Application Gateway WAF Custom Rules

Question

Hi,

There are a lot of online examples however I am looking for something quite specific that works for my use case but cannot find anything online (after trawling the web for some time) that matches (some close examples but also contradictory information).

I already have a Web application firewall (application gateway) setup and simply want a set of Powershell commands (similar to the below) to allow access request to a specific URL (specific not broad for security reasons).

This seems pretty straight forward via the GUI in Azure however would not be easily transferable in IaC so looking for examples from the community.

Thanks!

Answer 1

Hello ,

Welcome to MS Q&A

Here’s a PowerShell example that mirrors the style of your existing script but targets a specific URL path:

# Define the match variable for RequestUri
$matchVariable = New-AzApplicationGatewayFirewallMatchVariable -VariableName RequestUri

# Create a condition to match the specific URL path
$condition = New-AzApplicationGatewayFirewallCondition `
    -MatchVariable $matchVariable `
    -Operator Equals `
    -MatchValue "/specific-path" `
    -TransformLowercase `
    -NegationCondition $false

# Create a custom rule to allow traffic to that path
$allowRule = New-AzApplicationGatewayFirewallCustomRule `
    -Name "AllowSpecificPath" `
    -Priority 1 `
    -RuleType MatchRule `
    -MatchCondition $condition `
    -Action Allow

# Optional: Define WAF policy settings
$policySetting = New-AzApplicationGatewayFirewallPolicySetting -Mode "Prevention"

# Apply the rule to your existing WAF policy
Set-AzApplicationGatewayFirewallPolicy `
    -Name "WafPolicy" `
    -ResourceGroupName "<rgname>" `
    -Location "<location>" `
    -CustomRule $allowRule `
    -PolicySetting $policySetting

Replace "/specific-path" with the exact path you want to allow.

Ref link -->https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/per-site-policies

Pls let us know if further ques

Kindly accept answer if it helps

Thanks

Deepanshu