mmv1/products/compute/RegionSecurityPolicy.yaml [239:542]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                  item_type:
                    type: String
        - name: 'preconfiguredWafConfig'
          type: NestedObject
          description: |
            Preconfigured WAF configuration to be applied for the rule.
            If the rule does not evaluate preconfigured WAF rules, i.e., if evaluatePreconfiguredWaf() is not used, this field will have no effect.
          properties:
            - name: 'exclusion'
              type: Array
              description: |
                An exclusion to apply during preconfigured WAF evaluation.
              api_name: exclusions
              item_type:
                type: NestedObject
                properties:
                  - name: 'targetRuleSet'
                    type: String
                    description: |
                      Target WAF rule set to apply the preconfigured WAF exclusion.
                    required: true
                  - name: 'targetRuleIds'
                    type: Array
                    description: |
                      A list of target rule IDs under the WAF rule set to apply the preconfigured WAF exclusion.
                      If omitted, it refers to all the rule IDs under the WAF rule set.
                    item_type:
                      type: String
                  - name: 'requestHeader'
                    type: Array
                    description: |
                      Request header whose value will be excluded from inspection during preconfigured WAF evaluation.
                    api_name: requestHeadersToExclude
                    item_type:
                      type: NestedObject
                      properties:
                        - name: 'operator'
                          type: Enum
                          description: |
                            You can specify an exact match or a partial match by using a field operator and a field value.
                            Available options:
                            EQUALS: The operator matches if the field value equals the specified value.
                            STARTS_WITH: The operator matches if the field value starts with the specified value.
                            ENDS_WITH: The operator matches if the field value ends with the specified value.
                            CONTAINS: The operator matches if the field value contains the specified value.
                            EQUALS_ANY: The operator matches if the field value is any value.
                          api_name: op
                          required: true
                          enum_values:
                            - 'CONTAINS'
                            - 'ENDS_WITH'
                            - 'EQUALS'
                            - 'EQUALS_ANY'
                            - 'STARTS_WITH'
                        - name: 'value'
                          type: String
                          description: |
                            A request field matching the specified value will be excluded from inspection during preconfigured WAF evaluation.
                            The field value must be given if the field operator is not EQUALS_ANY, and cannot be given if the field operator is EQUALS_ANY.
                          api_name: val
                  - name: 'requestCookie'
                    type: Array
                    description: |
                      Request cookie whose value will be excluded from inspection during preconfigured WAF evaluation.
                    api_name: requestCookiesToExclude
                    item_type:
                      type: NestedObject
                      properties:
                        - name: 'operator'
                          type: Enum
                          description: |
                            You can specify an exact match or a partial match by using a field operator and a field value.
                            Available options:
                            EQUALS: The operator matches if the field value equals the specified value.
                            STARTS_WITH: The operator matches if the field value starts with the specified value.
                            ENDS_WITH: The operator matches if the field value ends with the specified value.
                            CONTAINS: The operator matches if the field value contains the specified value.
                            EQUALS_ANY: The operator matches if the field value is any value.
                          api_name: op
                          required: true
                          enum_values:
                            - 'CONTAINS'
                            - 'ENDS_WITH'
                            - 'EQUALS'
                            - 'EQUALS_ANY'
                            - 'STARTS_WITH'
                        - name: 'value'
                          type: String
                          description: |
                            A request field matching the specified value will be excluded from inspection during preconfigured WAF evaluation.
                            The field value must be given if the field operator is not EQUALS_ANY, and cannot be given if the field operator is EQUALS_ANY.
                          api_name: val
                  - name: 'requestUri'
                    type: Array
                    description: |
                      Request URI from the request line to be excluded from inspection during preconfigured WAF evaluation.
                      When specifying this field, the query or fragment part should be excluded.
                    api_name: requestUrisToExclude
                    item_type:
                      type: NestedObject
                      properties:
                        - name: 'operator'
                          type: Enum
                          description: |
                            You can specify an exact match or a partial match by using a field operator and a field value.
                            Available options:
                            EQUALS: The operator matches if the field value equals the specified value.
                            STARTS_WITH: The operator matches if the field value starts with the specified value.
