scm.SecurityRule

import * as pulumi from "@pulumi/pulumi";
import * as scm from "@pulumi/scm";

// First, create the tag objects that you will reference.
const outboundTag = new scm.Tag("outbound_tag", {
    folder: "All",
    name: "outbound143",
    color: "Red",
});
const webTag = new scm.Tag("web_tag", {
    folder: "All",
    name: "web143",
    color: "Blue",
});
// --- Existing Rules (Backward Compatibility) ---
const standardWebAccess = new scm.SecurityRule("standard_web_access", {
    folder: "All",
    name: "Allow Standard Web Access143",
    description: "Allow outbound web traffic to any destination...",
    position: "pre",
    action: "allow",
    categories: ["any"],
    applications: [
        "web-browsing",
        "ssl",
    ],
    services: [
        "service-http",
        "service-https",
    ],
    froms: [
        "untrust",
        "trust",
    ],
    tos: ["trust"],
    sources: ["any"],
    destinations: ["any"],
    negateSource: false,
    negateDestination: false,
    sourceUsers: ["any"],
    sourceHips: ["any"],
    destinationHips: ["any"],
    logStart: true,
    logEnd: true,
    disabled: false,
    tags: [
        outboundTag.name,
        webTag.name,
    ],
});
const blockRiskySaas = new scm.SecurityRule("block_risky_saas", {
    folder: "All",
    name: "Block Risky SaaS Applications143",
    description: "Prevent data exfiltration by blocking risky SaaS apps...",
    action: "deny",
    policyType: "Internet",
    securitySettings: {
        antiSpyware: "yes",
        vulnerability: "yes",
        virusAndWildfireAnalysis: "yes",
    },
    blockWebApplications: ["facebook-posting"],
    logSettings: {
        logSessions: true,
    },
    froms: ["any"],
    tos: ["any"],
    sources: ["any"],
    destinations: ["any"],
    sourceUsers: ["any"],
    disabled: false,
    tags: [
        outboundTag.name,
        webTag.name,
    ],
});
// --- NEW Examples Demonstrating Rule Ordering ---
// Example 1: Place a critical block rule at the absolute top
const criticalBlockTop = new scm.SecurityRule("critical_block_top", {
    folder: "All",
    name: "CRITICAL Block Malicious IPs Top143",
    description: "Always block known malicious IPs first.",
    relativePosition: "top",
    action: "deny",
    froms: ["any"],
    tos: ["any"],
    sources: ["any"],
    destinations: ["any"],
    sourceUsers: ["any"],
    categories: ["any"],
    applications: ["any"],
    services: ["any"],
    logEnd: true,
    tags: [outboundTag.name],
});
// Example 2: Place a cleanup rule at the absolute bottom
const cleanupDenyBottom = new scm.SecurityRule("cleanup_deny_bottom", {
    folder: "All",
    name: "Cleanup Deny All Bottom143",
    description: "Deny any traffic not explicitly allowed.",
    relativePosition: "bottom",
    action: "deny",
    froms: ["any"],
    tos: ["any"],
    sources: ["any"],
    destinations: ["any"],
    sourceUsers: ["any"],
    categories: ["any"],
    applications: ["any"],
    services: ["any"],
    logEnd: true,
    tags: [outboundTag.name],
});
// Example 3: Place a rule *before* the standard web access rule
const allowUpdatesBeforeWeb = new scm.SecurityRule("allow_updates_before_web", {
    folder: "All",
    name: "Allow OS Updates Before Web143",
    description: "Allow specific OS update traffic before general web access.",
    relativePosition: "before",
    targetRule: standardWebAccess.id,
    action: "allow",
    froms: ["trust"],
    tos: ["untrust"],
    sources: ["any"],
    destinations: ["any"],
    sourceUsers: ["any"],
    categories: ["any"],
    applications: [
        "ms-update",
        "apple-update",
    ],
    services: ["service-https"],
    logEnd: true,
    tags: [outboundTag.name],
});
// Example 4: Place a rule *after* the standard web access rule
const allowCorpAppsAfterWeb = new scm.SecurityRule("allow_corp_apps_after_web", {
    folder: "All",
    name: "Allow Corp Apps After Web143",
    description: "Allow access to specific corporate apps after general web access.",
    relativePosition: "after",
    targetRule: standardWebAccess.id,
    action: "allow",
    froms: ["trust"],
    tos: ["untrust"],
    sources: ["any"],
    destinations: ["any"],
    sourceUsers: ["any"],
    categories: ["any"],
    applications: ["ms-update"],
    services: ["service-https"],
    logEnd: true,
    tags: [webTag.name],
});

