feat(cdn): Add support for configuring WAF by matheuspolitano · Pull Request #1372 · stackitcloud/terraform-provider-stackit

matheuspolitano · 2026-04-13T13:30:42Z

Description

https://jira.schwarz/browse/STACKITCDN-723

I want to add support for the waf configuration block in the CDN distribution resource,so that users can programmatically manage security tiers, paranoia levels, and granular rule overrides (Enabled/Disabled/Log-only) via Terraform.

Checklist

Issue was linked above
Code format was applied: make fmt
Examples were added / adjusted (see examples/ directory)
Docs are up-to-date: make generate-docs (will be checked by CI)
Unit tests got implemented or updated
Acceptance tests got implemented or updated (see e.g. here)
Unit tests are passing: make test (will be checked by CI)
No linter issues: make lint (will be checked by CI)

matheuspolitano · 2026-04-13T13:37:03Z

@Fyusel @marceljk Kindly prioritize the review of PR #1333, as the current pull request builds upon those changes.

…ort by name

Co-authored-by: Marcel Jacek <72880145+marceljk@users.noreply.github.com>

marceljk · 2026-04-24T13:45:51Z

@Fyusel @marceljk Kindly prioritize the review of PR #1333, as the current pull request builds upon those changes.

#1333 is merged now. Please rebase this PR

marceljk · 2026-04-24T14:39:58Z

+	// Map WAF Update/Removal
+	if !utils.IsUndefined(configPlanModel.Waf) {
+		var wafModel wafConfig
+		diags := configPlanModel.Waf.As(ctx, &wafModel, basetypes.ObjectAsOptions{})
+		if diags.HasError() {
+			core.LogAndAddError(ctx, &resp.Diagnostics, "Update CDN distribution", "Error mapping WAF config")
+			return
+		}
+		wafPatch := cdnSdk.WafConfigPatch{
+			Mode:                       new(cdnSdk.WafMode(wafModel.Mode.ValueString())),
+			Type:                       new(cdnSdk.WafType(wafModel.Type.ValueString())),
+			AllowedHttpVersions:        getSortedWafList(ctx, wafModel.AllowedHttpVersions),
+			AllowedRequestContentTypes: getSortedWafList(ctx, wafModel.AllowedRequestContentTypes),
+			AllowedHttpMethods:         getSortedWafList(ctx, wafModel.AllowedHttpMethods),
+			EnabledRuleIds:             getSortedWafList(ctx, wafModel.EnabledRuleIds),
+			DisabledRuleIds:            getSortedWafList(ctx, wafModel.DisabledRuleIds),
+			LogOnlyRuleIds:             getSortedWafList(ctx, wafModel.LogOnlyRuleIds),
+			EnabledRuleGroupIds:        getSortedWafList(ctx, wafModel.EnabledRuleGroupIds),
+			DisabledRuleGroupIds:       getSortedWafList(ctx, wafModel.DisabledRuleGroupIds),
+			LogOnlyRuleGroupIds:        getSortedWafList(ctx, wafModel.LogOnlyRuleGroupIds),
+			EnabledRuleCollectionIds:   getSortedWafList(ctx, wafModel.EnabledRuleCollectionIds),
+			DisabledRuleCollectionIds:  getSortedWafList(ctx, wafModel.DisabledRuleCollectionIds),
+			LogOnlyRuleCollectionIds:   getSortedWafList(ctx, wafModel.LogOnlyRuleCollectionIds),
+		}
+		if !utils.IsUndefined(wafModel.ParanoiaLevel) {
+			pl := cdnSdk.WafParanoiaLevel(wafModel.ParanoiaLevel.ValueString())
+			wafPatch.ParanoiaLevel = &pl
+		}
+		configPatch.Waf = &wafPatch
+	} else if !utils.IsUndefined(configStateModel.Waf) {
+		// User explicitly removed the WAF block from their terraform configuration
+		modeDisabled := cdnSdk.WafMode(cdnSdk.WAFMODE_DISABLED)
+		typeFree := cdnSdk.WafType(cdnSdk.WAFTYPE_FREE)
+
+		wafPatch := cdnSdk.WafConfigPatch{
+			Mode: &modeDisabled,
+			Type: &typeFree,
+			// Send empty arrays to clear rules, keeping the API happy
+			EnabledRuleIds:            []string{},
+			DisabledRuleIds:           []string{},
+			LogOnlyRuleIds:            []string{},
+			EnabledRuleGroupIds:       []string{},
+			DisabledRuleGroupIds:      []string{},
+			LogOnlyRuleGroupIds:       []string{},
+			EnabledRuleCollectionIds:  []string{},
+			DisabledRuleCollectionIds: []string{},
+			LogOnlyRuleCollectionIds:  []string{},
+			// Intentionally omitted (nil) to avoid the 422 Unprocessable Entity error:
+			// AllowedHttpVersions, AllowedRequestContentTypes, AllowedHttpMethods
+		}
+		configPatch.Waf = &wafPatch
+	}


Why do you need the state here? Is it needed to set WAFMODE_DISABLED or can configPatch.Waf set to null to remove it?

