Scan file uploads with an AI Inference firewall function

Create a function that sends an uploaded file to a model through AI Inference, and run it on a firewall so a malicious upload never reaches the origin.

Last updated

View as Markdown Agent setup

You can scan an upload with a model and deny a malicious file, from Azion Console. The function runs on Firewall and calls the model through AI Inference. For the design this page builds, refer to Screen file uploads for malicious content.

Prerequisites

  • An Azion account. To create one, refer to How to create an account on Azion.
  • A firewall with the Functions module turned on. For what a function does on a firewall, refer to Functions for Firewall.
  • A domain associated to that firewall, so the upload traffic reaches it.
  • The upload routes to protect, such as /upload or /documents/upload.

Create the firewall function

A function runs on a firewall when it registers a firewall handler. This one reads the request body, sends it to the model, and applies the verdict in the same request. To create it:

Open the Functions page

Access Azion Console > Products Menu > Libraries > Functions.

Select + Function
Name the function

Enter a unique, descriptive name for the function.

Paste the code in the Code tab

In the Code tab, paste the function below.

Paste the arguments in the Arguments tab

In the Arguments tab, paste the JSON below.

Select Save

The Code tab takes this function:

JavaScript
01async function handleRequest(event) {
02 try {
03 const requestBody = await event.request.text();
04 const { model, action, prompt } = event.args;
05 const contentType = event.request.headers.get("content-type");
06
07 // Allows images
08 if (contentType && contentType.startsWith("image/")) {
09 event.continue();
10 return;
11 }
12
13 // Decodes the content if it's base64
14 const decodedBody = contentType && contentType.includes("base64")
15 ? atob(requestBody.split(",")[1])
16 : requestBody;
17
18 // Calls the model via Azion.AI.run
19 const modelResponse = await Azion.AI.run(model, {
20 stream: false,
21 seed: 42,
22 temperature: 0,
23 max_tokens: 1024,
24 messages: [
25 {
26 role: "system",
27 content: `${prompt}`
28 },
29 {
30 role: "user",
31 content: decodedBody
32 }
33 ]
34 });
35
36 // Extracts the model's response
37 const result = modelResponse?.choices?.[0]?.message?.content?.trim();
38
39 if (result === "true") {
40 event.console.warn(`[AI] ${result}`);
41 event[action]();
42 return;
43 }
44 } catch (err) {
45 event.console.error("Error handling request:", err.message);
46 event.continue();
47 return;
48 }
49
50 event.continue(); // If not malicious, let it pass
51}
52
53addEventListener("firewall", event => {
54 event.waitUntil(handleRequest(event));
55});

The Arguments tab takes this JSON:

JSON
01{
02 "model": "casperhansen-mistral-small-24b-instruct-2501-awq",
03 "prompt": "You are a security assistant specialized in detecting malicious PDF files. Analyze the provided content carefully and return 'true' only if you identify malicious content, such as embedded scripts, suspicious patterns, or known vulnerabilities. Do not classify a file as malicious based solely on its structure or the presence of a PDF header. If the content is safe or does not contain clear malicious indicators, return 'false'. Do not provide any additional explanation or output.",
04 "action": "deny"
05}

The function is saved and available to instantiate on a firewall.

The function reads the request body and lets an image content type through untouched. It decodes base64 content, sends it to the model with the prompt from the arguments, and applies the action. The action, deny in this example, runs only when the model answers true. On any error, the function logs the message and lets the request continue.

The arguments select Mistral 3 Small, whose id is casperhansen-mistral-small-24b-instruct-2501-awq. Make sure the model you choose is available and configured in your account. For every id you can pass, refer to AI models.

The handler runs on Functions. For every field Azion.AI.run accepts, refer to Model invocation. For what happens after the call, refer to How AI Inference works.

Enable the firewall modules

The function runs on a firewall, and a firewall runs a function only when its Functions module is on. To prepare the firewall:

Open the Firewall page

In Azion Console, go to Products Menu > Firewall.

Select the firewall that secures the upload routes
Turn on the modules the design needs

In the Main Settings tab, turn on the DDoS Protection, Functions, Network Shield, and Web Application Firewall modules.

Select Save

The firewall now runs the modules this design depends on, and it can hold a function instance.

Instantiate the function on the firewall

A function instance binds the function to one firewall. To create the instance:

Go to the Functions Instances tab
Select + Function Instance
Enter a name for the instance
Select the function you created
Select Save

The instance appears in the Functions Instances tab. It does not run until a Rules Engine rule selects it.

Add the rule that runs the function

A Rules Engine rule sets the criteria that trigger the instance. To run it on the uploads your application receives:

Go to the Rules Engine tab
Select + Rule
Enter a name for the rule
Select the Request URI variable

In the Criteria section, select the Request URI variable.

Set the comparison operator to starts with
Enter the upload route

Enter an upload route as the argument, such as /upload.

Select Run Function

In the Behaviors section, select Run Function.

Select the instance you created
Select Save

The rule runs the function on every request whose URI starts with that route. A file the model calls malicious is denied before the origin receives it. Changes can take a few minutes to propagate. Wait before you send an upload that matches the criteria.

Monitor and tune the policy

A model decides what the policy blocks, so its record is the only way to check it. Watch these signals in Real-Time Metrics and Real-Time Events:

  • The rate of uploads blocked, allowed, and quarantined.
  • Patterns by country, IP, ASN, route, and time.
  • Events correlated with the security incidents your team reports.

Then tune the policy against what you read:

  • The prompt in the Arguments tab, which sets how strictly the model answers.
  • Whether a suspect upload is denied or held for review in Object Storage.
  • The Web Application Firewall and Network Shield rules on the same firewall.
  • The volume the function sends to the model, within AI Inference limits.
  • The false positives and false negatives your analysts label, fed back into the prompt.

The signals show what the function decided, and each adjustment changes what the next reading shows.

Next steps

Screen file uploads for malicious contentThe design this page builds, with its dataflow and the components it puts in the request path.AI Inference best practicesThe decisions the function takes before the call: the model id, the input it sends, and how it reads the response.