Cloudflare.Ruleset reference

AccountEntrypoint

Source: src/Cloudflare/Ruleset/AccountEntrypoint.ts

A Cloudflare Ruleset phase entrypoint for an account.

The account-level counterpart of Cloudflare.Ruleset.Ruleset: it owns the entire ruleset for an account phase entrypoint (e.g. deploying custom WAF rulesets across zones with execute rules, or configuring ddos_l4 / magic_transit rules). The entrypoint is a per-phase singleton — destroy empties its rules rather than deleting the phase.

Account-level phases require an Enterprise plan; on lower plans deploys fail with the typed PhaseNotEntitled error.

AccountEntrypoint: Account WAF Deployment

const ruleset = yield* Cloudflare.Ruleset.CustomRuleset("SharedWafRules", {
  phase: "http_request_firewall_custom",
  rules: [
    {
      description: "Block exploit probes",
      expression: `lower(http.request.uri.path) contains "/.env"`,
      action: "block",
    },
  ],
});

yield* Cloudflare.Ruleset.AccountEntrypoint("WafDeployment", {
  phase: "http_request_firewall_custom",
  rules: [
    {
      description: "Deploy shared WAF rules",
      expression: "true",
      action: "execute",
      actionParameters: { id: ruleset.rulesetId },
    },
  ],
});

CustomRuleset

Source: src/Cloudflare/Ruleset/CustomRuleset.ts

A standalone account-level Cloudflare ruleset (kind: "custom").

Custom rulesets are the Enterprise WAF deployment workflow: define a reusable ruleset once at the account level, then deploy it across zones with an execute rule in a phase entrypoint (see Cloudflare.Ruleset.AccountEntrypoint). Account-level WAF phases require an Enterprise plan — on lower plans, creation fails with the typed PhaseNotEntitled error.

For zone-level rules, use Cloudflare.Ruleset.Ruleset (the zone phase entrypoint) instead.

CustomRuleset: Custom Rulesets

Define an account custom WAF ruleset

const ruleset = yield* Cloudflare.Ruleset.CustomRuleset("SharedWafRules", {
  phase: "http_request_firewall_custom",
  description: "Org-wide exploit probes",
  rules: [
    {
      description: "Block .env probes",
      expression: `lower(http.request.uri.path) contains "/.env"`,
      action: "block",
    },
  ],
});

Deploy the custom ruleset via the account entrypoint

yield* Cloudflare.Ruleset.AccountEntrypoint("WafDeployment", {
  phase: "http_request_firewall_custom",
  rules: [
    {
      description: "Deploy shared WAF rules everywhere",
      expression: "true",
      action: "execute",
      actionParameters: { id: ruleset.rulesetId },
    },
  ],
});

Ruleset

Source: src/Cloudflare/Ruleset/Ruleset.ts

A Cloudflare Ruleset phase entrypoint for a zone.

This resource owns the entire ruleset for a phase entrypoint. Rules managed elsewhere in the same phase can be overwritten on deploy.

Ruleset: WAF Rules

const zone = yield* Cloudflare.Zone.Zone("MyZone", { name: "example.com" });
const waf = yield* Cloudflare.Ruleset.Ruleset("WafRules", {
  zone,
  phase: "http_request_firewall_custom",
  rules: [
    {
      description: "Block exploit probes",
      expression: `lower(http.request.uri.path) contains "/.env"`,
      action: "block",
    },
  ],
});