                            ENDS_WITH: The operator matches if the field value ends with the specified value.
                            CONTAINS: The operator matches if the field value contains the specified value.
                            EQUALS_ANY: The operator matches if the field value is any value.
                          api_name: op
                          required: true
                          enum_values:
                            - 'CONTAINS'
                            - 'ENDS_WITH'
                            - 'EQUALS'
                            - 'EQUALS_ANY'
                            - 'STARTS_WITH'
                        - name: 'value'
                          type: String
                          description: |
                            A request field matching the specified value will be excluded from inspection during preconfigured WAF evaluation.
                            The field value must be given if the field operator is not EQUALS_ANY, and cannot be given if the field operator is EQUALS_ANY.
                          api_name: val
                  - name: 'requestQueryParam'
                    type: Array
                    description: |
                      Request query parameter whose value will be excluded from inspection during preconfigured WAF evaluation.
                      Note that the parameter can be in the query string or in the POST body.
                    api_name: requestQueryParamsToExclude
                    item_type:
                      type: NestedObject
                      properties:
                        - name: 'operator'
                          type: Enum
                          description: |
                            You can specify an exact match or a partial match by using a field operator and a field value.
                            Available options:
                            EQUALS: The operator matches if the field value equals the specified value.
                            STARTS_WITH: The operator matches if the field value starts with the specified value.
                            ENDS_WITH: The operator matches if the field value ends with the specified value.
                            CONTAINS: The operator matches if the field value contains the specified value.
                            EQUALS_ANY: The operator matches if the field value is any value.
                          api_name: op
                          required: true
                          enum_values:
                            - 'CONTAINS'
                            - 'ENDS_WITH'
                            - 'EQUALS'
                            - 'EQUALS_ANY'
                            - 'STARTS_WITH'
                        - name: 'value'
                          type: String
                          description: |
                            A request field matching the specified value will be excluded from inspection during preconfigured WAF evaluation.
                            The field value must be given if the field operator is not EQUALS_ANY, and cannot be given if the field operator is EQUALS_ANY.
                          api_name: val
        - name: 'action'
          type: String
          description: |
            The Action to perform when the rule is matched. The following are the valid actions:

            * allow: allow access to target.

            * deny(STATUS): deny access to target, returns the HTTP response code specified. Valid values for STATUS are 403, 404, and 502.

            * rate_based_ban: limit client traffic to the configured threshold and ban the client if the traffic exceeds the threshold. Configure parameters for this action in RateLimitOptions. Requires rateLimitOptions to be set.

            * redirect: redirect to a different target. This can either be an internal reCAPTCHA redirect, or an external URL-based redirect via a 302 response. Parameters for this action can be configured via redirectOptions. This action is only supported in Global Security Policies of type CLOUD_ARMOR.

            * throttle: limit client traffic to the configured threshold. Configure parameters for this action in rateLimitOptions. Requires rateLimitOptions to be set for this.
          required: true
        - name: 'rateLimitOptions'
          type: NestedObject
          description: |
            Must be specified if the action is "rate_based_ban" or "throttle". Cannot be specified for any other actions.
          update_mask_fields:
            - 'rateLimitOptions.rateLimitThreshold'
            - 'rateLimitOptions.conformAction'
            - 'rateLimitOptions.exceedAction'
            - 'rateLimitOptions.enforceOnKey'
            - 'rateLimitOptions.enforceOnKeyName'
            - 'rateLimitOptions.enforceOnKeyConfigs'
            - 'rateLimitOptions.banThreshold'
            - 'rateLimitOptions.banDurationSec'
          properties:
            - name: 'rateLimitThreshold'
              type: NestedObject
              description: |
                Threshold at which to begin ratelimiting.
              properties:
                - name: 'count'
                  type: Integer
                  description: |
                    Number of HTTP(S) requests for calculating the threshold.
                - name: 'intervalSec'
                  type: Integer
                  description: |
                    Interval over which the threshold is computed.
            - name: 'conformAction'
              type: String
              description: |
                Action to take for requests that are under the configured rate limit threshold.
                Valid option is "allow" only.
