vac_resource_policies

Creates, updates, deletes, gets or lists a vac_resource_policies resource.

Overview

Name	vac_resource_policies
Type	Resource
Id	ovh.network_defense.vac_resource_policies

Fields

The following fields are returned by SELECT queries:

get

successful operation

Name	Datatype	Description
id	string (uuid)	Unique identifier of the policy
checksum	string	Checksum of the current configuration, used to detect concurrent changes. Provide it on update to avoid overwriting another change.
created_at	string (date-time)	Date and time the policy was created (wire: createdAt)
current_state	object	Configuration currently being enforced. Null while the policy is still being created (CREATING). (wire: currentState)
error_message	string	Details of the last error, set when the status is ERROR (wire: errorMessage)
iam	object	IAM resource metadata
resource_status	string	Current status of the policy (CREATING, CREATION_PLANNED, DELETING, ERROR, OUT_OF_SYNC, READY, SUSPENDED, UNKNOWN, UPDATING) (wire: resourceStatus)
target_spec	object	Configuration you requested. While a change is being applied (CREATING, UPDATING or ERROR) it differs from currentState. Once READY it mirrors currentState. Null while the policy is being deleted. (wire: targetSpec)
updated_at	string (date-time)	Date and time the policy was last updated (wire: updatedAt)

list

A protection policy within a VAC resource. Changes are applied in the background, so its status shows whether the policy is ready or a change is still being applied.

Name	Datatype	Description
id	string (uuid)	Unique identifier of the policy
checksum	string	Checksum of the current configuration, used to detect concurrent changes. Provide it on update to avoid overwriting another change.
created_at	string (date-time)	Date and time the policy was created (wire: createdAt)
current_state	object	Configuration currently being enforced. Null while the policy is still being created (CREATING). (wire: currentState)
error_message	string	Details of the last error, set when the status is ERROR (wire: errorMessage)
iam	object	IAM resource metadata
resource_status	string	Current status of the policy (CREATING, CREATION_PLANNED, DELETING, ERROR, OUT_OF_SYNC, READY, SUSPENDED, UNKNOWN, UPDATING) (wire: resourceStatus)
target_spec	object	Configuration you requested. While a change is being applied (CREATING, UPDATING or ERROR) it differs from currentState. Once READY it mirrors currentState. Null while the policy is being deleted. (wire: targetSpec)
updated_at	string (date-time)	Date and time the policy was last updated (wire: updatedAt)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	policy_id, resource_name		Returns a policy with the configuration requested and the one currently enforced, including the status of every protected IP address prefix.
list	select	resource_name	x_pagination_cursor, x_pagination_size, iam_tags	Returns the list of policies within a VAC DDoS protection resource. Every policy applies a profile and a sensitivity level to target IP address prefixes, and carries the configuration requested and the one currently enforced.
create	insert	resource_name, target_spec	force	Creates a policy within a VAC DDoS protection resource, applying a profile and a sensitivity level to target IP address prefixes in order to tune detection and mitigation rules. Async call, follow resourceStatus for operation progress. A target whose prefix carries protection settings that were not set via a policy is refused, unless you send force=true to overwrite them.
update	update	policy_id, resource_name, target_spec	force	Updates the name, enabled state, targets, profile and sensitivity level of a policy. The targets sent fully replace the previous ones: an omitted or empty list of targets removes every target from the policy. Removed target IPs reset their VAC DDoS protection settings to the default state. Send the checksum from the last read. A stale value is rejected. A new target whose prefix carries protection settings that were not set via a policy is refused, unless you send force=true to overwrite them.
delete	delete	policy_id, resource_name		Deletes a policy from a VAC DDoS protection resource. All settings of linked target IP address prefixes return to their default states.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
api_host	string	The OVHcloud API host. Selected by OVH_ENDPOINT (ovh-eu, ovh-ca or ovh-us; default ovh-eu). (default: api.eu.ovhcloud.com, x-stackQL-envVarSelector: {"envVar":"OVH_ENDPOINT","default":"ovh-eu","values":{"ovh-eu":"api.eu.ovhcloud.com","ovh-ca":"api.ca.ovhcloud.com","ovh-us":"api.us.ovhcloud.com"}})
policy_id	string (uuid)	Policy ID (wire: policyId)
resource_name	string (uuid)	Resource name (wire: resourceName)
force	boolean	Overwrite the protection settings that were not set via a policy on the targets this request adds. Without it, such a request is refused. The previous settings are lost: you cannot restore them yourself. The force flag is not stored in the policy spec.
iam_tags	object	Filter resources on IAM tags (wire: iamTags)
x_pagination_cursor	string	Pagination cursor (wire: X-Pagination-Cursor)
x_pagination_size	integer	Pagination size (wire: X-Pagination-Size)

SELECT examples

get

Returns a policy with the configuration requested and the one currently enforced, including the status of every protected IP address prefix.

