Modifying a Domain Name Protected by a Dedicated WAF Instance
Function
This API is used to update configurations of domain names protected with a dedicated WAF instance. The new origin server information will overwrite the old origin server information. If you want to keep the old information, provide them as new data. You can provide only the updated information in the request body.
Calling Method
For details, see Calling APIs.
URI
PUT /v1/{project_id}/premium-waf/host/{host_id}
| Parameter | Mandatory | Type | Description |
|---|---|---|---|
| project_id | Yes | String | Definition Project ID. To obtain it, log in to the Huawei Cloud console, click the username, choose My Credentials, and find the project ID in the Projects list. Constraints N/A Range N/A Default Value N/A |
| host_id | Yes | String | Definition Domain name ID, which is obtained by calling the API (ListPremiumHost) for obtaining domain name list in dedicated mode. Constraints N/A Range N/A Default Value N/A |
| Parameter | Mandatory | Type | Description |
|---|---|---|---|
| enterprise_project_id | No | String | Definition Obtain the enterprise project ID by calling the ListEnterpriseProject API of Enterprise Project Management Service (EPS). To obtain the resource details in all enterprise projects of a user, set this parameter to all_granted_eps. Constraints N/A Range Default Value 0 |
Request Parameters
| Parameter | Mandatory | Type | Description |
|---|---|---|---|
| Content-Type | Yes | String | Definition Content type. Constraints N/A Range N/A Default Value application/json;charset=utf8 |
| X-Auth-Token | Yes | String | Definition User token. It can be obtained by calling the IAM API (value of X-Subject-Token in the response header). Constraints N/A Range N/A Default Value N/A |
| Parameter | Mandatory | Type | Description |
|---|---|---|---|
| proxy | No | Boolean | Whether the protected domain name uses a proxy. |
| certificateid | No | String | HTTPS certificate ID. You can call the ListCertificates API to obtain it. |
| certificatename | No | String | Certificate name. |
| server | No | Array of PremiumWafServer objects | Origin server configuration of the protected domain name |
| tls | No | String | Minimum TLS version (TLS v1.0, TLS v1.1, or TLS v1.2). The default value is TLS v1.0. Requests that do not meet the minimum TLS version cannot access the website. |
| cipher | No | String | Cipher suite. Options: cipher_1, cipher_2, cipher_3, cipher_4, cipher_default.
|
| mode | No | String | Special domain name mode in dedicated mode. This parameter is required only for special WAF modes, such as ELB. |
| locked | No | Integer | This parameter is reserved for freezing and unlocking domain names. Currently, this parameter is not supported. |
| protect_status | No | Integer | Definition Domain name protection status. Constraints N/A Range
Default Value N/A |
| access_status | No | Integer | Definition Domain name access status. Constraints N/A Range Default Value N/A |
| timestamp | No | Integer | Timestamp. |
| pool_ids | No | Array of strings | Dedicated engine group to which the domain name in special mode belongs (this parameter is required only in special mode, for example, ELB access). |
| block_page | No | BlockPage object | Alarm page configuration |
| traffic_mark | No | TrafficMark object | Traffic identifier |
| circuit_breaker | No | CircuitBreaker object | Circuit breaker configuration |
| timeout_config | No | TimeoutConfig object | Timeout settings |
| flag | No | HostFlag object | Feature switch for configuring compliance certification checks for domain names protected with the dedicated WAF instance. |
| forward_header_map | No | Map<String,String> | Field forwarding configuration. WAF inserts the added fields into the header and forwards the header to the origin server. The key cannot be the same as the native Nginx field. The options of Value are as follows: |
| Parameter | Mandatory | Type | Description |
|---|---|---|---|
| template | Yes | String | Template name. default: the default page. custom: the custom alarm page. redirect: redirection. |
| custom_page | No | CustomPage object | Custom alarm page. |
| redirect_url | No | String | URL of the redirection page. |
| Parameter | Mandatory | Type | Description |
|---|---|---|---|
