WAF Managed Rules configuration using Te·续

WAF Managed Rules configuration using Te·续

resource "cloudflare_ruleset" "zone_level_managed_waf" {
  # (...)

# Skip execution of the entire Cloudflare Managed Ruleset for specific URLs
  rules {
    ref         = "skip_cloudflare_managed_ruleset_example_com"
    description = "Skip Cloudflare Managed Ruleset"
    expression  = "(http.request.uri.path eq \"/status\" and http.request.uri.query contains \"skip=rulesets\")"
    action      = "skip"
    action_parameters {
      rulesets = ["efb7b8c949ac4650a09736fc376e9aee"]
    }
  }

# Skip execution of two rules in the Cloudflare Managed Ruleset for specific URLs
  rules {
    ref         = "skip_wordpress_sqli_rules_example_com"
    description = "Skip WordPress and SQLi rules"
    expression  = "(http.request.uri.path eq \"/status\" and http.request.uri.query contains \"skip=rules\")"
    action      = "skip"
    action_parameters {
      rules = {
        # Format: "<RULESET_ID>" = "<RULE_ID_1>,<RULE_ID_2>,..."
        "efb7b8c949ac4650a09736fc376e9aee" = "5de7edfa648c4d6891dc3e7f84534ffa,e3a567afc347477d9702d9047e97d760"
      }
    }
  }

# Execute Cloudflare Managed Ruleset
  rules {
    ref         = "execute_cloudflare_managed_ruleset"
    description = "Execute Cloudflare Managed Ruleset on my zone-level phase entry point ruleset"
    expression  = "true"
    action      = "execute"
    action_parameters {
      id = "efb7b8c949ac4650a09736fc376e9aee"
    }
  }

# (...)
}

Important

Ensure that you place the exceptions before the rule that executes the managed ruleset (or some of its rules) that you wish to skip, as in the previous example.

Configure overrides

The following example adds three overrides for the Cloudflare Managed Ruleset:

A rule override for rule with ID 5de7edfa648c4d6891dc3e7f84534ffa setting the action to log.
A rule override for rule with ID 75a0060762034a6cb663fd51a02344cb disabling the rule.
A tag override for the wordpress tag, setting the action of all the rules with this tag to js_challenge.

Important

Ruleset overrides and tag overrides apply to both existing and future rules in the managed ruleset. If you want to override existing rules only, you must use rule overrides.

The following configuration includes the three overrides in the rule that executes the Cloudflare Managed Ruleset:

  # (...)

# Execute Cloudflare Managed Ruleset
  rules = [{
    ref         = "execute_cloudflare_managed_ruleset"
    description = "Execute Cloudflare Managed Ruleset on my zone-level phase entry point ruleset"
    expression  = "true"
    action      = "execute"
    action_parameters = {
      id = "efb7b8c949ac4650a09736fc376e9aee"
      overrides = {
        rules = [
          {
            id      = "5de7edfa648c4d6891dc3e7f84534ffa"
            action  = "log"
            enabled = true
          },
          {
            id      = "75a0060762034a6cb663fd51a02344cb"
            enabled = false
          },
        ]
        categories = [{
          category = "wordpress"
          action   = "js_challenge"
          enabled  = true
        }]
      }
    }
  }]

# (...)

  # (...)

# Execute Cloudflare Managed Ruleset
  rules {
    ref         = "execute_cloudflare_managed_ruleset"
    description = "Execute Cloudflare Managed Ruleset on my zone-level phase entry point ruleset"
    expression  = "true"
    action      = "execute"
    action_parameters {
      id = "efb7b8c949ac4650a09736fc376e9aee"
      overrides {
        rules {
          id      = "5de7edfa648c4d6891dc3e7f84534ffa"
          action  = "log"
          enabled = true
        }
        rules {
          id      = "75a0060762034a6cb663fd51a02344cb"
          enabled = false
        }
        categories {
          category = "wordpress"
          action   = "js_challenge"
          enabled  = true
        }
      }
    }
  }

# (...)

Configure payload logging

This example enables payload logging for matched rules of the Cloudflare Managed Ruleset, setting the public key used to encrypt the logged payload.

