_level        = local.waf_paranoia_level
       rule_set {
         name    = "OWASP Core Ruleset"
         version = "4.0.0"
       }
     }
   
     ...
   
     # Exclusion rule
     exclusion_rule {
       name = "<exclusion_rule_name>"
       condition {
         source_ip {
           ip_ranges_match {
             ip_ranges = [
               "<IP_address_range_1>",
               "<IP_address_range_2>",
               ...
               "<IP_address_range_n>"
             ]
           }
           ip_ranges_not_match {
             ip_ranges = [
               "<IP_address_range_3>",
               "<IP_address_range_4>",
               ...
               "<IP_address_range_y>"
             ]
           }
         }
       }
   
       exclude_rules {
         exclude_all = <true_or_false>
         rule_ids    = [
           "rule_ID_1",
           "rule_ID_2",
           ...
           "rule_ID_n",
         ]
       }
     }
   }
   

   Where:

   • exclusion_rule:

     • name: Exclusion rule name.

     • condition: Conditions for the exception rule to trigger. The above example uses a condition based on the traffic source IP address.

       Under condition, you can specify multiple different condition types at the same time.

     • exclude_rules: Exclusion rule settings:

       • exclude_all: Exclusion will apply to all rules. It can be either false or true.
       • rule_ids: List of IDs of rules from the basic set to which the exclusion will apply. To specify individual rules, set exclude_all to false.

   For more on the properties of the sws_waf_profile resource, see this provider guide.

2. Create the resources:

   1. In the terminal, navigate to the configuration file directory.

   2. Make sure the configuration is correct using this command:

      terraform validate
      

      If the configuration is valid, you will get this message:

      Success! The configuration is valid.
      

   3. Run this command:

      terraform plan
      

      You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.

   4. Apply the configuration changes:

      terraform apply
      

   5. Type yes and press Enter to confirm the changes.

You can check the resource update in the management console.

Use the update REST API method for the WafProfile resource or the WafProfile/Update gRPC API call.