Nevertheless, I think you can check here also configPlanModel.Waf.IsNull() instead of !utils.IsUndefined(configStateModel.Waf) and would have the same outcome but without the need accessing the state

We are no longer persisting states once the WAF is removed, it is only disabled and change the type to free a pushed the API

But for this you don't need the state. You can just set WafConfigPatch always to mode=disabled and type=free, when in the terraform config nothing related to Waf is defined.

Then you can remove the added stateModel and revert all renamings from Model -> PlanModel. I would actually prefer to avoid here, handling the state and config model, because this can lead in the future to issue when someone mixes them. And this resource is already really big.

…ment-configuring-waf

marceljk · 2026-05-04T14:53:12Z

+func SortedStringsToListValue(items []string) basetypes.ListValue {
+	if len(items) == 0 {


Suggested change

func SortedStringsToListValue(items []string) basetypes.ListValue {

if len(items) == 0 {

func SortedStringsToListValue(items []string) basetypes.ListValue {

if items == nil {

return types.ListNull(types.StringType)

}

if len(items) == 0 {

I would return here a null list in case the string slice is also null. null list != empty list
This will also need some adjustment to the tests

marceljk · 2026-05-04T15:12:46Z

+							"mode": schema.StringAttribute{
+								Required:    true,
+								Description: schemaDescriptions["waf_mode"],
+								Validators:  []validator.String{stringvalidator.OneOf(string(cdnSdk.WAFMODE_DISABLED), string(cdnSdk.WAFMODE_ENABLED), string(cdnSdk.WAFMODE_LOG_ONLY))},


We have in our SDK also a slice with all the enum. Use it here instead of referencing each enum by hand

Suggested change

Validators: []validator.String{stringvalidator.OneOf(string(cdnSdk.WAFMODE_DISABLED), string(cdnSdk.WAFMODE_ENABLED), string(cdnSdk.WAFMODE_LOG_ONLY))},

Validators: []validator.String{stringvalidator.OneOf(sdkUtils.EnumSliceToStringSlice(cdnSdk.AllowedWafModeEnumValues)...)},

marceljk · 2026-05-04T15:12:54Z

+							"type": schema.StringAttribute{
+								Required:    true,
+								Description: schemaDescriptions["waf_type"],
+								Validators:  []validator.String{stringvalidator.OneOf(string(cdnSdk.WAFTYPE_PREMIUM), string(cdnSdk.WAFTYPE_FREE))},


marceljk · 2026-05-04T15:13:01Z

+							"paranoia_level": schema.StringAttribute{
+								Optional:    true,
+								Description: schemaDescriptions["waf_paranoia_level"],
+								Validators:  []validator.String{stringvalidator.OneOf(string(cdnSdk.WAFPARANOIALEVEL_L1), string(cdnSdk.WAFPARANOIALEVEL_L2), string(cdnSdk.WAFPARANOIALEVEL_L3), string(cdnSdk.WAFPARANOIALEVEL_L4))},


