DDoS managed rulesets configuration using Terraform

Last updated Apr 29, 2026 This page provides examples of configuring DDoS managed rulesets in your zone or account using Terraform. It covers the following configurations:

DDoS managed rulesets are always enabled. Depending on your Cloudflare services, you may be able to adjust their behavior.

If you are using the Cloudflare API, refer to the following resources:

For more information on deploying and configuring rulesets using the Rulesets API, refer to Work with managed rulesets in the Ruleset Engine documentation.

Before you start

Obtain the necessary account, zone, and managed ruleset IDs

The Terraform configurations provided in this page need the zone ID (or account ID) of the zone/account where you will deploy the managed rulesets.

  • To retrieve the list of accounts you have access to, including their IDs, use the List accounts operation.
  • To retrieve the list of zones you have access to, including their IDs, use the List zones operation.

The deployment of managed rulesets via Terraform requires that you use the ruleset IDs. To find the IDs of managed rulesets, use the List account rulesets operation. The response will include the description and IDs of existing managed rulesets.

(Optional) Delete existing rulesets to start from scratch

Terraform assumes that it has complete control over account and zone rulesets. If you already have rulesets configured in your account or zone, do one of the following:

  • Import existing rulesets to Terraform using the cf-terraforming tool. Recent versions of the tool can generate resource definitions for existing rulesets and import their configuration to Terraform state.
  • Start from scratch by deleting existing rulesets (account and zone rulesets with "kind": "root" and "kind": "zone", respectively) and then defining your rulesets configuration in Terraform.

Example: Configure HTTP DDoS Attack Protection

This example configures the HTTP DDoS Attack Protection managed ruleset for a zone using Terraform.

<details>

<summary>

Required API token permissions

</summary>

At least one of the following <a href="https://developers.cloudflare.com/fundamentals/api/reference/permissions/">token permissions</a> is required:

  • <code>HTTP DDoS Managed Ruleset Write</code>

</details>

Configure the cloudflare_ruleset ↗︎ resource:

resource "cloudflare_ruleset" "zone_level_http_ddos_config" {
  zone_id     = var.cloudflare_zone_id
  name        = "HTTP DDoS Attack Protection entry point ruleset"
  description = ""
  kind        = "zone"
  phase       = "ddos_l7"

rules = [{
    action = "execute"
    action_parameters = {
      # Cloudflare L7 DDoS Attack Protection Ruleset
      id = "4d21379b4f9f4bb088e0729962c8b3cf"
      overrides = {
        action            = "block"
        sensitivity_level = "default"
        rules = [
          {
            # Adaptive DDoS Protection based on Locations (Available only to Enterprise zones with Advanced DDoS service)
            id                = "a8c6333711ff4b0a81371d1c444be2c3"
            sensitivity_level = "default"
            action            = "managed_challenge"
          },
          {
            # Adaptive DDoS Protection based on User-Agents (Available only to Enterprise zones with Advanced DDoS service)
            id                = "7709d496081e458899c1e3a6e4fe8e55"
            sensitivity_level = "default"
            action            = "managed_challenge"
          },
          {
            # HTTP requests causing a high number of origin errors.
            id                = "dd42da7baabe4e518eaf11c393596a9d"
            sensitivity_level = "default"
            action            = "managed_challenge"
          },
        ]
      }
    }
    expression  = "true"
    description = "Zone-wide HTTP DDoS Override"
    enabled     = true
  }]
}

resource "cloudflare_ruleset" "zone_level_http_ddos_config" {
  zone_id     = "<ZONE_ID>"
  name        = "HTTP DDoS Attack Protection entry point ruleset"
  description = ""
  kind        = "zone"
  phase       = "ddos_l7"