import pulumi
import pulumi_scm as scm

# First, create the tag objects that you will reference.
outbound_tag = scm.Tag("outbound_tag",
    folder="All",
    name="outbound143",
    color="Red")
web_tag = scm.Tag("web_tag",
    folder="All",
    name="web143",
    color="Blue")
# --- Existing Rules (Backward Compatibility) ---
standard_web_access = scm.SecurityRule("standard_web_access",
    folder="All",
    name="Allow Standard Web Access143",
    description="Allow outbound web traffic to any destination...",
    position="pre",
    action="allow",
    categories=["any"],
    applications=[
        "web-browsing",
        "ssl",
    ],
    services=[
        "service-http",
        "service-https",
    ],
    froms=[
        "untrust",
        "trust",
    ],
    tos=["trust"],
    sources=["any"],
    destinations=["any"],
    negate_source=False,
    negate_destination=False,
    source_users=["any"],
    source_hips=["any"],
    destination_hips=["any"],
    log_start=True,
    log_end=True,
    disabled=False,
    tags=[
        outbound_tag.name,
        web_tag.name,
    ])
block_risky_saas = scm.SecurityRule("block_risky_saas",
    folder="All",
    name="Block Risky SaaS Applications143",
    description="Prevent data exfiltration by blocking risky SaaS apps...",
    action="deny",
    policy_type="Internet",
    security_settings={
        "anti_spyware": "yes",
        "vulnerability": "yes",
        "virus_and_wildfire_analysis": "yes",
    },
    block_web_applications=["facebook-posting"],
    log_settings={
        "log_sessions": True,
    },
    froms=["any"],
    tos=["any"],
    sources=["any"],
    destinations=["any"],
    source_users=["any"],
    disabled=False,
    tags=[
        outbound_tag.name,
        web_tag.name,
    ])
# --- NEW Examples Demonstrating Rule Ordering ---
# Example 1: Place a critical block rule at the absolute top
critical_block_top = scm.SecurityRule("critical_block_top",
    folder="All",
    name="CRITICAL Block Malicious IPs Top143",
    description="Always block known malicious IPs first.",
    relative_position="top",
    action="deny",
    froms=["any"],
    tos=["any"],
    sources=["any"],
    destinations=["any"],
    source_users=["any"],
    categories=["any"],
    applications=["any"],
    services=["any"],
    log_end=True,
    tags=[outbound_tag.name])
# Example 2: Place a cleanup rule at the absolute bottom
cleanup_deny_bottom = scm.SecurityRule("cleanup_deny_bottom",
    folder="All",
    name="Cleanup Deny All Bottom143",
    description="Deny any traffic not explicitly allowed.",
    relative_position="bottom",
    action="deny",
    froms=["any"],
    tos=["any"],
    sources=["any"],
    destinations=["any"],
    source_users=["any"],
    categories=["any"],
    applications=["any"],
    services=["any"],
    log_end=True,
    tags=[outbound_tag.name])
# Example 3: Place a rule *before* the standard web access rule
allow_updates_before_web = scm.SecurityRule("allow_updates_before_web",
    folder="All",
    name="Allow OS Updates Before Web143",
    description="Allow specific OS update traffic before general web access.",
    relative_position="before",
    target_rule=standard_web_access.id,
    action="allow",
    froms=["trust"],
    tos=["untrust"],
    sources=["any"],
    destinations=["any"],
    source_users=["any"],
    categories=["any"],
    applications=[
        "ms-update",
        "apple-update",
    ],
    services=["service-https"],
    log_end=True,
    tags=[outbound_tag.name])
# Example 4: Place a rule *after* the standard web access rule
allow_corp_apps_after_web = scm.SecurityRule("allow_corp_apps_after_web",
    folder="All",
    name="Allow Corp Apps After Web143",
    description="Allow access to specific corporate apps after general web access.",
    relative_position="after",
    target_rule=standard_web_access.id,
    action="allow",
    froms=["trust"],
    tos=["untrust"],
    sources=["any"],
    destinations=["any"],
    source_users=["any"],
    categories=["any"],
    applications=["ms-update"],
    services=["service-https"],
    log_end=True,
    tags=[web_tag.name])

