Cloudflare v6.11.0, Oct 31 25

Cloudflare v6.11.0 published on Friday, Oct 31, 2025 by Pulumi

cloudflare.getDnsFirewall

Start a Neo task

Explain and create a cloudflare.getDnsFirewall resource

Cloudflare v6.11.0 published on Friday, Oct 31, 2025 by Pulumi

pulumi/pulumi-cloudflare

Example Usage

import * as pulumi from "@pulumi/pulumi";
import * as cloudflare from "@pulumi/cloudflare";

const exampleDnsFirewall = cloudflare.getDnsFirewall({
    accountId: "023e105f4ecef8ad9ca31a8372d0c353",
    dnsFirewallId: "023e105f4ecef8ad9ca31a8372d0c353",
});

import pulumi
import pulumi_cloudflare as cloudflare

example_dns_firewall = cloudflare.get_dns_firewall(account_id="023e105f4ecef8ad9ca31a8372d0c353",
    dns_firewall_id="023e105f4ecef8ad9ca31a8372d0c353")

package main

import (
	"github.com/pulumi/pulumi-cloudflare/sdk/v6/go/cloudflare"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := cloudflare.LookupDnsFirewall(ctx, &cloudflare.LookupDnsFirewallArgs{
			AccountId:     "023e105f4ecef8ad9ca31a8372d0c353",
			DnsFirewallId: pulumi.StringRef("023e105f4ecef8ad9ca31a8372d0c353"),
		}, nil)
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Cloudflare = Pulumi.Cloudflare;

return await Deployment.RunAsync(() => 
{
    var exampleDnsFirewall = Cloudflare.GetDnsFirewall.Invoke(new()
    {
        AccountId = "023e105f4ecef8ad9ca31a8372d0c353",
        DnsFirewallId = "023e105f4ecef8ad9ca31a8372d0c353",
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.cloudflare.CloudflareFunctions;
import com.pulumi.cloudflare.inputs.GetDnsFirewallArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var exampleDnsFirewall = CloudflareFunctions.getDnsFirewall(GetDnsFirewallArgs.builder()
            .accountId("023e105f4ecef8ad9ca31a8372d0c353")
            .dnsFirewallId("023e105f4ecef8ad9ca31a8372d0c353")
            .build());

    }
}

variables:
  exampleDnsFirewall:
    fn::invoke:
      function: cloudflare:getDnsFirewall
      arguments:
        accountId: 023e105f4ecef8ad9ca31a8372d0c353
        dnsFirewallId: 023e105f4ecef8ad9ca31a8372d0c353

Using getDnsFirewall

Two invocation forms are available. The direct form accepts plain arguments and either blocks until the result value is available, or returns a Promise-wrapped result. The output form accepts Input-wrapped arguments and returns an Output-wrapped result.

function getDnsFirewall(args: GetDnsFirewallArgs, opts?: InvokeOptions): Promise<GetDnsFirewallResult>
function getDnsFirewallOutput(args: GetDnsFirewallOutputArgs, opts?: InvokeOptions): Output<GetDnsFirewallResult>

def get_dns_firewall(account_id: Optional[str] = None,
                     dns_firewall_id: Optional[str] = None,
                     opts: Optional[InvokeOptions] = None) -> GetDnsFirewallResult
def get_dns_firewall_output(account_id: Optional[pulumi.Input[str]] = None,
                     dns_firewall_id: Optional[pulumi.Input[str]] = None,
                     opts: Optional[InvokeOptions] = None) -> Output[GetDnsFirewallResult]

func LookupDnsFirewall(ctx *Context, args *LookupDnsFirewallArgs, opts ...InvokeOption) (*LookupDnsFirewallResult, error)
func LookupDnsFirewallOutput(ctx *Context, args *LookupDnsFirewallOutputArgs, opts ...InvokeOption) LookupDnsFirewallResultOutput

> Note: This function is named LookupDnsFirewall in the Go SDK.

