Firewall Terraform Configuration

In this guide, you will learn how to apply a series of firewall rules to multiple projects or teams by using Terraform to create configurations that are straightforward to manage and scalable.

• A Vercel account with access to the projects you want to manage.
• The Terraform CLI installed. Follow the Install Terraform guide to do this for all operating systems.
• A Vercel personal token to authenticate with the Terraform provider.
• The Vercel Terraform Provider installed.

Create a folder for your terraform setup

1
mkdir terraform-firewall
2
cd terraform-firewall

Create a .env file or export your token:

1
export VERCEL_TOKEN="your-vercel-token"

Then, create a Terraform file in your project folder and add Vercel as a provider.

Create a file called main.tf and paste the following content:

1
terraform {
2
  required_providers {
3
    vercel = {
4
      source = "vercel/vercel"
5
      version = "~> 0.3"
6
    }
7
  }
8
}

Run the following in the command line to initialize the project using main.tf:

1
terraform init

If your Vercel projects already exist, import them into Terraform state:

1
terraform import vercel_project.PROJECT_1 prj_abc123
2
terraform import vercel_project.PROJECT_2 prj_def456

Where prj_abc123 and prj_def456 are the Vercel project IDs.

This links your Terraform code to existing Vercel projects.

Your configuration will include the following rules:

• Suspicious user agents — Blocks known bots/crawlers.
• AI bots — Detects requests from AI services like GPTBot, Claude, etc.
• OFAC countries — Blocks traffic from sanctioned regions.
• WordPress URLs — Blocks scanners looking for common WordPress endpoints.
• Rate limiting — Limits API request frequency (per IP or JA4 fingerprint).

Define them in a vercel_firewall.tf file as follows:

