Add Azure Front Door (AFD) Web Application Firewall Policy

[proyVolt]

Hello!

• Vote on this issue by adding a 👍 reaction
• If you want to implement this feature, comment to let us know (we'll work with you on design, scheduling, etc.)

Issue details

The pulumi-azure-native provider has resources to create a firewall policy (Microsoft.Network/firewallPolicies) and a web application firewall policy (Microsoft.Network/ApplicationGatewayWebApplicationFirewallPolicies), but it currently doesn't have anything to create a front door (AFD) web application firewall policy (Microsoft.Network/frontdoorwebapplicationfirewallpolicies)

The terraform provider-based azure-native already has this resource, but there are some issues with allowed enum values:

azure:frontdoor/firewallPolicy:FirewallPolicy resource 'myPolicy' has a problem: expected managed_rule.0.override.0.rule.3.action to be one of [Allow Block Log Redirect], got AnomalyScoring. Examine values at 'FirewallPolicy.ManagedRules[0].Override[0].Rule[3].Action'.

Which I suspect are due to pinned versions of resources from the go-azure-sdk in the underlying terraform provider

For those who are looking into this issue please note that there are multiple azure products called front door. There is Azure Front Door (referred to as classic), and a completely separate product Azure Front Door (referred to as AFD). This issue is specifically requesting attention for the AFD web application firewall policy.

Affected area/feature

[kpitzen]

Hi @proyVolt - It does seem that you're correct that this specific FirewallPolicy resource is not currently supported by Azure Native. I've looked into the spec and can't find an obvious reason why (the Azure API specifies PUT and DELETE operations properly) so we'll investigate and see what changes need to be made to support this. Thank you!

[mikhailshilkov]

I believe this resource is available. However, it's confusingly called just Policy: https://www.pulumi.com/registry/packages/azure-native/api-docs/network/policy/

Here is our internal view on which endpoint it uses:

The Network resource provider is super confusing, that's why I think https://github.com/pulumi/pulumi-azure-native/issues/690 is a good idea.

Anyway, @proyVolt could you give it a try?

I'll let @kpitzen define any follow-ups here.

[proyVolt]

I will give it a shot and reply back asap, thanks.