| status_code | Yes | String | Response status code. |
| content_type | Yes | String | Definition Content type of the custom alarm page. Constraints N/A Range Default Value N/A |
| content | Yes | String | Configure the page content based on the selected page type. For details, see the Web Application Firewall User Guide. |
| Parameter | Mandatory | Type | Description |
|---|---|---|---|
| sip | No | Array of strings | IP tag: The HTTP request header field of the original client IP address. |
| cookie | No | String | Session tag, which is used for the cookie-based known attack rules. This tag must be configured for cookie-based known attack rules. |
| params | No | String | User tag. This tag is used to block possibly malicious requests based on the Params attribute of an attack source. This tag must be configured for Params-based known attack rules. |
| Parameter | Mandatory | Type | Description |
|---|---|---|---|
| switch | No | Boolean | Breakdown protection switch that controls whether to enable connection protection. |
| dead_num | No | Integer | 502/504 error quantity threshold. The threshold is based on the total 502/504 errors occurred every 30s. |
| dead_ratio | No | Number | Percentage of 502/504 errors (%). When the percentage of 502/504 errors in the total number of requests reaches the specified value and the time threshold, breakdown protection is triggered. |
| block_time | No | Integer | Protection period upon the first breakdown. During this period, WAF stops forwarding client requests. |
| superposition_num | No | Integer | The maximum multiplier you can use for consecutive breakdowns. The number of breakdowns is counted from 0 every time the accumulated breakdown protection duration reaches 3,600s. For example, the initial protection time is set to 180s, and the continuous trigger addition coefficient is set to 3. |
| suspend_num | No | Integer | Threshold of the number of read waiting URL requests. When the number of read waiting URL requests reaches the threshold, connection protection is triggered. |
| sus_block_time | No | Integer | Breakdown protection duration when the number of read waiting URL requests exceeds the threshold. When the number of read waiting URL requests reaches the protection time triggered by the threshold, WAF stops forwarding user requests. |
| Parameter | Mandatory | Type | Description |
|---|---|---|---|
| connect_timeout | No | Integer | Timeout for WAF to connect to the origin server. |
| send_timeout | No | Integer | Timeout for WAF to send requests to the origin server. |
| read_timeout | No | Integer | Timeout for WAF to receive responses from the origin server. |
| Parameter | Mandatory | Type | Description |
|---|---|---|---|
| pci_3ds | No | String | Status of the PCI 3DS compliance check. This parameter must be used together with tls and cipher. tls must be set to TLS v1.2, and cipher must be set to cipher_2. Note: PCI 3DS compliance check cannot be disabled after being enabled. Before enabling PCI 3DS compliance check, read the description of PCI 3DS compliance check in WAF documentation in Help Center. |
| pci_dss | No | String | Status of the PCI DSS compliance check. This parameter must be used together with tls and cipher. tls must be set to TLS v1.2, and cipher must be set to cipher_2. Note: Before enabling the check, read the corresponding description in WAF documentation in Help Center. |
Response Parameters
Status code: 200
| Parameter | Type | Description |
|---|---|---|
| id | String | Domain name ID |
| hostname | String | Domain name added to the dedicated WAF instance |
| protocol | String | Client protocol, which is the protocol used by a client (for example, a browser) to access your website. |
| server | Array of PremiumWafServer objects | Origin server configuration of the protected domain name |
| proxy | Boolean | Whether a proxy is used for the protected domain name. |
| locked | Integer | This parameter is reserved, which will be used to freeze a domain name. |
| timestamp | Long | Time the domain name was added to WAF. |
| tls | String | Minimum TLS version. The value can be TLS v1.0, TLS v1.1, or TLS v1.2. TLS v1.0 is used by default. |
| cipher | String | Cipher suite. Options: cipher_1, cipher_2, cipher_3, cipher_4, cipher_default.