marceljk · 2026-05-04T15:23:39Z

+	// Map WAF Update/Removal
+	if !utils.IsUndefined(configPlanModel.Waf) {
+		var wafModel wafConfig
+		diags := configPlanModel.Waf.As(ctx, &wafModel, basetypes.ObjectAsOptions{})
+		if diags.HasError() {
+			core.LogAndAddError(ctx, &resp.Diagnostics, "Update CDN distribution", "Error mapping WAF config")
+			return
+		}
+		wafPatch := cdnSdk.WafConfigPatch{
+			Mode:                       new(cdnSdk.WafMode(wafModel.Mode.ValueString())),
+			Type:                       new(cdnSdk.WafType(wafModel.Type.ValueString())),
+			AllowedHttpVersions:        getSortedWafList(ctx, wafModel.AllowedHttpVersions),
+			AllowedRequestContentTypes: getSortedWafList(ctx, wafModel.AllowedRequestContentTypes),
+			AllowedHttpMethods:         getSortedWafList(ctx, wafModel.AllowedHttpMethods),
+			EnabledRuleIds:             getSortedWafList(ctx, wafModel.EnabledRuleIds),
+			DisabledRuleIds:            getSortedWafList(ctx, wafModel.DisabledRuleIds),
+			LogOnlyRuleIds:             getSortedWafList(ctx, wafModel.LogOnlyRuleIds),
+			EnabledRuleGroupIds:        getSortedWafList(ctx, wafModel.EnabledRuleGroupIds),
+			DisabledRuleGroupIds:       getSortedWafList(ctx, wafModel.DisabledRuleGroupIds),
+			LogOnlyRuleGroupIds:        getSortedWafList(ctx, wafModel.LogOnlyRuleGroupIds),
+			EnabledRuleCollectionIds:   getSortedWafList(ctx, wafModel.EnabledRuleCollectionIds),
+			DisabledRuleCollectionIds:  getSortedWafList(ctx, wafModel.DisabledRuleCollectionIds),
+			LogOnlyRuleCollectionIds:   getSortedWafList(ctx, wafModel.LogOnlyRuleCollectionIds),
+		}
+		if !utils.IsUndefined(wafModel.ParanoiaLevel) {
+			pl := cdnSdk.WafParanoiaLevel(wafModel.ParanoiaLevel.ValueString())
+			wafPatch.ParanoiaLevel = &pl
+		}
+		configPatch.Waf = &wafPatch
+	} else if !utils.IsUndefined(configStateModel.Waf) {
+		// User explicitly removed the WAF block from their terraform configuration
+		modeDisabled := cdnSdk.WafMode(cdnSdk.WAFMODE_DISABLED)
+		typeFree := cdnSdk.WafType(cdnSdk.WAFTYPE_FREE)
+
+		wafPatch := cdnSdk.WafConfigPatch{
+			Mode: &modeDisabled,
+			Type: &typeFree,
+			// Send empty arrays to clear rules, keeping the API happy
+			EnabledRuleIds:            []string{},
+			DisabledRuleIds:           []string{},
+			LogOnlyRuleIds:            []string{},
+			EnabledRuleGroupIds:       []string{},
+			DisabledRuleGroupIds:      []string{},
+			LogOnlyRuleGroupIds:       []string{},
+			EnabledRuleCollectionIds:  []string{},
+			DisabledRuleCollectionIds: []string{},
+			LogOnlyRuleCollectionIds:  []string{},
+			// Intentionally omitted (nil) to avoid the 422 Unprocessable Entity error:
+			// AllowedHttpVersions, AllowedRequestContentTypes, AllowedHttpMethods
+		}
+		configPatch.Waf = &wafPatch
+	}


But for this you don't need the state. You can just set WafConfigPatch always to mode=disabled and type=free, when in the terraform config nothing related to Waf is defined.

Then you can remove the added stateModel and revert all renamings from Model -> PlanModel. I would actually prefer to avoid here, handling the state and config model, because this can lead in the future to issue when someone mixes them. And this resource is already really big.

Matheus Politano and others added 25 commits March 26, 2026 17:49

feat: add redirects in convertConfig

7c989aa

feat: add redirect in toCreatePayload

7cca33f

feat: add redirect in the update function

e850a14

feat: add in the map field mapfield

cf6f255

small fix and add datasource

72d079c

chore: update doc

cafad57

chore: add resource example

f2bcc1b

Merge branch 'main' into mp/cdn/feat/implement-redirects

a5f9f48

chore: add redirect in acc test and address linter issues

9addaea

chore: address linter issue

618c3a2

chore: add doc

9a22cef

Merge branch 'main' into mp/cdn/feat/implement-redirects

83c4b94

Merge branch 'main' into mp/cdn/feat/implement-redirects

6d30d9b

chore: adjust for the new sdk version

cf12967

chore: implement new sdk in cdn_acc_test

45905c6

Merge branch 'main' into mp/cdn/feat/implement-redirects

92dfd6f

Merge branch 'main' into mp/cdn/feat/implement-redirects

9ccd292

Merge branch 'main' into mp/cdn/feat/implement-redirects

56f3e9c

feat: add waf in resource

23d6bd9

feat: add waf in datasource

731fb3f

fix acc test

162d0d8

feat: improve waf to avoid state drift

bd94faa

fyi: run fmt and fix linter issues

312cca0

feat: add doc and improve descriptions

a15c7f7

fyi: improve some validations and description

d3929ad

matheuspolitano requested a review from a team as a code owner April 13, 2026 13:30

matheuspolitano changed the title ~~Mp/cdn/feat/implement configuring waf~~ feat(cdn): Add support for configuring WAF Apr 13, 2026