SELECT
id,
checksum,
created_at,
current_state,
error_message,
iam,
resource_status,
target_spec,
updated_at
FROM ovh.network_defense.vac_resource_policies
WHERE policy_id = '{{ policy_id }}' -- required
AND resource_name = '{{ resource_name }}' -- required
;

list

Returns the list of policies within a VAC DDoS protection resource. Every policy applies a profile and a sensitivity level to target IP address prefixes, and carries the configuration requested and the one currently enforced.

SELECT
id,
checksum,
created_at,
current_state,
error_message,
iam,
resource_status,
target_spec,
updated_at
FROM ovh.network_defense.vac_resource_policies
WHERE resource_name = '{{ resource_name }}' -- required
AND x_pagination_cursor = '{{ x_pagination_cursor }}'
AND x_pagination_size = '{{ x_pagination_size }}'
AND iam_tags = '{{ iam_tags }}'
;

INSERT examples

create

Creates a policy within a VAC DDoS protection resource, applying a profile and a sensitivity level to target IP address prefixes in order to tune detection and mitigation rules. Async call, follow resourceStatus for operation progress. A target whose prefix carries protection settings that were not set via a policy is refused, unless you send force=true to overwrite them.

INSERT INTO ovh.network_defense.vac_resource_policies (
target_spec,
resource_name,
force
)
SELECT 
'{{ target_spec }}' /* required */,
'{{ resource_name }}',
'{{ force }}'
RETURNING
id,
checksum,
created_at,
current_state,
error_message,
resource_status,
target_spec,
updated_at
;

Manifest

# Description fields are for documentation purposes
- name: vac_resource_policies
props:
  - name: resource_name
    value: "{{ resource_name }}"
    description: Required parameter for the vac_resource_policies resource.
  - name: target_spec
    description: |
      Protection configuration to apply to the policy
    value:
      enabled: {{ enabled }}
      name: "{{ name }}"
      profileId: "{{ profileId }}"
      sensitivity: "{{ sensitivity }}"
      targets:
        - prefix:
            cidr: "{{ cidr }}"
  - name: force
    value: {{ force }}
    description: Overwrite the protection settings that were not set via a policy on the targets this request adds. Without it, such a request is refused. The previous settings are lost: you cannot restore them yourself. The `force` flag is not stored in the policy spec.
    description: Overwrite the protection settings that were not set via a policy on the targets this request adds. Without it, such a request is refused. The previous settings are lost: you cannot restore them yourself. The `force` flag is not stored in the policy spec.

UPDATE examples

update

Updates the name, enabled state, targets, profile and sensitivity level of a policy. The targets sent fully replace the previous ones: an omitted or empty list of targets removes every target from the policy. Removed target IPs reset their VAC DDoS protection settings to the default state. Send the checksum from the last read. A stale value is rejected. A new target whose prefix carries protection settings that were not set via a policy is refused, unless you send force=true to overwrite them.

UPDATE ovh.network_defense.vac_resource_policies
SET 
checksum = '{{ checksum }}',
target_spec = '{{ target_spec }}'
WHERE 
policy_id = '{{ policy_id }}' --required
AND resource_name = '{{ resource_name }}' --required
AND target_spec = '{{ target_spec }}' --required
AND force = {{ force}}
RETURNING
id,
checksum,
created_at,
current_state,
error_message,
resource_status,
target_spec,
updated_at;

DELETE examples

delete

Deletes a policy from a VAC DDoS protection resource. All settings of linked target IP address prefixes return to their default states.

DELETE FROM ovh.network_defense.vac_resource_policies
WHERE policy_id = '{{ policy_id }}' --required
AND resource_name = '{{ resource_name }}' --required
;