• Suspicious user agents
  1
  variable "suspicious_user_agent_conditions" {
  2
    description = "Conditions to challenge requests with suspicious user agents."
  3
    type = list(object({
  4
      type  = string
  5
      op    = string
  6
      value = string
  7
    }))
  8
    default = [
  9
      {
  10
        type  = "user_agent"
  11
        op    = "ex"
  12
        value = "01h4x.com|360Spider|404checker|404enemy|80legs|ADmantX|AIBOT|ALittle Client|ASPSeek|Abonti|Aboundex|Aboundexbot|Acunetix|AdsTxtCrawlerTP|AfD-Verbotsverfahren|AhrefsBot|AiHitBot|Aipbot|Alexibot|AllSubmitter|Alligator|AlphaBot|Anarchie|Anarchy|Anarchy99|Ankit|Anthill|Apexoo|Aspiegel|Asterias|Atomseobot|Attach|AwarioBot|AwarioRssBot|AwarioSmartBot|BBBike|BDCbot|BDFetch|BLEXBot|BackDoorBot|BackStreet|BackWeb|Backlink-Ceck|BacklinkCrawler|BacklinksExtendedBot|Badass|Bandit|Barkrowler|BatchFTP|Battleztar Bazinga|BetaBot|Bigfoot|Bitacle|BlackWidow|Black Hole|Blackboard|Blow|BlowFish|Boardreader|Bolt|BotALot|Brandprotect|Brandwatch|Buck|Buddy|BuiltBotTough|BuiltWith|Bullseye|BunnySlippers|BuzzSumo|Bytespider|CATExplorador|CCBot|CODE87|CSHttp|Calculon|CazoodleBot|Cegbfeieh|CensysInspect|ChatGPT-User|CheTeam|CheeseBot|CherryPicker|ChinaClaw|Chlooe|Citoid|Claritybot|ClaudeBot|Cliqzbot|Cloud mapping|Cocolyzebot|Cogentbot|Collector|Copier|CopyRightCheck|Copyscape|Cosmos|Craftbot|Crawling at Home Project|CrazyWebCrawler|Crescent|CrunchBot|Curious|Custo|CyotekWebCopy|DBLBot|DIIbot|DSearch|DTS Agent|DataCha0s|DatabaseDriverMysqli|Demon|Deusu|Devil|Digincore|DigitalPebble|Dirbuster|Disco|Discobot|Discoverybot|Dispatch|DittoSpyder|DnBCrawler-Analytics|DnyzBot|DomCopBot|DomainAppender|DomainCrawler|DomainSigmaCrawler|DomainStatsBot|Domains Project|Dotbot|Download Wonder|Dragonfly|Drip|ECCP/1.0|EMail Siphon|EMail Wolf|EasyDL|Ebingbong|Ecxi|EirGrabber|EroCrawler|Evil|Exabot|Express WebPictures|ExtLinksBot|Extractor|ExtractorPro|Extreme Picture Finder|EyeNetIE|Ezooms|FDM|FHscan|FacebookBot|FemtosearchBot|Fimap|Firefox/7.0|FlashGet|Flunky|Foobot|Freeuploader|FrontPage|Fuzz|FyberSpider|Fyrebot|G-i-g-a-b-o-t|GPTBot|GT::WWW|GalaxyBot|Genieo|GermCrawler|GetRight|GetWeb|Getintent|Gigabot|Go!Zilla|Go-Ahead-Got-It|GoZilla|Gotit|GrabNet|Grabber|Grafula|GrapeFX|GrapeshotCrawler|GridBot|HEADMasterSEO|HMView|HTMLparser|HTTP::Lite|HTTrack|Haansoft|HaosouSpider|Harvest|Havij|Heritrix|Hloader|HonoluluBot|Humanlinks|HybridBot|IDBTE4M|IDBot|IRLbot|Iblog|Id-search|IlseBot|Image Fetch|Image Sucker|ImagesiftBot|IndeedBot|Indy Library|InfoNaviRobot|InfoTekies|Information Security Team InfraSec Scanner|InfraSec Scanner|Intelliseek|InterGET|InternetMeasurement|InternetSeer|Internet Ninja|Iria|Iskanie|IstellaBot|JOC Web Spider|JamesBOT|Jbrofuzz|JennyBot|JetCar|Jetty|JikeSpider|Joomla|Jorgee|JustView|Jyxobot|Kenjin Spider|Keybot Translation-Search-Machine|Keyword Density|Kinza|Kozmosbot|LNSpiderguy|LWP::Simple|Lanshanbot|Larbin|Leap|LeechFTP|LeechGet|LexiBot|Lftp|LibWeb|Libwhisker|LieBaoFast|Lightspeedsystems|Likse|LinkScan|LinkWalker|Linkbot|LinkextractorPro|LinkpadBot|LinksManager|LinqiaMetadataDownloaderBot|LinqiaRSSBot|LinqiaScrapeBot|Lipperhey|Lipperhey Spider|Litemage_walker|Lmspider|Ltx71|MFC_Tear_Sample|MIDown tool|MIIxpc|MJ12bot|MQQBrowser|MSFrontPage|MSIECrawler|MTRobot|Mag-Net|Magnet|Mail.RU_Bot|Majestic-SEO|Majestic12|Majestic SEO|MarkMonitor|MarkWatch|Mass Downloader|Masscan|Mata Hari|MauiBot|Mb2345Browser|MeanPath Bot|Meanpathbot|Mediatoolkitbot|MegaIndex.ru|Metauri|MicroMessenger|Microsoft Data Access|Microsoft URL Control|Minefield|Mister PiX|Moblie Safari|Mojeek|Mojolicious|MolokaiBot|Morfeus Fucking Scanner|Mozlila|Mr.4x3|Msrabot|Musobot|NICErsPRO|NPbot|Name Intelligence|Nameprotect|Navroad|NearSite|Needle|Nessus|NetAnts|NetLyzer|NetMechanic|NetSpider|NetZIP|Net