Matheus Politano added 2 commits April 13, 2026 15:49

fyi: add checks in acc_test

100d9f6

FYI: add all field in acc_test

7f5e08d

Matheus Politano and others added 3 commits April 23, 2026 16:10

chore: remove redundant string in acc_test

633ac4f

Merge branch 'stackitcloud:main' into mp/cdn/feat/implement-redirects

ec7f0d5

chore: remove empty line at the end of the function and order acc imp…

4cc4b60

…ort by name

Manuelvaas added has internal tracking issue and removed Stale PR is marked as stale due to inactivity. labels Apr 23, 2026

matheuspolitano and others added 5 commits April 24, 2026 09:50

feat: remove the case insensitive

43ad030

Co-authored-by: Marcel Jacek <72880145+marceljk@users.noreply.github.com>

feat: add validation to no null values

e1ee94f

Co-authored-by: Marcel Jacek <72880145+marceljk@users.noreply.github.com>

chore: remove redundant code

be8a32e

fix: add redirecttype

0d3507a

chore: change the all matcho dondition to all

6c1b069

Fyusel reviewed Apr 24, 2026

View reviewed changes

Comment thread docs/data-sources/cdn_distribution.md Outdated

Comment thread docs/data-sources/cdn_distribution.md Outdated

Comment thread docs/resources/cdn_distribution.md Outdated

Comment thread stackit/internal/services/cdn/distribution/resource.go

Matheus Politano and others added 4 commits April 24, 2026 11:15

feat: make match condition sensitive

e93dcb2

Merge branch 'main' into mp/cdn/feat/implement-redirects

c308a6c

chore: remove portuguese comment

e8d4324

chore: switch to all ALL

d8448a1

marceljk reviewed Apr 24, 2026

View reviewed changes

Comment thread stackit/internal/services/cdn/distribution/resource.go

marceljk reviewed Apr 24, 2026

View reviewed changes

Comment thread stackit/internal/services/cdn/distribution/resource.go Outdated

marceljk reviewed Apr 24, 2026

View reviewed changes

Matheus Politano and others added 10 commits April 29, 2026 16:13

Merge branch 'mp/cdn/feat/implement-redirects' into mp/cdn/feat/imple…

4657841

…ment-configuring-waf

Merge branch 'main' into mp/cdn/feat/implement-configuring-waf

100fa6e

chore: create SortedStringToListVale in conversion

7d99d21

chore: improve the documentations

3c4cf95

chore: improve cdn waf documentation

c3c37c9

chore: cdn remove the default value

72ddf6c

chore: improve waf

1fdf69f

chore: update docs

9dc726c

Merge branch 'main' into mp/cdn/feat/implement-configuring-waf

a6f9afe

chore: update doc

4b3a312

marceljk reviewed May 4, 2026

View reviewed changes

		func SortedStringsToListValue(items []string) basetypes.ListValue {
		if len(items) == 0 {

	Validators: []validator.String{stringvalidator.OneOf(string(cdnSdk.WAFMODE_DISABLED), string(cdnSdk.WAFMODE_ENABLED), string(cdnSdk.WAFMODE_LOG_ONLY))},
	Validators: []validator.String{stringvalidator.OneOf(sdkUtils.EnumSliceToStringSlice(cdnSdk.AllowedWafModeEnumValues)...)},

Conversation

matheuspolitano commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Checklist

Uh oh!

matheuspolitano commented Apr 13, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

marceljk commented Apr 24, 2026

Uh oh!

Uh oh!

Uh oh!

marceljk Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

matheuspolitano May 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

marceljk May 4, 2026

Choose a reason for hiding this comment

Uh oh!

marceljk May 4, 2026

Choose a reason for hiding this comment

Uh oh!

marceljk May 4, 2026

Choose a reason for hiding this comment

Uh oh!

marceljk May 4, 2026

Choose a reason for hiding this comment

Uh oh!

marceljk May 4, 2026

Choose a reason for hiding this comment

Uh oh!

marceljk May 4, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

matheuspolitano commented Apr 13, 2026 •

edited

Loading

matheuspolitano May 4, 2026 •

edited

Loading