---
layout: "fastly"
page_title: "Fastly: ngwaf_workspace"
sidebar_current: "docs-fastly-resource-ngwaf-workspace"
description: |-
  Provides a Fastly Next-Gen WAF Workspace
---

# fastly_ngwaf_workspace

Provides a Fastly Next-Gen WAF Workspace, representing a container for
rules, signals, and various other resources that are offered by the
Next-Gen WAF product.

## Example Usage

Basic usage:

```terraform
resource "fastly_ngwaf_workspace" "demo" {
  name                         = "Demo"
  description                  = "Testing"
  mode                         = "block"

  attack_signal_thresholds {
    one_minute  = 100
    ten_minutes = 500
    one_hour    = 1000
    immediate   = true
  }
}
```

## Import

Fastly Next-Gen WAF Workspaces can be imported using their workspace ID, e.g.

```sh
$ terraform import fastly_ngwaf_workspace.demo xxxxxxxxxxxxxxxxxxxx
```

<!-- schema generated by tfplugindocs -->
## Schema

### Required

- `attack_signal_thresholds` (Block List, Min: 1, Max: 1) Attack threshold parameters for system site alerts. Each threshold value is the number of attack signals per IP address that must be detected during the interval before the related IP address is flagged. If no values are set then the default value for each field will be applied (see [below for nested schema](#nestedblock--attack_signal_thresholds))
- `description` (String) The description of the workspace
- `mode` (String) The operation mode of the workspace. Accepted values are `off`, `block`, and `log`.
- `name` (String) The display name of the workspace.

### Optional

- `client_ip_headers` (List of String) Specifies the request headers containing the client IP address. Maximum of 10 header names.
- `default_blocking_response_code` (Number) The status code returned when a request is blocked. This configuration is applied at the workspace but can be overwritten in rules. Accepted values are [`301`, `302`, `400..599`]. Default value `406`.
- `default_redirect_url` (String) The redirect URL used if default_blocking_response_code is `301` or `302`.
- `ip_anonymization` (String) Agents will anonymize IP addresses according to the option selected. Accepted value is `hashed`.

### Read-Only

- `id` (String) The ID of this resource.

<a id="nestedblock--attack_signal_thresholds"></a>
### Nested Schema for `attack_signal_thresholds`

Optional:

- `immediate` (Boolean) Ignore thresholds and block immediately when at least one attack signal is detected. Default value `false`.
- `one_hour` (Number) The one-hour interval threshold. Minimum 1 and maximum 10,000. Default value 100.
- `one_minute` (Number) The one-minute interval threshold. Minimum 1 and maximum 10,000. Default value 1.
- `ten_minutes` (Number) The ten-minute interval threshold. Minimum 1 and maximum 10,000. Default value 60.