            - name: 'exceedAction'
              type: String
              description: |
                Action to take for requests that are above the configured rate limit threshold, to deny with a specified HTTP response code.
                Valid options are deny(STATUS), where valid values for STATUS are 403, 404, 429, and 502.
            - name: 'enforceOnKey'
              type: Enum
              description: |
                Determines the key to enforce the rateLimitThreshold on. Possible values are:
                * ALL: A single rate limit threshold is applied to all the requests matching this rule. This is the default value if "enforceOnKey" is not configured.
                * IP: The source IP address of the request is the key. Each IP has this limit enforced separately.
                * HTTP_HEADER: The value of the HTTP header whose name is configured under "enforceOnKeyName". The key value is truncated to the first 128 bytes of the header value. If no such header is present in the request, the key type defaults to ALL.
                * XFF_IP: The first IP address (i.e. the originating client IP address) specified in the list of IPs under X-Forwarded-For HTTP header. If no such header is present or the value is not a valid IP, the key defaults to the source IP address of the request i.e. key type IP.
                * HTTP_COOKIE: The value of the HTTP cookie whose name is configured under "enforceOnKeyName". The key value is truncated to the first 128 bytes of the cookie value. If no such cookie is present in the request, the key type defaults to ALL.
                * HTTP_PATH: The URL path of the HTTP request. The key value is truncated to the first 128 bytes.
                * SNI: Server name indication in the TLS session of the HTTPS request. The key value is truncated to the first 128 bytes. The key type defaults to ALL on a HTTP session.
                * REGION_CODE: The country/region from which the request originates.
                * TLS_JA3_FINGERPRINT: JA3 TLS/SSL fingerprint if the client connects using HTTPS, HTTP/2 or HTTP/3. If not available, the key type defaults to ALL.
                * USER_IP: The IP address of the originating client, which is resolved based on "userIpRequestHeaders" configured with the security policy. If there is no "userIpRequestHeaders" configuration or an IP address cannot be resolved from it, the key type defaults to IP.
              enum_values:
                - 'ALL'
                - 'IP'
                - 'HTTP_HEADER'
                - 'XFF_IP'
                - 'HTTP_COOKIE'
                - 'HTTP_PATH'
                - 'SNI'
                - 'REGION_CODE'
                - 'TLS_JA3_FINGERPRINT'
                - 'USER_IP'
            - name: 'enforceOnKeyName'
              type: String
              description: |
                Rate limit key name applicable only for the following key types:
                HTTP_HEADER -- Name of the HTTP header whose value is taken as the key value.
                HTTP_COOKIE -- Name of the HTTP cookie whose value is taken as the key value.
            - name: 'enforceOnKeyConfigs'
              type: Array
              description: |
                If specified, any combination of values of enforceOnKeyType/enforceOnKeyName is treated as the key on which ratelimit threshold/action is enforced.
                You can specify up to 3 enforceOnKeyConfigs.
                If enforceOnKeyConfigs is specified, enforceOnKey must not be specified.
              item_type:
                type: NestedObject
                properties:
                  - name: 'enforceOnKeyType'
                    type: Enum
                    description: |
                      Determines the key to enforce the rateLimitThreshold on. Possible values are:
                      * ALL: A single rate limit threshold is applied to all the requests matching this rule. This is the default value if "enforceOnKeyConfigs" is not configured.
                      * IP: The source IP address of the request is the key. Each IP has this limit enforced separately.
                      * HTTP_HEADER: The value of the HTTP header whose name is configured under "enforceOnKeyName". The key value is truncated to the first 128 bytes of the header value. If no such header is present in the request, the key type defaults to ALL.
                      * XFF_IP: The first IP address (i.e. the originating client IP address) specified in the list of IPs under X-Forwarded-For HTTP header. If no such header is present or the value is not a valid IP, the key defaults to the source IP address of the request i.e. key type IP.
                      * HTTP_COOKIE: The value of the HTTP cookie whose name is configured under "enforceOnKeyName". The key value is truncated to the first 128 bytes of the cookie value. If no such cookie is present in the request, the key type defaults to ALL.
                      * HTTP_PATH: The URL path of the HTTP request. The key value is truncated to the first 128 bytes.