rules {
    action = "execute"
    action_parameters {
      # Cloudflare L7 DDoS Attack Protection Ruleset
      id = "4d21379b4f9f4bb088e0729962c8b3cf"
      overrides {
        action = "block"
        sensitivity_level = "default"
        rules {
          # Adaptive DDoS Protection based on Locations (Available only to Enterprise zones with Advanced DDoS service)
          id = "a8c6333711ff4b0a81371d1c444be2c3"
          sensitivity_level = "default"
          action = "managed_challenge"
        }
        rules {
          # Adaptive DDoS Protection based on User-Agents (Available only to Enterprise zones with Advanced DDoS service)
          id = "7709d496081e458899c1e3a6e4fe8e55"
          sensitivity_level = "default"
          action = "managed_challenge"
        }
        rules {
          # HTTP requests causing a high number of origin errors.
          id = "dd42da7baabe4e518eaf11c393596a9d"
          sensitivity_level = "default"
          action = "managed_challenge"
        }
      }
    }
    expression = "true"
    description = "Zone-wide HTTP DDoS Override"
    enabled = true
  }
}

For more information about HTTP DDoS Attack Protection, refer to HTTP DDoS Attack Protection managed ruleset.

Example: Configure Network-layer DDoS Attack Protection

This example configures the Network-layer DDoS Attack Protection managed ruleset for an account using Terraform, changing the sensitivity level of rule with ID ...e954e98b to low using an override.

Important

  • Only Magic Transit and Spectrum customers on an Enterprise plan can configure this managed ruleset using overrides.
  • This managed ruleset only supports overrides at the account level.

<details>

<summary>

Required API token permissions

</summary>

At least one of the following <a href="https://developers.cloudflare.com/fundamentals/api/reference/permissions/">token permissions</a> is required:

  • <code>L4 DDoS Managed Ruleset Write</code>

</details>

Configure the cloudflare_ruleset ↗︎ resource:

resource "cloudflare_ruleset" "account_level_network_ddos_config" {
  account_id  = var.cloudflare_account_id
  name        = "Network-layer DDoS Attack Protection entry point ruleset"
  description = ""
  kind        = "root"
  phase       = "ddos_l4"

rules = [{
    ref         = "override_l7_ddos_ruleset_dst_ip"
    description = "Override the HTTP DDoS Attack Protection managed ruleset"
    expression  = "ip.dst in { 192.0.2.0/24 }"
    action      = "execute"
    action_parameters = {
      # Cloudflare L3/4 DDoS Attack Protection Ruleset
      id = "3b64149bfa6e4220bbbc2bd6db589552"
      overrides = {
        rules = [{
          # Rule: Generic high-volume UDP traffic flows.
          id                = "599dab0942ff4898ac1b7797e954e98b"
          sensitivity_level = "low"
        }]
      }
    }
  }]
}

resource "cloudflare_ruleset" "account_level_network_ddos_config" {
  account_id  = "<ACCOUNT_ID>"
  name        = "Network-layer DDoS Attack Protection entry point ruleset"
  description = ""
  kind        = "root"
  phase       = "ddos_l4"

rules {
    ref         = "override_l7_ddos_ruleset_dst_ip"
    description = "Override the HTTP DDoS Attack Protection managed ruleset"
    expression  = "ip.dst in { 192.0.2.0/24 }"
    action      = "execute"
    action_parameters {
      # Cloudflare L3/4 DDoS Attack Protection Ruleset
      id = "3b64149bfa6e4220bbbc2bd6db589552"
      overrides {
        rules {
          # Rule: Generic high-volume UDP traffic flows.
          id                = "599dab0942ff4898ac1b7797e954e98b"
          sensitivity_level = "low"
        }
      }
    }
  }
}

For more information about Network-layer DDoS Attack Protection, refer to Network-layer DDoS Attack Protection managed ruleset.

Use case: Mitigate large HTTP DDoS attacks and monitor flagged traffic

In the following example, a customer is concerned about false positives, but wants to get protection against large HTTP DDoS attacks. The two rules, containing two overrides each, in their HTTP DDoS protection configuration will have the following behavior:

  1. Mitigate any large HTTP DDoS attacks by configuring a rule with a Low sensitivity level and a Block action.
  2. Monitor traffic being flagged by the DDoS protection system by configuring a rule with the default sensitivity level (High) and a Log action.