|
| extend | Map<String,String> | Extended field, which is used to save some configuration information about the protected domain name. |
| flag | Flag object | Special identifier, which is used on the console. |
| mode | String | elb-shared is returned if cloud load balancer access mode is used. |
| loadbalancer_id | String | ELB load balancer ID. This field is returned when the cloud load balancer access mode is used. |
| listener_id | String | ID of the listener configured for the ELB load balancer. This field is returned when the cloud load balancer access mode is used. |
| protocol_port | Integer | Service port. This field is returned when the cloud load balancer access mode is used. |
| description | String | Domain name description |
| policyid | String | ID of the policy initially used to the domain name. You can call the ListPolicy API to query the policy list and view the ID of the specific policy. |
| domainid | String | Account ID. You can obtain it from My Credentials > Account ID page on the Huawei Cloud management console. |
| projectid | String | Project ID. To obtain it, log in to the Huawei Cloud console, click the username, choose My Credentials, and find the project ID in the Projects list. |
| enterprise_project_id | String | Enterprise project ID. To obtain it, log in to the Huawei Cloud management console, click the username, choose Enterprise > Project Management, click the project name, and locate the project ID. |
| certificateid | String | HTTPS certificate ID. |
| certificatename | String | Certificate name |
| protect_status | Integer | Definition Domain name protection status. Constraints N/A Range
Default Value N/A |
| access_status | Integer | Definition Domain name access status. Constraints N/A Range Default Value N/A |
| web_tag | String | Website name, which is the same as the website name in the domain name details on the WAF console. |
| lb_algorithm | String | Load balancing algorithm. Weighted round robin is used by default and cannot be changed. |
| block_page | BlockPage object | Alarm page configuration |
| traffic_mark | TrafficMark object | Traffic identifier |
| timeout_config | TimeoutConfig object | Timeout settings |
| forward_header_map | Map<String,String> | Field forwarding configuration. WAF inserts the added fields into the header and forwards the header to the origin server. The key cannot be the same as the native Nginx field. The options of Value are as follows: |
| access_progress | Array of Access_progress objects | Access progress, which is used only for the new WAF console. |
| Parameter | Type | Description |
|---|---|---|
| pci_3ds | String | Whether to enable PCI 3DS compliance check. |
| pci_dss | String | Whether to enable PCI DSS compliance check. |
| cname | String | old: The old CNAME record is used. new: The new CNAME record is used. |
| is_dual_az | String | Whether IPv6 is enabled for the domain name. |
| ipv6 | String | Whether IPv6 is enabled for the domain name. |
| Parameter | Type | Description |
|---|---|---|
| template | String | Template name. default: the default page. custom: the custom alarm page. redirect: redirection. |
| custom_page | CustomPage object | Custom alarm page. |
| redirect_url | String | URL of the redirection page. |
| Parameter | Type | Description |
|---|---|---|
| status_code | String | Response status code. |
| content_type | String | Definition Content type of the custom alarm page. Constraints N/A Range Default Value N/A |
| content | String | Configure the page content based on the selected page type. For details, see the Web Application Firewall User Guide. |
| Parameter | Type | Description |
|---|---|---|
| sip | Array of strings | IP tag: The HTTP request header field of the original client IP address. |
| cookie | String | Session tag, which is used for the cookie-based known attack rules. This tag must be configured for cookie-based known attack rules. |