                      * SNI: Server name indication in the TLS session of the HTTPS request. The key value is truncated to the first 128 bytes. The key type defaults to ALL on a HTTP session.
                      * REGION_CODE: The country/region from which the request originates.
                      * TLS_JA3_FINGERPRINT: JA3 TLS/SSL fingerprint if the client connects using HTTPS, HTTP/2 or HTTP/3. If not available, the key type defaults to ALL.
                      * USER_IP: The IP address of the originating client, which is resolved based on "userIpRequestHeaders" configured with the security policy. If there is no "userIpRequestHeaders" configuration or an IP address cannot be resolved from it, the key type defaults to IP.
                    enum_values:
                      - 'ALL'
                      - 'IP'
                      - 'HTTP_HEADER'
                      - 'XFF_IP'
                      - 'HTTP_COOKIE'
                      - 'HTTP_PATH'
                      - 'SNI'
                      - 'REGION_CODE'
                      - 'TLS_JA3_FINGERPRINT'
                      - 'USER_IP'
                  - name: 'enforceOnKeyName'
                    type: String
                    description: |
                      Rate limit key name applicable only for the following key types:
                      HTTP_HEADER -- Name of the HTTP header whose value is taken as the key value.
                      HTTP_COOKIE -- Name of the HTTP cookie whose value is taken as the key value.
            - name: 'banThreshold'
              type: NestedObject
              description: |
                Can only be specified if the action for the rule is "rate_based_ban".
                If specified, the key will be banned for the configured 'banDurationSec' when the number of requests that exceed the 'rateLimitThreshold' also exceed this 'banThreshold'.
              properties:
                - name: 'count'
                  type: Integer
                  description: |
                    Number of HTTP(S) requests for calculating the threshold.
                - name: 'intervalSec'
                  type: Integer
                  description: |
                    Interval over which the threshold is computed.
            - name: 'banDurationSec'
              type: Integer
              description: |
                Can only be specified if the action for the rule is "rate_based_ban".
                If specified, determines the time (in seconds) the traffic will continue to be banned by the rate limit after the rate falls below the threshold.
        - name: 'preview'
          type: Boolean
          description: |
            If set to true, the specified action is not enforced.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



mmv1/products/compute/RegionSecurityPolicyRule.yaml [134:437]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
            item_type:
              type: String
  - name: 'preconfiguredWafConfig'
    type: NestedObject
    description: |
      Preconfigured WAF configuration to be applied for the rule.
      If the rule does not evaluate preconfigured WAF rules, i.e., if evaluatePreconfiguredWaf() is not used, this field will have no effect.
    properties:
      - name: 'exclusion'
        type: Array
        description: |
          An exclusion to apply during preconfigured WAF evaluation.
        api_name: exclusions
        item_type:
          type: NestedObject
          properties:
            - name: 'targetRuleSet'
              type: String
              description: |
                Target WAF rule set to apply the preconfigured WAF exclusion.
              required: true
            - name: 'targetRuleIds'
              type: Array
              description: |
                A list of target rule IDs under the WAF rule set to apply the preconfigured WAF exclusion.
                If omitted, it refers to all the rule IDs under the WAF rule set.
              item_type:
                type: String
            - name: 'requestHeader'
              type: Array
              description: |
                Request header whose value will be excluded from inspection during preconfigured WAF evaluation.
              api_name: requestHeadersToExclude
              item_type:
                type: NestedObject
                properties:
                  - name: 'operator'
                    type: Enum
                    description: |
                      You can specify an exact match or a partial match by using a field operator and a field value.
                      Available options:
                      EQUALS: The operator matches if the field value equals the specified value.
                      STARTS_WITH: The operator matches if the field value starts with the specified value.
                      ENDS_WITH: The operator matches if the field value ends with the specified value.
                      CONTAINS: The operator matches if the field value contains the specified value.
                      EQUALS_ANY: The operator matches if the field value is any value.
                    api_name: op
                    required: true
                    enum_values:
                      - 'CONTAINS'
                      - 'ENDS_WITH'
                      - 'EQUALS'
                      - 'EQUALS_ANY'
                      - 'STARTS_WITH'
                  - name: 'value'
                    type: String
                    description: |
                      A request field matching the specified value will be excluded from inspection during preconfigured WAF evaluation.
