Azion CLI firewall-instance

Azion CLI commands that create, list, describe, update, and delete function instances on a firewall, with every flag, its type, and its default.

Last updated

View as Markdown Agent setup

The Azion CLI firewall-instance commands create, list, describe, update, and delete function instances on a firewall. An instance binds one function to one firewall and holds the arguments the function receives there. The options every command accepts, such as --format, --out, and -y, are on Global options.

Create

azion create firewall-instance creates a function instance on the firewall you name:

azion create firewall-instance [flags]
FlagShortTypeDefaultDescription
--active—string"true"Whether the instance is active: true or false.
--args—string—Path to a JSON file with the arguments the function receives on this instance.
--file—string—Path to a JSON file with the attributes of the instance. Use - to read the JSON from standard input.
--firewall-id—int—ID of the firewall that holds the instance.
--function-id—int—Required unless --file is set. ID of the function the instance runs. Without it, the command asks ? Enter the Function's ID:.
--name—string—Name of the instance.

This command creates an instance named my-firewall-instance of the function with ID 12370 on the firewall with ID 12353, with the arguments in args.json:

azion create firewall-instance --firewall-id 12353 --function-id 12370 --name my-firewall-instance --args ./args.json

The command prints the ID of the instance:

Created Firewall Function Instance with ID 12355

List

azion list firewall-instance lists the function instances of a firewall, 50 to a page:

azion list firewall-instance [flags]
FlagShortTypeDefaultDescription
--details———Adds the LAST EDITOR and LAST MODIFIED columns to the ID, NAME, ACTIVE, and FUNCTION columns.
--filter—string—Name to filter the list by.
--firewall-id—int—ID of the firewall whose instances to list.
--order-by—string—Field to sort the list by.
--page—int1Number of the page to return.
--page-size—int50Number of instances on each page.

This command lists the instances of the firewall with ID 12353:

azion list firewall-instance --firewall-id 12353

The command prints one row per instance. The FUNCTION column holds the ID of the function each instance runs:

Text
01ID NAME ACTIVE FUNCTION
0212355 my-firewall-instance true 12370
0312356 my-file-instance true 12370

Describe

azion describe firewall-instance prints the settings of one function instance:

azion describe firewall-instance [flags]
FlagShortTypeDefaultDescription
--firewall-id—int—ID of the firewall that holds the instance.
--instance-id—int—ID of the instance to describe.

This command describes the instance with ID 12355 on the firewall with ID 12353:

azion describe firewall-instance --firewall-id 12353 --instance-id 12355

The command prints the ID, the name, and the function of the instance, and who changed it last and when:

Text
01ID: 12355
02Name: my-firewall-instance
03Function: 12370
04Last Editor: you@example.com
05Last Modified: "2026-01-01T12:00:00.276936Z"

With --format json, the command prints the full object: active, args, azion_form, created_at, function, id, last_editor, last_modified, and name. The args object holds the arguments that --args or the JSON file set, and function holds the ID of the function.

An instance ID that does not exist on the firewall fails with Error: failed to describe the Firewall Function Instance: The given ID or API's endpoint doesn't exist or isn't available. Check that the identifying information is correct.

Update

azion update firewall-instance changes the attributes of a function instance:

azion update firewall-instance [flags]
FlagShortTypeDefaultDescription
--active—string"true"Whether the instance is active: true or false.
--args—string—Path to a JSON file with the arguments the function receives on this instance.
--file—string—Path to a JSON file with the attributes to change. Use - to read the JSON from standard input.
--firewall-id—int—ID of the firewall that holds the instance.
--function-id—int—ID of the function the instance runs.
--instance-id—int—ID of the instance to update.
--name—string—New name of the instance.

An instance cannot be turned off. With --active false, the command fails with this error:

Error: failed to update the Firewall Function Instance: ["You can't deactivate a function instance."]

This command renames the instance with ID 12355 to my-firewall-instance-renamed:

azion update firewall-instance --firewall-id 12353 --instance-id 12355 --name my-firewall-instance-renamed

The command prints the ID of the updated instance. The arguments of the instance keep their values:

Updated Firewall Function Instance with ID 12355

Delete

azion delete firewall-instance deletes a function instance from a firewall:

azion delete firewall-instance [flags]
FlagShortTypeDefaultDescription
--firewall-id—int—ID of the firewall that holds the instance.
--instance-id—int—ID of the instance to delete.

This command deletes the instance with ID 12356 from the firewall with ID 12353:

azion delete firewall-instance --firewall-id 12353 --instance-id 12356 -y

The command confirms the deletion:

Firewall Function Instance 12356 was successfully deleted

Use a JSON file

azion create firewall-instance and azion update firewall-instance read the attributes of the instance from a JSON file with --file. Pass --firewall-id on the command line in both cases.

This file creates an active instance named my-file-instance of the function with ID 12370, with no arguments. Because the file carries function, --function-id is not needed:

JSON
01{
02 "name": "my-file-instance",
03 "function": 12370,
04 "active": true,
05 "args": {}
06}

Pass the file to the create command:

azion create firewall-instance --firewall-id 12353 --file fwi-create.json

The command prints the ID of the instance:

Created Firewall Function Instance with ID 12356

On update, pass --instance-id as well. This file renames the instance and replaces its arguments:

JSON
01{
02 "name": "my-file-instance-updated",
03 "args": {"mode": "updated"}
04}

Pass the file to the update command:

azion update firewall-instance --firewall-id 12353 --instance-id 12356 --file fwi-update.json

The command prints the ID of the updated instance:

Updated Firewall Function Instance with ID 12356

The update is partial: a field the file leaves out, such as active, keeps its value.

Global options

The options every command accepts, such as --format, --out, and -y.

Function instances for Firewall

What an instance holds and how its arguments reach the function.

Azion CLI function

The commands that create the function an instance runs and print its ID.

Azion CLI firewall-rule

The commands that create the rules that run an instance on a firewall.