| params | String | User tag. This tag is used to block possibly malicious requests based on the Params attribute of an attack source. This tag must be configured for Params-based known attack rules. |
| Parameter | Type | Description |
|---|---|---|
| connect_timeout | Integer | Timeout for WAF to connect to the origin server. |
| send_timeout | Integer | Timeout for WAF to send requests to the origin server. |
| read_timeout | Integer | Timeout for WAF to receive responses from the origin server. |
| Parameter | Type | Description |
|---|---|---|
| step | Integer | Step. |
| status | Integer | Definition Completion status of the corresponding step. Constraints N/A Range Default Value N/A |
Status code: 400
| Parameter | Type | Description |
|---|---|---|
| error_code | String | Error code. |
| error_msg | String | Error message. |
| encoded_authorization_message | String | You can call the decode-authorization-message interface of the STS service to decode the rejection reason. For details, see the STS5 joint commissioning and self-verification. This parameter is returned only when an IAM 5 authentication error occurs. |
| details | Array of IAM5ErrorDetails objects | The set of error messages reported when a downstream service is invoked. This parameter is returned only when an IAM 5 authentication error occurs. |
| Parameter | Type | Description |
|---|---|---|
| error_code | String | Error codes of the downstream service. |
| error_msg | String | Error messages of the downstream service. |
Status code: 401
| Parameter | Type | Description |
|---|---|---|
| error_code | String | Error code. |
| error_msg | String | Error message. |
| encoded_authorization_message | String | You can call the decode-authorization-message interface of the STS service to decode the rejection reason. For details, see the STS5 joint commissioning and self-verification. This parameter is returned only when an IAM 5 authentication error occurs. |
| details | Array of IAM5ErrorDetails objects | The set of error messages reported when a downstream service is invoked. This parameter is returned only when an IAM 5 authentication error occurs. |
| Parameter | Type | Description |
|---|---|---|
| error_code | String | Error codes of the downstream service. |
| error_msg | String | Error messages of the downstream service. |
Status code: 500
| Parameter | Type | Description |
|---|---|---|
| error_code | String | Error code. |
| error_msg | String | Error message. |
| encoded_authorization_message | String | You can call the decode-authorization-message interface of the STS service to decode the rejection reason. For details, see the STS5 joint commissioning and self-verification. This parameter is returned only when an IAM 5 authentication error occurs. |
| details | Array of IAM5ErrorDetails objects | The set of error messages reported when a downstream service is invoked. This parameter is returned only when an IAM 5 authentication error occurs. |
Example Requests
The following example shows how to change proxy settings for a dedicated WAF instance. The project ID is specified by project_id. The domain name ID is specified by host_id. Proxy settings: No proxies are used.
PUT https://{Endpoint}/v1/{project_id}/premium-waf/host/{host_id}?enterprise_project_id=0
{
"proxy" : false
} Example Responses
Status code: 200
OK
{
"id" : "27995fb98a2d4928a1e453e65ee8117a",
"hostname" : "www.demo.com",
"protocol" : "HTTP",
"server" : [ {
"address" : "192.168.0.209",
"port" : 80,
"type" : "ipv4",
"weight" : 1,
"front_protocol" : "HTTP",
"back_protocol" : "HTTP",
"vpc_id" : "cf6dbace-b36a-4d51-ae04-52a8459ae247"
} ],
"proxy" : false,
"locked" : 0,
"timestamp" : 1650590814885,
"flag" : {
"pci_3ds" : "false",
"pci_dss" : "false"
},
"description" : "",
"policyid" : "9555cda636ef4ca294dfe4b14bc94c47",
"domainid" : "d4ecb00b031941ce9171b7bc3386883f",
"projectid" : "05e33ecd328025dd2f7fc00696201fb4",
"enterprise_project_id" : "0",
"protect_status" : 1,
"access_status" : 0
} SDK Sample Code
The SDK sample code is as follows.