                      The field value must be given if the field operator is not EQUALS_ANY, and cannot be given if the field operator is EQUALS_ANY.
                    api_name: val
            - name: 'requestCookie'
              type: Array
              description: |
                Request cookie whose value will be excluded from inspection during preconfigured WAF evaluation.
              api_name: requestCookiesToExclude
              item_type:
                type: NestedObject
                properties:
                  - name: 'operator'
                    type: Enum
                    description: |
                      You can specify an exact match or a partial match by using a field operator and a field value.
                      Available options:
                      EQUALS: The operator matches if the field value equals the specified value.
                      STARTS_WITH: The operator matches if the field value starts with the specified value.
                      ENDS_WITH: The operator matches if the field value ends with the specified value.
                      CONTAINS: The operator matches if the field value contains the specified value.
                      EQUALS_ANY: The operator matches if the field value is any value.
                    api_name: op
                    required: true
                    enum_values:
                      - 'CONTAINS'
                      - 'ENDS_WITH'
                      - 'EQUALS'
                      - 'EQUALS_ANY'
                      - 'STARTS_WITH'
                  - name: 'value'
                    type: String
                    description: |
                      A request field matching the specified value will be excluded from inspection during preconfigured WAF evaluation.
                      The field value must be given if the field operator is not EQUALS_ANY, and cannot be given if the field operator is EQUALS_ANY.
                    api_name: val
            - name: 'requestUri'
              type: Array
              description: |
                Request URI from the request line to be excluded from inspection during preconfigured WAF evaluation.
                When specifying this field, the query or fragment part should be excluded.
              api_name: requestUrisToExclude
              item_type:
                type: NestedObject
                properties:
                  - name: 'operator'
                    type: Enum
                    description: |
                      You can specify an exact match or a partial match by using a field operator and a field value.
                      Available options:
                      EQUALS: The operator matches if the field value equals the specified value.
                      STARTS_WITH: The operator matches if the field value starts with the specified value.
                      ENDS_WITH: The operator matches if the field value ends with the specified value.
                      CONTAINS: The operator matches if the field value contains the specified value.
                      EQUALS_ANY: The operator matches if the field value is any value.
                    api_name: op
                    required: true
                    enum_values:
                      - 'CONTAINS'
                      - 'ENDS_WITH'
                      - 'EQUALS'
                      - 'EQUALS_ANY'
                      - 'STARTS_WITH'
                  - name: 'value'
                    type: String
                    description: |
                      A request field matching the specified value will be excluded from inspection during preconfigured WAF evaluation.
                      The field value must be given if the field operator is not EQUALS_ANY, and cannot be given if the field operator is EQUALS_ANY.
                    api_name: val
            - name: 'requestQueryParam'
              type: Array
              description: |
                Request query parameter whose value will be excluded from inspection during preconfigured WAF evaluation.
                Note that the parameter can be in the query string or in the POST body.
              api_name: requestQueryParamsToExclude
              item_type:
                type: NestedObject
                properties:
                  - name: 'operator'
                    type: Enum
                    description: |
                      You can specify an exact match or a partial match by using a field operator and a field value.
                      Available options:
                      EQUALS: The operator matches if the field value equals the specified value.
                      STARTS_WITH: The operator matches if the field value starts with the specified value.
                      ENDS_WITH: The operator matches if the field value ends with the specified value.
                      CONTAINS: The operator matches if the field value contains the specified value.
                      EQUALS_ANY: The operator matches if the field value is any value.
                    api_name: op
                    required: true
                    enum_values:
                      - 'CONTAINS'
                      - 'ENDS_WITH'
                      - 'EQUALS'
                      - 'EQUALS_ANY'
                      - 'STARTS_WITH'
                  - name: 'value'
                    type: String
                    description: |
                      A request field matching the specified value will be excluded from inspection during preconfigured WAF evaluation.
                      The field value must be given if the field operator is not EQUALS_ANY, and cannot be given if the field operator is EQUALS_ANY.
                    api_name: val
  - name: 'action'
    type: String
    description: |
      The Action to perform when the rule is matched. The following are the valid actions:

      * allow: allow access to target.