Building upon the rule that deploys the Cloudflare Managed Ruleset, the following rule configuration adds the matched_data object with the public key used to encrypt the payload:

  # (...)

# Execute Cloudflare Managed Ruleset
  rules = [{
    ref         = "execute_cloudflare_managed_ruleset"
    description = "Execute Cloudflare Managed Ruleset on my zone-level phase entry point ruleset"
    expression  = "true"
    action      = "execute"
    action_parameters = {
      id = "efb7b8c949ac4650a09736fc376e9aee"
      matched_data = {
        public_key = "Ycig/Zr/pZmklmFUN99nr+taURlYItL91g+NcHGYpB8="
      }
    }
  }]

# (...)

  # (...)

# Execute Cloudflare Managed Ruleset
  rules {
    ref         = "execute_cloudflare_managed_ruleset"
    description = "Execute Cloudflare Managed Ruleset on my zone-level phase entry point ruleset"
    expression  = "true"
    action      = "execute"
    action_parameters {
      id = "efb7b8c949ac4650a09736fc376e9aee"
      matched_data {
         public_key = "Ycig/Zr/pZmklmFUN99nr+taURlYItL91g+NcHGYpB8="
      }
    }
  }

# (...)

Configure the OWASP paranoia level, score threshold, and action

The OWASP managed ruleset supports the following configurations:

Enable all the rules up to a specific paranoia level by creating tag overrides that disable all the rules associated with higher paranoia levels.
Set the action to perform when the calculated threat score is greater than the score threshold by creating a rule override for the last rule in the Cloudflare OWASP Core Ruleset (rule with ID ...843b323c), and including the action property.
Set the score threshold by creating a rule override for the last rule in the Cloudflare OWASP Core Ruleset (rule with ID ...843b323c), and including the score_threshold property.

For more information on the available configuration values, refer to the Cloudflare OWASP Core Ruleset page in the WAF documentation.

The following example rule of a cloudflare_ruleset Terraform resource performs the following configuration:

Deploys the OWASP managed ruleset.
Sets the OWASP paranoia level to PL2.
Sets the score threshold to 60 (Low).
Sets the ruleset action to log.

  # (...)

# Execute Cloudflare OWASP Core Ruleset
  rules = [{
    ref         = "execute_owasp_core_ruleset"
    description = "Execute Cloudflare OWASP Core Ruleset"
    expression  = "true"
    action      = "execute"
    action_parameters = {
      id = "4814384a9e5d4991b9815dcfc25d2f1f"
      overrides = {
        # By default, all PL1 to PL4 rules are enabled.
        # Set the paranoia level to PL2 by disabling rules with
        # tags "paranoia-level-3" and "paranoia-level-4".
        categories = [
          {
            category = "paranoia-level-3"
            enabled  = false
          },
          {
            category = "paranoia-level-4"
            enabled  = false
          },
        ]
        rules = [{
          id              = "6179ae15870a4bb7b2d480d4843b323c"
          action          = "log"
          score_threshold = 60
        }]
      }
    }
  }]

# (...)

  # (...)

# Execute Cloudflare OWASP Core Ruleset
  rules {
    ref         = "execute_owasp_core_ruleset"
    description = "Execute Cloudflare OWASP Core Ruleset"
    expression  = "true"
    action      = "execute"
    action_parameters {
      id = "4814384a9e5d4991b9815dcfc25d2f1f"
      overrides {
        # By default, all PL1 to PL4 rules are enabled.
        # Set the paranoia level to PL2 by disabling rules with
        # tags "paranoia-level-3" and "paranoia-level-4".
        categories {
          category = "paranoia-level-3"
          enabled  = false
        }
        categories {
          category = "paranoia-level-4"
          enabled  = false
        }
        rules {
          id              = "6179ae15870a4bb7b2d480d4843b323c"
          action          = "log"
          score_threshold = 60
        }
      }
    }
  }

# (...)

Was this helpful?

YesNo

{"@context":"https://schema.org","@type":"TechArticle","@id":"https://developers.cloudflare.com/terraform/additional-configurations/waf-managed-rulesets/#page","headline":"WAF Managed Rules configuration using Terraform","description":"Deploy and configure Cloudflare WAF Managed Rules at the zone or account level using Terraform.","url":"https://developers.cloudflare.com/terraform/additional-configurations/waf-managed-rulesets/","inLanguage":"en","image":"https://developers.cloudflare.com/terraform/additional-configurations/waf-managed-rulesets/og.png?v=1918dd36b28e849d","dateModified":"2026-04-29","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}}

description: Log the request content that triggered a managed ruleset match. title: Log the payload of matched rules image: https://developers.cloudflare.com/waf/managed-rules/payload-logging/og.png?v=df94312cd06d567c

Documentation Index
Fetch the complete documentation index at: https://developers.cloudflare.com/waf/llms.txt
Use this file to discover all available pages before exploring further.

WAF Managed Rules configuration using Te·续

WAF Managed Rules configuration using Te·续

Configure overrides

Configure payload logging

Configure the OWASP paranoia level, score threshold, and action

On this page