URL protection policy

akamai_appsec_url_protection_policy

📘
Beta
Hello. Just a note to let you know the underlying API on which this resource is built is general release and has been vetted, but because this is a new feature for our Terraform provider, we've given it beta label.
This status just means we've paused for a bit to get your feedback to make sure this resource works like you need and expect.

Update or delete a URL protection policy.

resource "akamai_appsec_url_protection_policy" "my_protection_policy" {
  config_id          = 12345
  name               = "my_protection_policy"
  max_rate_threshold = 50
  hostname_paths = [ {
    hostname = "my-url-protection-policy.com"
    paths = [
      "/*"
      ]
  } ]
}

my_protection_policy = {
  api_definitions = null,
  bypass_conditions = null,
  config_id = 12345,
  create_date = "2026-03-19T15:22:28Z",
  created_by = "jsmith",
  description = null,
  hostname_paths = [
    {
      hostname = "my-url-protection-policy.com",
      paths = [
        "/*"
      ]
    }
  ],
  intelligent_load_shedding = null,
  max_rate_threshold = 50,
  name = "my-protection-policy",
  update_date = "2026-03-19T15:22:28Z",
  updated_by = "jsmith",
  url_protection_policy_id = 987654
}

Arguments

Provide the required arguments, to include either api_definitions or hostname_paths, to create a URL protection policy.

Argument	Required	Description
`config_id`	✔️	Your security configuration's ID.
`name`	✔️	Name of the URL protection policy.
`max_rate_threshold`	✔️	Maximum rate threshold for the URL protection.
`api_definitions`	Conditional	Required use of this or `hostname_paths`. A list of API definitions associated with the URL protection policy. Contains: `api_definition_id`. Required. The API's ID. `defined_resources`. When set to `true`, it includes defined resources. `resource_ids`. A list of resource IDs. `undefined_resources`. When set to `true`, it includes undefined resources.
`hostname_paths`	Conditional	Required use of this or `api_definitions`. A list of hostname and path configurations. Contains: `hostname`. Required. Hostname for the URL protection. `paths`. Required. A list of paths associated with the hostname.
`bypass_conditions`		A list of bypass conditions for the URL protection rule. Contains: `type`. Required. The type of condition. Value is either `RequestHeaderCondition` or `NetworkListCondition`. `names`. A list of header names used with `RequestHeaderCondition`. `name_wildcard`. When set to `true`, uses wildcard matching for header names. `values`. A list of values for the condition. `value_case_sensitive`. When set to `true`, uses case-sensitive value matching. `value_wildcard`. When set to `true`, uses wildcard matching for values.
`intelligent_load_shedding`		Intelligent load shedding configuration. Contains: `hits_per_sec`. Required. Number of hits per second threshold. `categories`. Possible values are: `BOTS` `CLIENT_REPUTATIONS` `CLOUD_PROVIDERS` `PLATFORM_DDOS_INTELLIGENCE` `PROXIES` `TOR_EXIT_NODES` `custom_criteria`. Custom criteria for intelligent load shedding. Contains: `type`. Required. The custom criteria type. `list_ids`. Required. List of client list IDs. `positive_match`. Required. Whether this is a positive match condition.
`description`		Human-readable statement about your URL protection policy.

Attributes

There is no standard output for this resource. Adding an output block returns the protection policy’s details you provided on create and the computed attributes.

Attribute	Description
`config_id`	Your security configuration's ID.
`name`	Name of the URL protection policy.
`url_protection_policy_id`	A URL protection policy's ID.
`description`	Human-readable statement about your URL protection policy.
`bypass_conditions`	A list of bypass conditions for the URL protection rule. Contains: `type`. The type of condition. Value is either `RequestHeaderCondition` or `NetworkListCondition`. `names`. A list of header names used with `RequestHeaderCondition`. `name_wildcard`. When set to `true`, uses wildcard matching for header names. `values`. A list of values for the condition. `value_case_sensitive`. When set to `true`, uses case-sensitive value matching. `value_wildcard`. When set to `true`, uses wildcard matching for values.
`max_rate_threshold`	Maximum rate threshold for the URL protection.
`api_definitions`	Required use of this or `hostname_paths`. A list of API definitions associated with the URL protection policy. Contains: `api_definition_id`. An API's ID. `defined_resources`. When set to `true`, it includes defined resources. `resource_ids`. A list of resource IDs. `undefined_resources`. When set to `true`, it includes undefined resources.
`hostname_paths`	List of hostname and path configurations. Contains: `hostname`. Hostname for the URL protection. `paths`. List of paths associated with the hostname.
`intelligent_load_shedding`	Intelligent load shedding configuration. Contains: `hits_per_sec`. Number of hits per second threshold. `categories`. Possible values are: `BOTS` `CLIENT_REPUTATIONS` `CLOUD_PROVIDERS` `PLATFORM_DDOS_INTELLIGENCE` `PROXIES` `TOR_EXIT_NODES` `custom_criteria`. Custom criteria for intelligent load shedding. Contains: `type`. The custom criteria type. `list_ids`. List of client list IDs. `positive_match`. Whether this is a positive match condition.
`used`	Whether you're currently using the URL protection policy.
`create_date`	Date when the URL protection policy was created.
`created_by`	User who created the URL protection policy.
`update_date`	Date when the URL protection policy was last updated.
`updated_by`	User who last updated the URL protection policy.

Updated 1 day ago