WebApplicationFirewallCustomRule - Missing Rate Limit Parameters

[mstrisoline]

Hello!

• Vote on this issue by adding a 👍 reaction
• If you want to implement this feature, comment to let us know (we'll work with you on design, scheduling, etc.)

I am happy to help implement this feature, but I requires some guidance on the proper way to implement this.

Issue details

Azure Front Door supports a Web Application Firewall. Current implementation does not support the ability to define Rate Limit Rules via Pulumi.

Our current problem is we define both Rate Limit and Match rules. We are looking to migrate this functionality over to the Azure Native provider off of the Azure Core provider.

Affected area/feature

• https://www.pulumi.com/registry/packages/azure-native/api-docs/network/webapplicationfirewallpolicy/#webapplicationfirewallcustomrule
• https://www.pulumi.com/registry/packages/azure-native/api-docs/network/webapplicationfirewallpolicy/#webapplicationfirewallruletype

This does not support the RateLimit Rule Type

https://docs.microsoft.com/en-us/rest/api/frontdoorservice/webapplicationfirewall/policies/create-or-update#customrule

It should support the two following parameters

Parameter	Type	Description
rateLimitDurationInMinutes	integer	Time window for resetting the rate limit count. Default is 1 minute.
rateLimitThreshold	integer	Number of allowed requests per client within the time window.

The WebApplicationFirewallRuleType also needs to be updated to support RateLimitRule

[mikhailshilkov]

Thank you for raising this issue.

I think it's extremely confusing but ARM defines two resource endpoints that are almost the same but not exactly the same:

/subscriptions/{}/resourceGroups/{}/providers/Microsoft.Network/FrontDoorWebApplicationFirewallPolicies/{}
/subscriptions/{}/resourceGroups/{}/providers/Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies/{}

Correspondingly, we define two resources (using the names as they are defined in ARM operation IDs): Policy and WebApplicationFirewallPolicy. The former has rateLimitDurationInMinutes and rateLimitThreshold defined.

Based on the API doc that you linked and the properties that you need, I believe you should switch over to Policy.

[mstrisoline]

Thank you for the update. Going to try and build this out with Policy I will follow up after testing.

[mstrisoline]

@mikhailshilkov Thank you for pointing me in the right direction. Switching to use Policy worked.