public static class GetDnsFirewall 
{
    public static Task<GetDnsFirewallResult> InvokeAsync(GetDnsFirewallArgs args, InvokeOptions? opts = null)
    public static Output<GetDnsFirewallResult> Invoke(GetDnsFirewallInvokeArgs args, InvokeOptions? opts = null)
}

public static CompletableFuture<GetDnsFirewallResult> getDnsFirewall(GetDnsFirewallArgs args, InvokeOptions options)
public static Output<GetDnsFirewallResult> getDnsFirewall(GetDnsFirewallArgs args, InvokeOptions options)

fn::invoke:
  function: cloudflare:index/getDnsFirewall:getDnsFirewall
  arguments:
    # arguments dictionary

The following arguments are supported:

AccountId string: Identifier.
DnsFirewallId string: Identifier.

AccountId string: Identifier.
DnsFirewallId string: Identifier.

accountId String: Identifier.
dnsFirewallId String: Identifier.

accountId string: Identifier.
dnsFirewallId string: Identifier.

account_id str: Identifier.
dns_firewall_id str: Identifier.

accountId String: Identifier.
dnsFirewallId String: Identifier.

getDnsFirewall Result

The following output properties are available:

AccountId string: Identifier.
AttackMitigation GetDnsFirewallAttackMitigation: Attack mitigation settings
DeprecateAnyRequests bool: Whether to refuse to answer queries for the ANY type
DnsFirewallIps List<string>
EcsFallback bool: Whether to forward client IP (resolver) subnet if no EDNS Client Subnet is sent
Id string: Identifier.
MaximumCacheTtl double: By default, Cloudflare attempts to cache responses for as long as indicated by the TTL received from upstream nameservers. This setting sets an upper bound on this duration. For caching purposes, higher TTLs will be decreased to the maximum value defined by this setting.
MinimumCacheTtl double
ModifiedOn string
Name string
NegativeCacheTtl double
Ratelimit double
Retries double
UpstreamIps List<string>
DnsFirewallId string: Identifier.

AccountId string: Identifier.
AttackMitigation GetDnsFirewallAttackMitigation: Attack mitigation settings
DeprecateAnyRequests bool: Whether to refuse to answer queries for the ANY type
DnsFirewallIps []string
EcsFallback bool: Whether to forward client IP (resolver) subnet if no EDNS Client Subnet is sent
Id string: Identifier.
MaximumCacheTtl float64: By default, Cloudflare attempts to cache responses for as long as indicated by the TTL received from upstream nameservers. This setting sets an upper bound on this duration. For caching purposes, higher TTLs will be decreased to the maximum value defined by this setting.
MinimumCacheTtl float64
ModifiedOn string
Name string
NegativeCacheTtl float64
Ratelimit float64
Retries float64
UpstreamIps []string
DnsFirewallId string: Identifier.

accountId String: Identifier.
attackMitigation GetDnsFirewallAttackMitigation: Attack mitigation settings
deprecateAnyRequests Boolean: Whether to refuse to answer queries for the ANY type
dnsFirewallIps List<String>
ecsFallback Boolean: Whether to forward client IP (resolver) subnet if no EDNS Client Subnet is sent
id String: Identifier.
maximumCacheTtl Double: By default, Cloudflare attempts to cache responses for as long as indicated by the TTL received from upstream nameservers. This setting sets an upper bound on this duration. For caching purposes, higher TTLs will be decreased to the maximum value defined by this setting.
minimumCacheTtl Double
modifiedOn String
name String
negativeCacheTtl Double
ratelimit Double
retries Double
upstreamIps List<String>
dnsFirewallId String: Identifier.

