<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Cloud WAF Rules — API Reference

## AWS WAF v2 CLI

```bash
# List Web ACLs
aws wafv2 list-web-acls --scope REGIONAL

# Get Web ACL details
aws wafv2 get-web-acl --name NAME --scope REGIONAL --id ID

# List available managed rule groups
aws wafv2 list-available-managed-rule-groups --scope REGIONAL

# Create IP set
aws wafv2 create-ip-set --name NAME --scope REGIONAL --ip-address-version IPV4 --addresses CIDR

# Get sampled requests
aws wafv2 get-sampled-requests --web-acl-arn ARN --rule-metric-name METRIC \
  --scope REGIONAL --time-window '{"StartTime":"START","EndTime":"END"}' --max-items 100

# WAF logging
aws wafv2 put-logging-configuration --logging-configuration '{"ResourceArn":"ACL_ARN","LogDestinationConfigs":["S3_ARN"]}'
aws wafv2 get-logging-configuration --resource-arn ACL_ARN
```

## Azure Front Door WAF CLI

```bash
# Create WAF policy
az network front-door waf-policy create -g RG -n NAME --mode Prevention

# Add managed ruleset
az network front-door waf-policy managed-rules add -g RG --policy-name NAME --type Microsoft_DefaultRuleSet --version 2.1

# Add custom rule
az network front-door waf-policy rule create -g RG --policy-name NAME --name RULE --priority 100 --action Block --rule-type MatchRule

# List rules
az network front-door waf-policy rule list -g RG --policy-name NAME
```

## GCP Cloud Armor CLI

```bash
# Create security policy
gcloud compute security-policies create NAME

# Add preconfigured WAF rule
gcloud compute security-policies rules create PRIORITY --security-policy NAME \
  --action deny-403 --expression "evaluatePreconfiguredExpr('sqli-v33-stable')"

# Rate limiting rule
gcloud compute security-policies rules create PRIORITY --security-policy NAME \
  --action throttle --expression "true" \
  --rate-limit-threshold-count 100 --rate-limit-threshold-interval-sec 60

# List rules
gcloud compute security-policies rules list --security-policy NAME

# Describe policy
gcloud compute security-policies describe NAME
```

## Key Managed Rule Sets

| Provider | Rule Set | Coverage |
|----------|----------|----------|
| AWS | AWSManagedRulesCommonRuleSet | OWASP core |
| AWS | AWSManagedRulesSQLiRuleSet | SQL injection |
| AWS | AWSManagedRulesKnownBadInputsRuleSet | Log4j, etc |
| AWS | AWSManagedRulesBotControlRuleSet | Bot mitigation |
| Azure | Microsoft_DefaultRuleSet 2.1 | OWASP 3.2 |
| Azure | Microsoft_BotManagerRuleSet | Bot detection |
| GCP | sqli-v33-stable | SQL injection |
| GCP | xss-v33-stable | Cross-site scripting |
| GCP | lfi-v33-stable | Local file inclusion |