Vampire|Netcraft|Nettrack|Netvibes|NextGenSearchBot|Nibbler|Niki-bot|Nikto|NimbleCrawler|Nimbostratus|Ninja|Nmap|Nuclei|Nutch|Octopus|Offline Explorer|Offline Navigator|OnCrawl|OpenLinkProfiler|OpenVAS|Openfind|Openvas|OrangeBot|OrangeSpider|OutclicksBot|OutfoxBot|PECL::HTTP|PHPCrawl|POE-Component-Client-HTTP|PageAnalyzer|PageGrabber|PageScorer|PageThing.com|Page Analyzer|Pandalytics|Panscient|Papa Foto|Pavuk|PeoplePal|Petalbot|Pi-Monster|Picscout|Picsearch|PictureFinder|Piepmatz|Pimonster|Pixray|PleaseCrawl|Pockey|ProPowerBot|ProWebWalker|Probethenet|Proximic|Psbot|Pu_iN|Pump|PxBroker|PyCurl|QueryN Metasearch|Quick-Crawler|RSSingBot|Rainbot|RankActive|RankActiveLinkBot|RankFlex|RankingBot|RankingBot2|Rankivabot|RankurBot|Re-re|ReGet|RealDownload|Reaper|RebelMouse|Recorder|RedesScrapy|RepoMonkey|Ripper|RocketCrawler|Rogerbot|SBIder|SEOkicks|SEOkicks-Robot|SEOlyt|SEOlyticsCrawler|SEOprofiler|SEOstats|SISTRIX|SMTBot|SalesIntelligent|ScanAlert|Scanbot|ScoutJet|Scrapy|Screaming|ScreenerBot|ScrepyBot|Searchestate|SearchmetricsBot|Seekport|SeekportBot|SemanticJuice|Semrush|SemrushBot|SentiBot|SenutoBot|SeoSiteCheckup|SeobilityBot|Seomoz|Shodan|Siphon|SiteCheckerBotCrawler|SiteExplorer|SiteLockSpider|SiteSnagger|SiteSucker|Site Sucker|Sitebeam|Siteimprove|Sitevigil|SlySearch|SmartDownload|Snake|Snapbot|Snoopy|SocialRankIOBot|Sociscraper|Sogou web spider|Sosospider|Sottopop|SpaceBison|Spammen|SpankBot|Spanner|Spbot|Spider_Bot|Spider_Bot/3.0|Spinn3r|SputnikBot|Sqlmap|Sqlworm|Sqworm|Steeler|Stripper|Sucker|Sucuri|SuperBot|SuperHTTP|Surfbot|SurveyBot|Suzuran|Swiftbot|Szukacz|T0PHackTeam|T8Abot|Teleport|TeleportPro|Telesoft|Telesphoreo|Telesphorep|TheNomad|The Intraformant|Thumbor|TightTwatBot|TinyTestBot|Titan|Toata|Toweyabot|Tracemyfile|Trendiction|Trendictionbot|True_Robot|Turingos|Turnitin|TurnitinBot|TwengaBot|Twice|Typhoeus|URLy.Warning|URLy Warning|UnisterBot|Upflow|V-BOT|VB Project|VCI|Vacuum|Vagabondo|VelenPublicWebCrawler|VeriCiteCrawler|VidibleScraper|Virusdie|VoidEYE|Voil|Voltron|WASALive-Bot|WBSearchBot|WEBDAV|WISENutbot|WPScan|WWW-Collector-E|WWW-Mechanize|WWW::Mechanize|WWWOFFLE|Wallpapers|Wallpapers/3.0|WallpapersHD|WeSEE|WebAuto|WebBandit|WebCollage|WebCopier|WebEnhancer|WebFetch|WebFuck|WebGo IS|WebImageCollector|WebLeacher|WebPix|WebReaper|WebSauger|WebStripper|WebSucker|WebWhacker|WebZIP|Web Auto|Web Collage|Web Enhancer|Web Fetch|Web Fuck|Web Pix|Web Sauger|Web Sucker|Webalta|WebmasterWorldForumBot|Webshag|WebsiteExtractor|WebsiteQuester|Website Quester|Webster|Whack|Whacker|Whatweb|Who.is Bot|Widow|WinHTTrack|WiseGuys Robot|Wonderbot|Woobot|Wotbox|Wprecon|Xaldon WebSpider|Xaldon_WebSpider|Xenu|YaK|YoudaoBot|Zade|Zauba|Zermelo|Zeus|Zitebot|ZmEu|ZoomBot|ZoominfoBot|ZumBot|ZyBorg|adscanner|anthropic-ai|archive.org_bot|arquivo-web-crawler|arquivo.pt|autoemailspider|awario.com|backlink-check|cah.io.community|check1.exe|clark-crawler|coccocbot|cognitiveseo|cohere-ai|com.plumanalytics|crawl.sogou.com|crawler.feedback|crawler4j|dataforseo.com|dataforseobot|demandbase-bot|domainsproject.org|eCatch|evc-batch|facebookscraper|gopher|heritrix|imagesift.com|instabid|internetVista monitor|ips-agent|isitwp.com|iubenda-radar|linkdexbot|linkfluence|lwp-request|lwp-trivial|magpie-crawler|meanpathbot|mediawords|muhstik-scan|netEstate NE Crawler|oBot|omgili|openai|openai.com|page scorer|pcBrowser|plumanalytics|polaris version|probe-image-size|ripz|s1z.ru|satoristudio.net|scalaj-http|scan.lol|seobility|seocompany.store|seoscanners|seostar|serpstatbot|sexsearcher|sitechecker.pro|siteripz|sogouspider|sp_auditbot|spyfu|sysscan|tAkeOut|trendiction.com|trendiction.de|ubermetrics-technologies.com|voyagerx.com|webgains-bot|webmeup-crawler|webpros.com|webprosbot|x09Mozilla|x22Mozilla|xpymep1.exe|zauba.io|zgrab"
  13
      }
  14
    ]
  15
  }