accountId string: Identifier.
attackMitigation GetDnsFirewallAttackMitigation: Attack mitigation settings
deprecateAnyRequests boolean: Whether to refuse to answer queries for the ANY type
dnsFirewallIps string[]
ecsFallback boolean: Whether to forward client IP (resolver) subnet if no EDNS Client Subnet is sent
id string: Identifier.
maximumCacheTtl number: By default, Cloudflare attempts to cache responses for as long as indicated by the TTL received from upstream nameservers. This setting sets an upper bound on this duration. For caching purposes, higher TTLs will be decreased to the maximum value defined by this setting.
minimumCacheTtl number
modifiedOn string
name string
negativeCacheTtl number
ratelimit number
retries number
upstreamIps string[]
dnsFirewallId string: Identifier.

account_id str: Identifier.
attack_mitigation GetDnsFirewallAttackMitigation: Attack mitigation settings
deprecate_any_requests bool: Whether to refuse to answer queries for the ANY type
dns_firewall_ips Sequence[str]
ecs_fallback bool: Whether to forward client IP (resolver) subnet if no EDNS Client Subnet is sent
id str: Identifier.
maximum_cache_ttl float: By default, Cloudflare attempts to cache responses for as long as indicated by the TTL received from upstream nameservers. This setting sets an upper bound on this duration. For caching purposes, higher TTLs will be decreased to the maximum value defined by this setting.
minimum_cache_ttl float
modified_on str
name str
negative_cache_ttl float
ratelimit float
retries float
upstream_ips Sequence[str]
dns_firewall_id str: Identifier.

accountId String: Identifier.
attackMitigation Property Map: Attack mitigation settings
deprecateAnyRequests Boolean: Whether to refuse to answer queries for the ANY type
dnsFirewallIps List<String>
ecsFallback Boolean: Whether to forward client IP (resolver) subnet if no EDNS Client Subnet is sent
id String: Identifier.
maximumCacheTtl Number: By default, Cloudflare attempts to cache responses for as long as indicated by the TTL received from upstream nameservers. This setting sets an upper bound on this duration. For caching purposes, higher TTLs will be decreased to the maximum value defined by this setting.
minimumCacheTtl Number
modifiedOn String
name String
negativeCacheTtl Number
ratelimit Number
retries Number
upstreamIps List<String>
dnsFirewallId String: Identifier.

Supporting Types

GetDnsFirewallAttackMitigation

Enabled bool: When enabled, automatically mitigate random-prefix attacks to protect upstream DNS servers
OnlyWhenUpstreamUnhealthy bool: Only mitigate attacks when upstream servers seem unhealthy

Enabled bool: When enabled, automatically mitigate random-prefix attacks to protect upstream DNS servers
OnlyWhenUpstreamUnhealthy bool: Only mitigate attacks when upstream servers seem unhealthy

enabled Boolean: When enabled, automatically mitigate random-prefix attacks to protect upstream DNS servers
onlyWhenUpstreamUnhealthy Boolean: Only mitigate attacks when upstream servers seem unhealthy

enabled boolean: When enabled, automatically mitigate random-prefix attacks to protect upstream DNS servers
onlyWhenUpstreamUnhealthy boolean: Only mitigate attacks when upstream servers seem unhealthy

enabled bool: When enabled, automatically mitigate random-prefix attacks to protect upstream DNS servers
only_when_upstream_unhealthy bool: Only mitigate attacks when upstream servers seem unhealthy

enabled Boolean: When enabled, automatically mitigate random-prefix attacks to protect upstream DNS servers
onlyWhenUpstreamUnhealthy Boolean: Only mitigate attacks when upstream servers seem unhealthy

Package Details

Repository: Cloudflare pulumi/pulumi-cloudflare
License: Apache-2.0
Notes: This Pulumi package is based on the cloudflare Terraform Provider.

Cloudflare v6.11.0 published on Friday, Oct 31, 2025 by Pulumi

pulumi/pulumi-cloudflare

cloudflare.getDnsFirewall

On this page

On this page

Example Usage

Using getDnsFirewall

getDnsFirewall Result

Supporting Types

GetDnsFirewallAttackMitigation

Package Details

On this page

On this page