      * deny(STATUS): deny access to target, returns the HTTP response code specified. Valid values for STATUS are 403, 404, and 502.

      * rate_based_ban: limit client traffic to the configured threshold and ban the client if the traffic exceeds the threshold. Configure parameters for this action in RateLimitOptions. Requires rateLimitOptions to be set.

      * redirect: redirect to a different target. This can either be an internal reCAPTCHA redirect, or an external URL-based redirect via a 302 response. Parameters for this action can be configured via redirectOptions. This action is only supported in Global Security Policies of type CLOUD_ARMOR.

      * throttle: limit client traffic to the configured threshold. Configure parameters for this action in rateLimitOptions. Requires rateLimitOptions to be set for this.
    required: true
  - name: 'rateLimitOptions'
    type: NestedObject
    description: |
      Must be specified if the action is "rate_based_ban" or "throttle". Cannot be specified for any other actions.
    update_mask_fields:
      - 'rateLimitOptions.rateLimitThreshold'
      - 'rateLimitOptions.conformAction'
      - 'rateLimitOptions.exceedAction'
      - 'rateLimitOptions.enforceOnKey'
      - 'rateLimitOptions.enforceOnKeyName'
      - 'rateLimitOptions.enforceOnKeyConfigs'
      - 'rateLimitOptions.banThreshold'
      - 'rateLimitOptions.banDurationSec'
    properties:
      - name: 'rateLimitThreshold'
        type: NestedObject
        description: |
          Threshold at which to begin ratelimiting.
        properties:
          - name: 'count'
            type: Integer
            description: |
              Number of HTTP(S) requests for calculating the threshold.
          - name: 'intervalSec'
            type: Integer
            description: |
              Interval over which the threshold is computed.
      - name: 'conformAction'
        type: String
        description: |
          Action to take for requests that are under the configured rate limit threshold.
          Valid option is "allow" only.
      - name: 'exceedAction'
        type: String
        description: |
          Action to take for requests that are above the configured rate limit threshold, to deny with a specified HTTP response code.
          Valid options are deny(STATUS), where valid values for STATUS are 403, 404, 429, and 502.
      - name: 'enforceOnKey'
        type: Enum
        description: |
          Determines the key to enforce the rateLimitThreshold on. Possible values are:
          * ALL: A single rate limit threshold is applied to all the requests matching this rule. This is the default value if "enforceOnKey" is not configured.
          * IP: The source IP address of the request is the key. Each IP has this limit enforced separately.
          * HTTP_HEADER: The value of the HTTP header whose name is configured under "enforceOnKeyName". The key value is truncated to the first 128 bytes of the header value. If no such header is present in the request, the key type defaults to ALL.
          * XFF_IP: The first IP address (i.e. the originating client IP address) specified in the list of IPs under X-Forwarded-For HTTP header. If no such header is present or the value is not a valid IP, the key defaults to the source IP address of the request i.e. key type IP.
          * HTTP_COOKIE: The value of the HTTP cookie whose name is configured under "enforceOnKeyName". The key value is truncated to the first 128 bytes of the cookie value. If no such cookie is present in the request, the key type defaults to ALL.
          * HTTP_PATH: The URL path of the HTTP request. The key value is truncated to the first 128 bytes.
          * SNI: Server name indication in the TLS session of the HTTPS request. The key value is truncated to the first 128 bytes. The key type defaults to ALL on a HTTP session.
          * REGION_CODE: The country/region from which the request originates.
          * TLS_JA3_FINGERPRINT: JA3 TLS/SSL fingerprint if the client connects using HTTPS, HTTP/2 or HTTP/3. If not available, the key type defaults to ALL.