• AI bots
  1
  variable "ai_bots" {
  2
    description = "Detects common AI Bot user agents."
  3
    type = list(object({
  4
      type  = string
  5
      op    = string
  6
      value = string
  7
    }))
  8
    default = [
  9
      {
  10
        type  = "user_agent"
  11
        op    = "ex"
  12
        value = "AI2Bot|Ai2Bot-Dolma|Amazonbot|Applebot|Applebot-Extended|Bytespider|CCBot|ChatGPT-User|Claude-Web|ClaudeBot|Diffbot|FacebookBot|FriendlyCrawler|GPTBot|Google-Extended|GoogleOther|GoogleOther-Image|GoogleOther-Video|ICC-Crawler|ImagesiftBot|Meta-ExternalAgent|Meta-ExternalFetcher|OAI-SearchBot|PerplexityBot|PetalBot|Scrapy|Timpibot|VelenPublicWebCrawler|Webzio-Extended|YouBot|anthropic-ai|cohere-ai|facebookexternalhit|img2dataset|omgili|omgilibot"
  13
      }
  14
    ]
  15
  }

• OFAC countries
  1
  variable "ofac_countries" {
  2
    description = "Detects requests from OFAC sanctioned countries (Cuba, Iran, North Korea, Syria, Russia)."
  3
    type = list(object({
  4
      type   = string
  5
      op     = string
  6
      values = list(string)
  7
    }))
  8
    default = [
  9
      {
  10
        type   = "geo_country"
  11
        op     = "inc"
  12
        values = ["CU", "IR", "KP", "SY", "RU"]
  13
      }
  14
    ]
  15
  }

• WordPress URLs
  1
  variable "wordpress_urls" {
  2
    description = "Detects requests to WordPress URLs."
  3
    type = list(object({
  4
      type  = string
  5
      op    = string
  6
      value = string
  7
    }))
  8
    default = [
  9
      {
  10
        type  = "path"
  11
        op    = "ex"
  12
        value = "/(wp-admin|wp-login\\.php|xmlrpc\\.php|wp-content|wp-includes|wp-signup\\.php|wp-activate\\.php|register\\.php|wp-register\\.php)"
  13
      }
  14
    ]
  15
  }

• Rate limiting
  1
  variable "rate_limit_condition" {
  2
    description = "Rate limit API requests."
  3
    type = object({
  4
      conditions = list(object({
  5
        type  = string
  6
        op    = string
  7
        value = string
  8
      }))
  9
    })
  10
    default = {
  11
      conditions = [
  12
        {
  13
          type  = "path"
  14
          op    = "pre"
  15
          value = "/api"
  16
        }
  17
      ]
  18
    }
  19
  }
  20
  
  21
  variable "rate_limit_action" {
  22
    description = "Rate limit API requests."
  23
    type = object({
  24
      action = string
  25
      rate_limit = object({
  26
        limit  = number
  27
        window = number
  28
        keys   = list(string)
  29
        algo   = string
  30
        action = string
  31
      })
  32
      action_duration = string
  33
    })
  34
    default = {
  35
      action = "rate_limit"
  36
      rate_limit = {
  37
        limit  = 100
  38
        window = 300
  39
        keys   = ["ip", "ja4"]
  40
        algo   = "fixed_window"
  41
        action = "deny"
  42
      }
  43
      action_duration = "5m"
  44
    }
  45
  }

These are defined once and reused across both projects.

