ContentScanning

Source: src/Cloudflare/ContentScanning/ContentScanning.ts

WAF Content Scanning (malicious uploads detection) on a Cloudflare zone — the /zones/{zone_id}/content-upload-scan/settings singleton toggle.

Content Scanning is a zone singleton: the setting always exists (default disabled), so this resource never creates or deletes anything physical. Reconcile PUTs the status only when the observed value differs from the desired one; destroy restores the status the zone had before Alchemy first managed it (captured as initialValue).

Content Scanning is an Enterprise paid add-on. Reading the status works on every plan, but enabling it on a zone without the add-on fails with the typed ContentScanningNotEntitled error.

Enabling Content Scanning

Turn on malicious-upload scanning for a zone

const zone = yield* Cloudflare.Zone.Zone("Site", { name: "example.com" });

yield* Cloudflare.ContentScanning.ContentScanning("UploadScanning", {
  zoneId: zone.zoneId,
});

Pin Content Scanning off

yield* Cloudflare.ContentScanning.ContentScanning("UploadScanning", {
  zoneId: zone.zoneId,
  enabled: false,
});

Custom scan expressions

const scanning = yield* Cloudflare.ContentScanning.ContentScanning("UploadScanning", {
  zoneId: zone.zoneId,
});

yield* Cloudflare.ContentScanning.Expression("ScanJsonFile", {
  zoneId: scanning.zoneId,
  payload: 'lookup_json_string(http.request.body.raw, "file")',
});