          * USER_IP: The IP address of the originating client, which is resolved based on "userIpRequestHeaders" configured with the security policy. If there is no "userIpRequestHeaders" configuration or an IP address cannot be resolved from it, the key type defaults to IP.
        enum_values:
          - 'ALL'
          - 'IP'
          - 'HTTP_HEADER'
          - 'XFF_IP'
          - 'HTTP_COOKIE'
          - 'HTTP_PATH'
          - 'SNI'
          - 'REGION_CODE'
          - 'TLS_JA3_FINGERPRINT'
          - 'USER_IP'
      - name: 'enforceOnKeyName'
        type: String
        description: |
          Rate limit key name applicable only for the following key types:
          HTTP_HEADER -- Name of the HTTP header whose value is taken as the key value.
          HTTP_COOKIE -- Name of the HTTP cookie whose value is taken as the key value.
      - name: 'enforceOnKeyConfigs'
        type: Array
        description: |
          If specified, any combination of values of enforceOnKeyType/enforceOnKeyName is treated as the key on which ratelimit threshold/action is enforced.
          You can specify up to 3 enforceOnKeyConfigs.
          If enforceOnKeyConfigs is specified, enforceOnKey must not be specified.
        item_type:
          type: NestedObject
          properties:
            - name: 'enforceOnKeyType'
              type: Enum
              description: |
                Determines the key to enforce the rateLimitThreshold on. Possible values are:
                * ALL: A single rate limit threshold is applied to all the requests matching this rule. This is the default value if "enforceOnKeyConfigs" is not configured.
                * IP: The source IP address of the request is the key. Each IP has this limit enforced separately.
                * HTTP_HEADER: The value of the HTTP header whose name is configured under "enforceOnKeyName". The key value is truncated to the first 128 bytes of the header value. If no such header is present in the request, the key type defaults to ALL.
                * XFF_IP: The first IP address (i.e. the originating client IP address) specified in the list of IPs under X-Forwarded-For HTTP header. If no such header is present or the value is not a valid IP, the key defaults to the source IP address of the request i.e. key type IP.
                * HTTP_COOKIE: The value of the HTTP cookie whose name is configured under "enforceOnKeyName". The key value is truncated to the first 128 bytes of the cookie value. If no such cookie is present in the request, the key type defaults to ALL.
                * HTTP_PATH: The URL path of the HTTP request. The key value is truncated to the first 128 bytes.
                * SNI: Server name indication in the TLS session of the HTTPS request. The key value is truncated to the first 128 bytes. The key type defaults to ALL on a HTTP session.
                * REGION_CODE: The country/region from which the request originates.
                * TLS_JA3_FINGERPRINT: JA3 TLS/SSL fingerprint if the client connects using HTTPS, HTTP/2 or HTTP/3. If not available, the key type defaults to ALL.
                * USER_IP: The IP address of the originating client, which is resolved based on "userIpRequestHeaders" configured with the security policy. If there is no "userIpRequestHeaders" configuration or an IP address cannot be resolved from it, the key type defaults to IP.
              enum_values:
                - 'ALL'
                - 'IP'
                - 'HTTP_HEADER'
                - 'XFF_IP'
                - 'HTTP_COOKIE'
                - 'HTTP_PATH'
                - 'SNI'
                - 'REGION_CODE'
                - 'TLS_JA3_FINGERPRINT'
                - 'USER_IP'
            - name: 'enforceOnKeyName'
              type: String
              description: |
                Rate limit key name applicable only for the following key types:
                HTTP_HEADER -- Name of the HTTP header whose value is taken as the key value.
                HTTP_COOKIE -- Name of the HTTP cookie whose value is taken as the key value.
      - name: 'banThreshold'
        type: NestedObject
        description: |
          Can only be specified if the action for the rule is "rate_based_ban".
          If specified, the key will be banned for the configured 'banDurationSec' when the number of requests that exceed the 'rateLimitThreshold' also exceed this 'banThreshold'.
        properties:
          - name: 'count'
            type: Integer
            description: |
              Number of HTTP(S) requests for calculating the threshold.
          - name: 'intervalSec'
            type: Integer
            description: |
              Interval over which the threshold is computed.
      - name: 'banDurationSec'
        type: Integer
        description: |
          Can only be specified if the action for the rule is "rate_based_ban".
          If specified, determines the time (in seconds) the traffic will continue to be banned by the rate limit after the rate falls below the threshold.
  - name: 'preview'
    type: Boolean
    description: |
      If set to true, the specified action is not enforced.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