Each project (PROJECT_1, PROJECT_2) has a vercel_firewall_config that applies the rules defined in your variables.

For PROJECT_1, connect the following rules

1
resource "vercel_firewall_config" "project_1_fw_config" {
2
  project_id = vercel_project.PROJECT_1.id
3

4
  rules {
5
    rule {
6
      name        = "Suspicous User Agent - Terraform"
7
      description = "Challenge requests with suspicious user agents."
8
      condition_group = [
9
        {
10
          conditions = var.suspicious_user_agent_conditions
11
        }
12
      ]
13
      action = {
14
        action = "challenge"
15
      }
16
    }
17

18
    rule {
19
      name        = "Block AI Bots - Terraform"
20
      description = "Block requests from common AI Bot user agents."
21
      condition_group = [
22
        {
23
          conditions = var.ai_bots
24
        }
25
      ]
26
      action = {
27
        action = "challenge"
28
      }
29
    }
30

31
    rule {
32
      name        = "Block OFAC Countries - Terraform"
33
      description = "Block requests from OFAC sanctioned countries."
34
      condition_group = [
35
        {
36
          conditions = var.ofac_countries
37
        }
38
      ]
39
      action = {
40
        action = "deny"
41
      }
42
    }
43

44
    rule {
45
      name        = "Block WordPress URLs - Terraform"
46
      description = "Block requests to WordPress URLs."
47
      condition_group = [
48
        {
49
          conditions = var.wordpress_urls
50
        }
51
      ]
52
      action = {
53
        action = "deny"
54
      }
55
    }
56

57
    rule {
58
      name        = "Rate limit API"
59
      description = "apply ratelimit to requests under /api"
60
      condition_group = [{
61
        conditions = var.rate_limit_condition.conditions
62
      }]
63

64
      action = var.rate_limit_action
65
    }
66
  }
67
}

And for PROJECT_2, connect the following rules:

1
resource "vercel_firewall_config" "project_2_waf_config" {
2
  project_id = vercel_project.PROJECT_2.id
3

4
  rules {
5
    rule {
6
      name        = "Suspicous User Agent - Terraform"
7
      description = "Challenge requests with suspicious user agents."
8
      condition_group = [
9
        {
10
          conditions = var.suspicious_user_agent_conditions
11
        }
12
      ]
13
      action = {
14
        action = "challenge"
15
      }
16
    }
17

18
    rule {
19
      name        = "Block AI Bots - Terraform"
20
      description = "Block requests from common AI Bot user agents."
21
      condition_group = [
22
        {
23
          conditions = var.ai_bots
24
        }
25
      ]
26
      action = {
27
        action = "challenge"
28
      }
29
    }
30

31
    rule {
32
      name        = "Block OFAC Countries - Terraform"
33
      description = "Block requests from OFAC sanctioned countries."
34
      condition_group = [
35
        {
36
          conditions = var.ofac_countries
37
        }
38
      ]
39
      action = {
40
        action = "deny"
41
      }
42
    }
43

44
    rule {
45
      name        = "Block WordPress URLs - Terraform"
46
      description = "Block requests to WordPress URLs."
47
      condition_group = [
48
        {
49
          conditions = var.wordpress_urls
50
        }
51
      ]
52
      action = {
53
        action = "deny"
54
      }
55
    }
56

57
    rule {
58
      name        = "Rate limit API"
59
      description = "apply ratelimit to requests under /api"
60
      condition_group = [{
61
        conditions = var.rate_limit_condition.conditions
62
      }]
63

64
      action = var.rate_limit_action
65
    }
66
  }
67
}

This structure lets you enforce a consistent policy across multiple projects.

Run the following from the command line:

1
terraform init
2
terraform plan
3
terraform apply

This will apply the rules defined for each project as defined for PROJECT_1 and PROJECT_2. Terraform loads all .tf files in the current working directory, merges them, and treats them as a single configuration.

• Test with terraform plan to preview changes before applying.
• Store the project IDs and sensitive values using environment variables.