Microsoft.Cdn profiles/securityPolicies 2024-02-01

Bicep resource definition

The profiles/securityPolicies resource type can be deployed with operations that target:

Resource groups - See resource group deployment commands

For a list of changed properties in each API version, see change log.

Usage Examples

Bicep Samples

A basic example of deploying Front Door (standard/premium) Security Policy.

param resourceName string = 'acctest0001'
param location string = 'westeurope'

resource profile 'Microsoft.Cdn/profiles@2021-06-01' = {
  name: resourceName
  location: 'global'
  sku: {
    name: 'Premium_AzureFrontDoor'
  }
  properties: {
    originResponseTimeoutSeconds: 120
  }
}

resource securityPolicy 'Microsoft.Cdn/profiles/securityPolicies@2021-06-01' = {
  name: resourceName
  parent: profile
  properties: {
    parameters: {
      associations: [
        {
          domains: [
            {
              id: customDomain.id
            }
          ]
          patternsToMatch: [
            '/*'
          ]
        }
      ]
      type: 'WebApplicationFirewall'
      wafPolicy: {
        id: frontDoorWebApplicationFirewallPolicy.id
      }
    }
  }
}

resource frontDoorWebApplicationFirewallPolicy 'Microsoft.Network/FrontDoorWebApplicationFirewallPolicies@2020-11-01' = {
  name: resourceName
  location: 'global'
  sku: {
    name: 'Premium_AzureFrontDoor'
  }
  properties: {
    customRules: {
      rules: [
        {
          action: 'Block'
          enabledState: 'Enabled'
          matchConditions: [
            {
              matchValue: [
                '192.168.1.0/24'
                '10.0.0.0/24'
              ]
              matchVariable: 'RemoteAddr'
              negateCondition: false
              operator: 'IPMatch'
            }
          ]
          name: 'Rule1'
          priority: 1
          rateLimitDurationInMinutes: 1
          rateLimitThreshold: 10
          ruleType: 'MatchRule'
        }
      ]
    }
    managedRules: {
      managedRuleSets: [
        {
          ruleGroupOverrides: [
            {
              ruleGroupName: 'PHP'
              rules: [
                {
                  action: 'Block'
                  enabledState: 'Disabled'
                  ruleId: '933111'
                }
              ]
            }
          ]
          ruleSetAction: 'Block'
          ruleSetType: 'DefaultRuleSet'
          ruleSetVersion: 'preview-0.1'
        }
        {
          ruleSetAction: 'Block'
          ruleSetType: 'BotProtection'
          ruleSetVersion: 'preview-0.1'
        }
      ]
    }
    policySettings: {
      customBlockResponseBody: 'PGh0bWw+CjxoZWFkZXI+PHRpdGxlPkhlbGxvPC90aXRsZT48L2hlYWRlcj4KPGJvZHk+CkhlbGxvIHdvcmxkCjwvYm9keT4KPC9odG1sPg=='
      customBlockResponseStatusCode: 403
      enabledState: 'Enabled'
      mode: 'Prevention'
      redirectUrl: 'https://www.fabrikam.com'
    }
  }
}

resource dnsZone 'Microsoft.Network/dnsZones@2018-05-01' = {
  name: '${resourceName}.com'
  location: 'global'
}

resource customDomain 'Microsoft.Cdn/profiles/customDomains@2021-06-01' = {
  name: resourceName
  parent: profile
  properties: {
    azureDnsZone: {
      id: dnsZone.id
    }
    hostName: 'fabrikam.${resourceName}.com'
    tlsSettings: {
      certificateType: 'ManagedCertificate'
      minimumTlsVersion: 'TLS12'
    }
  }
}

Azure Quickstart Samples

The following Azure Quickstart templates contain Bicep samples for deploying this resource type.

Bicep File	Description
Front Door Premium with blob origin and Private Link	This template creates a Front Door Premium and an Azure Storage blob container, and uses a private endpoint for Front Door to send traffic to the storage account.
Front Door Premium with WAF and Microsoft-managed rule sets	This template creates a Front Door Premium including a web application firewall with the Microsoft-managed default and bot protection rule sets.
Front Door Standard/Premium with geo-filtering	This template creates a Front Door Standard/Premium including a web application firewall with a geo-filtering rule.
Front Door Standard/Premium with rate limit	This template creates a Front Door Standard/Premium including a web application firewall with a rate limit rule.
Front Door Standard/Premium with WAF and custom rule	This template creates a Front Door Standard/Premium including a web application firewall with a custom rule.
Front Door with blob origins for blobs upload	This template creates a Front Door with origins, routes and ruleSets, and an Azure Storage accounts with blob containers. Front Door sends traffic to the storage accounts when uploading files.
FrontDoor CDN with WAF, Domains and Logs to EventHub	This template creates a new Azure FrontDoor cdn profile. Create WAF with custom and managed rules, cdn routes, origin and groups with their association with WAF and routes, configures custom domains, create event hub and diagnostic settings for sending CDN access logs using event hub.
Function App secured by Azure Frontdoor	This template allows you to deploy an azure premium function protected and published by Azure Frontdoor premium. The conenction between Azure Frontdoor and Azure Functions is protected by Azure Private Link.

Resource format

To create a Microsoft.Cdn/profiles/securityPolicies resource, add the following Bicep to your template.

resource symbolicname 'Microsoft.Cdn/profiles/securityPolicies@2024-02-01' = {
  parent: resourceSymbolicName
  name: 'string'
  properties: {
    parameters: {
      type: 'string'
      // For remaining properties, see SecurityPolicyPropertiesParameters objects
    }
  }
}

SecurityPolicyPropertiesParameters objects

Set the type property to specify the type of object.

For WebApplicationFirewall, use:

{
  associations: [
    {
      domains: [
        {
          id: 'string'
        }
      ]
      patternsToMatch: [
        'string'
      ]
    }
  ]
  type: 'WebApplicationFirewall'
  wafPolicy: {
    id: 'string'
  }
}

Property Values