DDoS managed rulesets configuration usin·续
- On this page

DDoS managed rulesets configuration usin·续

The order of the rules is important: the rule with the highest sensitivity level must come after the rule with the lowest sensitivity level, otherwise it will never be evaluated.

Important considerations

When a DDoS attack mitigation is ongoing, Cloudflare will check the rules order and apply the first one that matches both the expression and the sensitivity level.
Since rules are evaluated in order and the first one to match the conditions of both the expression and the sensitivity level will get applied, take care when editing and reordering existing rules. Changing a rule from Block to Log may allow attack traffic to reach your web property.
Overrides will not affect read-only rules in the managed ruleset.

Required API token permissions

</summary>

At least one of the following <a href="https://developers.cloudflare.com/fundamentals/api/reference/permissions/">token permissions</a> is required:

<code>HTTP DDoS Managed Ruleset Write</code>

</details>

Configure the cloudflare_ruleset ↗︎ resource:

resource "cloudflare_ruleset" "zone_level_http_ddos_config" {
  zone_id     = var.cloudflare_zone_id
  name        = "HTTP DDoS - Terraform managed"
  description = ""
  kind        = "zone"
  phase       = "ddos_l7"

# The resource configuration contains two rules:
  #  1. The first rule has the lowest sensitivity level (highest threshold)
  #     and it will block attacks.
  #  2. The second rule has a higher sensitivity level (lower threshold) and
  #     will only apply a Log action.
  #
  # In practice, evaluation stops whenever a rule matches both the expression
  # and the threshold, so the rule order is important:
  #   - When the traffic rate is below the (low) threshold of the default
  #     sensitivity level ('High'), no rules match (no action is applied).
  #   - When the traffic rate is between the thresholds of the 'Low' and
  #     default ('High') sensitivity levels, the first rule does not match,
  #     but the second rule does (traffic gets logged).
  #   - When the traffic rate goes above the (high) threshold of the 'Low'
  #     sensitivity level, the first rule matches (traffic gets blocked).
  #
  # The DDoS protection systems will still apply mitigation actions to incoming
  # traffic when rates exceed the threshold of the _Essentially Off_ sensitivity
  # level.

rules = [
    {
      ref         = "l7_ddos_block_traffic_low_threshold"
      description = "At the low sensitivity threshold, block the traffic"
      expression  = "true"
      action      = "execute"
      action_parameters = {
        # Cloudflare L7 DDoS Attack Protection Ruleset
        id = "4d21379b4f9f4bb088e0729962c8b3cf"
        overrides = {
          rules = [
            {
              # Rule: HTTP requests from known botnet (signature #4).
              id                = "29d170ba2f004cc787b1ac272c9e04e7"
              sensitivity_level = "low"
              action            = "block"
            },
            {
              # Rule: HTTP requests with unusual HTTP headers or URI path (signature #16).
              id                = "60a48054bbcf4014ac63c44f1712a123"
              sensitivity_level = "low"
              action            = "block"
            },
          ]
        }
      }
    },
    {
      ref         = "l7_ddos_log_default_threshold"
      description = "At the default sensitivity threshold, log to see if any legitimate traffic gets caught"
      expression  = "true"
      action      = "execute"
      action_parameters = {
        # Cloudflare L7 DDoS Attack Protection Ruleset
        id = "4d21379b4f9f4bb088e0729962c8b3cf"
        overrides = {
          rules = [
            {
              # Rule: HTTP requests from known botnet (signature #4).
              id                = "29d170ba2f004cc787b1ac272c9e04e7"
              sensitivity_level = "default"
              action            = "log"
            },
            {
              # Rule: HTTP requests with unusual HTTP headers or URI path (signature #16).
              id                = "60a48054bbcf4014ac63c44f1712a123"
              sensitivity_level = "default"
              action            = "log"
            },
          ]
        }
      }
    },
  ]
}

variable "zone_id" {
  default = "<ZONE_ID>"
}

resource "cloudflare_ruleset" "zone_level_http_ddos_config" {
  zone_id     = var.zone_id
  name        = "HTTP DDoS - Terraform managed"
  description = ""
  kind        = "zone"
  phase       = "ddos_l7"