The following example shows how to change proxy settings for a dedicated WAF instance. The project ID is specified by project_id. The domain name ID is specified by host_id. Proxy settings: No proxies are used.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 | package com.huaweicloud.sdk.test; import com.huaweicloud.sdk.core.auth.ICredential; import com.huaweicloud.sdk.core.auth.BasicCredentials; import com.huaweicloud.sdk.core.exception.ConnectionException; import com.huaweicloud.sdk.core.exception.RequestTimeoutException; import com.huaweicloud.sdk.core.exception.ServiceResponseException; import com.huaweicloud.sdk.waf.v1.region.WafRegion; import com.huaweicloud.sdk.waf.v1.*; import com.huaweicloud.sdk.waf.v1.model.*; public class UpdatePremiumHostSolution { public static void main(String[] args) { // The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security. // In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment String ak = System.getenv("CLOUD_SDK_AK"); String sk = System.getenv("CLOUD_SDK_SK"); String projectId = "{project_id}"; ICredential auth = new BasicCredentials() .withProjectId(projectId) .withAk(ak) .withSk(sk); WafClient client = WafClient.newBuilder() .withCredential(auth) .withRegion(WafRegion.valueOf("<YOUR REGION>")) .build(); UpdatePremiumHostRequest request = new UpdatePremiumHostRequest(); request.withHostId("{host_id}"); UpdatePremiumHostRequestBody body = new UpdatePremiumHostRequestBody(); body.withProxy(false); request.withBody(body); try { UpdatePremiumHostResponse response = client.updatePremiumHost(request); System.out.println(response.toString()); } catch (ConnectionException e) { e.printStackTrace(); } catch (RequestTimeoutException e) { e.printStackTrace(); } catch (ServiceResponseException e) { e.printStackTrace(); System.out.println(e.getHttpStatusCode()); System.out.println(e.getRequestId()); System.out.println(e.getErrorCode()); System.out.println(e.getErrorMsg()); } } } |
The following example shows how to change proxy settings for a dedicated WAF instance. The project ID is specified by project_id. The domain name ID is specified by host_id. Proxy settings: No proxies are used.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 | # coding: utf-8 import os from huaweicloudsdkcore.auth.credentials import BasicCredentials from huaweicloudsdkwaf.v1.region.waf_region import WafRegion from huaweicloudsdkcore.exceptions import exceptions from huaweicloudsdkwaf.v1 import * if __name__ == "__main__": # The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security. # In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment ak = os.environ["CLOUD_SDK_AK"] sk = os.environ["CLOUD_SDK_SK"] projectId = "{project_id}" credentials = BasicCredentials(ak, sk, projectId) client = WafClient.new_builder() \ .with_credentials(credentials) \ .with_region(WafRegion.value_of("<YOUR REGION>")) \ .build() try: request = UpdatePremiumHostRequest() request.host_id = "{host_id}" request.body = UpdatePremiumHostRequestBody( proxy=False ) response = client.update_premium_host(request) print(response) except exceptions.ClientRequestException as e: print(e.status_code) print(e.request_id) print(e.error_code) print(e.error_msg) |
The following example shows how to change proxy settings for a dedicated WAF instance. The project ID is specified by project_id. The domain name ID is specified by host_id. Proxy settings: No proxies are used.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 | package main import ( "fmt" "github.com/huaweicloud/huaweicloud-sdk-go-v3/core/auth/basic" waf "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/waf/v1" "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/waf/v1/model" region "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/waf/v1/region" ) func main() { // The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security. // In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment ak := os.Getenv("CLOUD_SDK_AK") sk := os.Getenv("CLOUD_SDK_SK") projectId := "{project_id}" auth, err := basic.NewCredentialsBuilder(). WithAk(ak). WithSk(sk). WithProjectId(projectId). SafeBuild() if err != nil { fmt.Println(err) return } hcClient, err := waf.WafClientBuilder(). WithRegion(region.ValueOf("<YOUR REGION>")). WithCredential(auth). SafeBuild() if err != nil { fmt.Println(err) return } client := waf.NewWafClient(hcClient) request := &model.UpdatePremiumHostRequest{} request.HostId = "{host_id}" proxyUpdatePremiumHostRequestBody:= false request.Body = &model.UpdatePremiumHostRequestBody{ Proxy: &proxyUpdatePremiumHostRequestBody, } response, err := client.UpdatePremiumHost(request) if err == nil { fmt.Printf("%+v\n", response) } else { fmt.Println(err) } } |
For SDK sample code of more programming languages, see the Sample Code tab in API Explorer. SDK sample code can be automatically generated.
Status Codes
| Status Code | Description |
|---|---|
| 200 | OK |
| 400 | Invalid request. |
| 401 | The token does not have the required permission. |
| 500 | Internal server error. |
Error Codes
See Error Codes.
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.
For any further questions, feel free to contact us through the chatbot.
Chatbot