Bind a rule set in azion.config.js

Declare the WAF rule set and the firewall rule that applies it in azion.config.js, so the Azion CLI creates both from the repository.

Last updated

View as Markdown Agent setup

You can declare a WAF rule set and the firewall rule that applies it in azion.config.js, and let the Azion CLI create both from the file. Both then live in the repository, under review alongside the application they protect.

Prerequisites

You need the Azion CLI installed and a configured personal token.

Declare the rule set and the rule

In azion.config.js, declare the firewall with waf: true, the rule that carries the setWafRuleset behavior, and the rule set under waf:

JavaScript
01import { defineConfig } from 'azion';
02
03export default defineConfig({
04 firewall: {
05 name: 'storefront-firewall',
06 active: true,
07 waf: true,
08 rules: [
09 {
10 name: 'Apply storefront-waf',
11 active: true,
12 criteria: [
13 {
14 variable: 'request_uri',
15 conditional: 'if',
16 operator: 'starts_with',
17 argument: '/',
18 },
19 ],
20 behaviors: [
21 {
22 setWafRuleset: {
23 wafMode: 'blocking',
24 wafId: '<waf-id>',
25 },
26 },
27 ],
28 },
29 ],
30 },
31 waf: [
32 {
33 name: 'storefront-waf',
34 engineSettings: {
35 engineVersion: '2021-Q3',
36 type: 'score',
37 attributes: {
38 rulesets: [1],
39 thresholds: [
40 { threat: 'sql_injection', sensitivity: 'medium' },
41 { threat: 'cross_site_scripting', sensitivity: 'medium' },
42 ],
43 },
44 },
45 },
46 ],
47});

The Azion CLI reads the file and creates what it declares: the firewall with WAF turned on, the rule set, and the rule that applies it.

waf: true on the firewall turns WAF on, and it stays off until you turn it on. A family you leave out of thresholds is not configured, so list every family you want scored. setWafRuleset takes exactly two keys, wafMode and wafId. wafMode takes learning or blocking in this file: the same mode reads Logging in Azion Console and logging in an API payload. For what each mode does, refer to Scoring and modes.

Next steps

Apply a rule set to every requestThe same binding as an API call, with the response it returns.azion.config.jsEvery field this file accepts, including the firewall behaviors a rule can carry.