A Zone WAF Whose Managed Rulesets Actually Execute
A paid plan makes the Cloudflare Managed Ruleset and the OWASP Core Ruleset available; a zone runs them only when a rule in the managed phase executes them, so a subscribed zone with no such rule is protected by the free ruleset alone. Both executed here with the OWASP threshold set, custom rules that block rather than log, and a per-client rate limit in its own phase.
Verification
Static-verifiedPassed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).
Conformance
- Static validation (fmt · validate · tflint)
- No applicable security policies for this provider
- Plan tests (mocked: validation rules · outputs)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live test pending (no cloud run yet)
Last verified 2026-09-14 · how we verify
Use it from the registry
terraform · opentofumodule "waf" {
source = "www.iac-bazaar.com/iac-bazaar/cloudflare-waf/cloudflare"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
cloudflare-waf
Cloudflare WAF on a zone: the managed ruleset actually deployed, custom
rules that block, and a rate limit. Works with Terraform and OpenTofu
(>= 1.6), cloudflare provider >= 5.0, < 6.0.
The managed ruleset is not deployed until a rule executes it. A zone
with a WAF subscription and no execute rule runs only the free ruleset.
The Cloudflare Managed Ruleset and the OWASP Core Ruleset are both executed
here; going without the managed one needs accept_no_managed_ruleset.
action = "log" is detection. Log-only custom rules need
accept_log_only_rules and are counted.
The OWASP ruleset needs a threshold, set through the override; medium by default.
Rate limiting is a separate phase; one rule when a limit is given.
Verification
Static validation runs tofu fmt, init, validate, tflint and checkov.
This module has not yet had a live test, so it is published as statically
validated with its live test pending and does not carry the live-tested mark.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage
Related modules
cloudflare-turnstile
The widget secret is the whole check: whoever holds it mints passing verifications for your forms; domains is an allow list of hostnames, so a widget made for production does not render on staging until staging is listed; and the mode decides whether visitors see a checkbox, a spinner or nothing. Hostnames required, the mode validated, and the secret exposed only as a sensitive output.
cloudflare-bot-management
Bot Fight Mode is zone-wide with no path exclusion and no allow list: it challenges CI runners, monitoring, mobile apps and every API client that worked yesterday. Off unless accepted by name, Super Bot Fight Mode with an action per class on paid plans (challenge the definitely automated, admit the rest), AI crawlers blocked, and an output that says whether API clients will be challenged.
cloudflare-zero-trust-access
Access application with policies, identity provider wiring, and a cloudflared tunnel to private origins.
cloudflare-zone-hardening
ssl = flexible encrypts the visitor's half and speaks plain HTTP to the origin while showing a padlock; DNSSEC is off until turned on at Cloudflare and again at the registrar; and TLS 1.0, HTTP without redirect and no HSTS are the defaults. Strict SSL with weaker modes accepted by name, TLS 1.2 minimum, HTTPS forced, HSTS (preload by name), DNSSEC on with the DS record exposed.
azure-waf-policy
Detection mode evaluates every rule, logs every match and forwards every request - the dashboard fills with blocked-looking entries while the backend receives them all. Prevention by default, Detection only by name. A policy attached to no listener protects nothing, so the attached listeners are an output; every exclusion is a hole and has to carry a reason.
oci-waf
CHECK is the action that evaluates the rule, logs the match and lets the request through - the console shows the protection rules and every matched attack reached the backend. BLOCK by default, DETECT only by name. The policy and the firewall binding it to a load balancer are separate resources; both are created, and a policy alone has to be asked for.