# The resource configuration contains two rules:
  #  1. The first rule has the lowest sensitivity level (highest threshold)
  #     and it will block attacks.
  #  2. The second rule has a higher sensitivity level (lower threshold) and
  #     will only apply a Log action.
  #
  # In practice, evaluation stops whenever a rule matches both the expression
  # and the threshold, so the rule order is important:
  #   - When the traffic rate is below the (low) threshold of the default
  #     sensitivity level ('High'), no rules match (no action is applied).
  #   - When the traffic rate is between the thresholds of the 'Low' and
  #     default ('High') sensitivity levels, the first rule does not match,
  #     but the second rule does (traffic gets logged).
  #   - When the traffic rate goes above the (high) threshold of the 'Low'
  #     sensitivity level, the first rule matches (traffic gets blocked).
  #
  # The DDoS protection systems will still apply mitigation actions to incoming
  # traffic when rates exceed the threshold of the _Essentially Off_ sensitivity
  # level.

rules {
    ref         = "l7_ddos_block_traffic_low_threshold"
    description = "At the low sensitivity threshold, block the traffic"
    expression  = "true"
    action      = "execute"
    action_parameters {
      # Cloudflare L7 DDoS Attack Protection Ruleset
      id = "4d21379b4f9f4bb088e0729962c8b3cf"
      overrides {
        rules {
          # Rule: HTTP requests from known botnet (signature #4).
          id                = "29d170ba2f004cc787b1ac272c9e04e7"
          sensitivity_level = "low"
          action            = "block"
        }
        rules {
          # Rule: HTTP requests with unusual HTTP headers or URI path (signature #16).
          id                = "60a48054bbcf4014ac63c44f1712a123"
          sensitivity_level = "low"
          action            = "block"
        }
      }
    }
  }

rules {
    ref         = "l7_ddos_log_default_threshold"
    description = "At the default sensitivity threshold, log to see if any legitimate traffic gets caught"
    expression  = "true"
    action      = "execute"
    action_parameters {
      # Cloudflare L7 DDoS Attack Protection Ruleset
      id = "4d21379b4f9f4bb088e0729962c8b3cf"
      overrides {
        rules {
          # Rule: HTTP requests from known botnet (signature #4).
          id                = "29d170ba2f004cc787b1ac272c9e04e7"
          sensitivity_level = "default"
          action            = "log"
        }
        rules {
          # Rule: HTTP requests with unusual HTTP headers or URI path (signature #16).
          id                = "60a48054bbcf4014ac63c44f1712a123"
          sensitivity_level = "default"
          action            = "log"
        }
      }
    }
  }
}

Was this helpful?

YesNo

{"@context":"https://schema.org","@type":"TechArticle","@id":"https://developers.cloudflare.com/terraform/additional-configurations/ddos-managed-rulesets/#page","headline":"DDoS managed rulesets configuration using Terraform","description":"Configure Cloudflare DDoS managed rulesets at the zone or account level using Terraform.","url":"https://developers.cloudflare.com/terraform/additional-configurations/ddos-managed-rulesets/","inLanguage":"en","image":"https://developers.cloudflare.com/terraform/additional-configurations/ddos-managed-rulesets/og.png?v=a53159cdc459fd5d","dateModified":"2026-04-29","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}}

description: Create Bulk Redirects using the Terraform Cloudflare provider. title: Configure Bulk Redirects using Terraform image: https://developers.cloudflare.com/rules/url-forwarding/bulk-redirects/terraform-example/og.png?v=d3a2b557b6fd590e

Documentation Index
Fetch the complete documentation index at: https://developers.cloudflare.com/rules/llms.txt
Use this file to discover all available pages before exploring further.

DDoS managed rulesets configuration usin·续

DDoS managed rulesets configuration usin·续

On this page