package main

import (
	"github.com/pulumi/pulumi-scm/sdk/go/scm"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		// First, create the tag objects that you will reference.
		outboundTag, err := scm.NewTag(ctx, "outbound_tag", &scm.TagArgs{
			Folder: pulumi.String("All"),
			Name:   pulumi.String("outbound143"),
			Color:  pulumi.String("Red"),
		})
		if err != nil {
			return err
		}
		webTag, err := scm.NewTag(ctx, "web_tag", &scm.TagArgs{
			Folder: pulumi.String("All"),
			Name:   pulumi.String("web143"),
			Color:  pulumi.String("Blue"),
		})
		if err != nil {
			return err
		}
		// --- Existing Rules (Backward Compatibility) ---
		standardWebAccess, err := scm.NewSecurityRule(ctx, "standard_web_access", &scm.SecurityRuleArgs{
			Folder:      pulumi.String("All"),
			Name:        pulumi.String("Allow Standard Web Access143"),
			Description: pulumi.String("Allow outbound web traffic to any destination..."),
			Position:    pulumi.String("pre"),
			Action:      pulumi.String("allow"),
			Categories: pulumi.StringArray{
				pulumi.String("any"),
			},
			Applications: pulumi.StringArray{
				pulumi.String("web-browsing"),
				pulumi.String("ssl"),
			},
			Services: pulumi.StringArray{
				pulumi.String("service-http"),
				pulumi.String("service-https"),
			},
			Froms: pulumi.StringArray{
				pulumi.String("untrust"),
				pulumi.String("trust"),
			},
			Tos: pulumi.StringArray{
				pulumi.String("trust"),
			},
			Sources: pulumi.StringArray{
				pulumi.String("any"),
			},
			Destinations: pulumi.StringArray{
				pulumi.String("any"),
			},
			NegateSource:      pulumi.Bool(false),
			NegateDestination: pulumi.Bool(false),
			SourceUsers: pulumi.StringArray{
				pulumi.String("any"),
			},
			SourceHips: pulumi.StringArray{
				pulumi.String("any"),
			},
			DestinationHips: pulumi.StringArray{
				pulumi.String("any"),
			},
			LogStart: pulumi.Bool(true),
			LogEnd:   pulumi.Bool(true),
			Disabled: pulumi.Bool(false),
			Tags: pulumi.StringArray{
				outboundTag.Name,
				webTag.Name,
			},
		})
		if err != nil {
			return err
		}
		_, err = scm.NewSecurityRule(ctx, "block_risky_saas", &scm.SecurityRuleArgs{
			Folder:      pulumi.String("All"),
			Name:        pulumi.String("Block Risky SaaS Applications143"),
			Description: pulumi.String("Prevent data exfiltration by blocking risky SaaS apps..."),
			Action:      pulumi.String("deny"),
			PolicyType:  pulumi.String("Internet"),
			SecuritySettings: &scm.SecurityRuleSecuritySettingsArgs{
				AntiSpyware:              pulumi.String("yes"),
				Vulnerability:            pulumi.String("yes"),
				VirusAndWildfireAnalysis: pulumi.String("yes"),
			},
			BlockWebApplications: pulumi.StringArray{
				pulumi.String("facebook-posting"),
			},
			LogSettings: &scm.SecurityRuleLogSettingsArgs{
				LogSessions: pulumi.Bool(true),
			},
			Froms: pulumi.StringArray{
				pulumi.String("any"),
			},
			Tos: pulumi.StringArray{
				pulumi.String("any"),
			},
			Sources: pulumi.StringArray{
				pulumi.String("any"),
			},
			Destinations: pulumi.StringArray{
				pulumi.String("any"),
			},
			SourceUsers: pulumi.StringArray{
				pulumi.String("any"),
			},
			Disabled: pulumi.Bool(false),
			Tags: pulumi.StringArray{
				outboundTag.Name,
				webTag.Name,
			},
		})
		if err != nil {
			return err
		}
		// Example 1: Place a critical block rule at the absolute top
		_, err = scm.NewSecurityRule(ctx, "critical_block_top", &scm.SecurityRuleArgs{
			Folder:           pulumi.String("All"),
			Name:             pulumi.String("CRITICAL Block Malicious IPs Top143"),
			Description:      pulumi.String("Always block known malicious IPs first."),
			RelativePosition: pulumi.String("top"),
			Action:           pulumi.String("deny"),
			Froms: pulumi.StringArray{
				pulumi.String("any"),
			},
			Tos: pulumi.StringArray{
				pulumi.String("any"),
			},
			Sources: pulumi.StringArray{
				pulumi.String("any"),
			},
			Destinations: pulumi.StringArray{
				pulumi.String("any"),
			},
			SourceUsers: pulumi.StringArray{
				pulumi.String("any"),
			},
			Categories: pulumi.StringArray{
				pulumi.String("any"),
			},
			Applications: pulumi.StringArray{
				pulumi.String("any"),
			},
			Services: pulumi.StringArray{
				pulumi.String("any"),
			},
			LogEnd: pulumi.Bool(true),
			Tags: pulumi.StringArray{
				outboundTag.Name,
			},
		})
		if err != nil {
			return err
		}
		// Example 2: Place a cleanup rule at the absolute bottom
		_, err = scm.NewSecurityRule(ctx, "cleanup_deny_bottom", &scm.SecurityRuleArgs{
			Folder:           pulumi.String("All"),
			Name:             pulumi.String("Cleanup Deny All Bottom143"),
			Description:      pulumi.String("Deny any traffic not explicitly allowed."),
			RelativePosition: pulumi.String("bottom"),
			Action:           pulumi.String("deny"),
			Froms: pulumi.StringArray{
				pulumi.String("any"),
			},
			Tos: pulumi.StringArray{
				pulumi.String("any"),
			},
			Sources: pulumi.StringArray{
				pulumi.String("any"),
			},
			Destinations: pulumi.StringArray{
				pulumi.String("any"),
			},
			SourceUsers: pulumi.StringArray{
				pulumi.String("any"),
			},
			Categories: pulumi.StringArray{
				pulumi.String("any"),
			},
			Applications: pulumi.StringArray{
				pulumi.String("any"),
			},
			Services: pulumi.StringArray{
				pulumi.String("any"),
			},
			LogEnd: pulumi.Bool(true),
			Tags: pulumi.StringArray{
				outboundTag.Name,
			},
		})
		if err != nil {
			return err
		}
		// Example 3: Place a rule *before* the standard web access rule
		_, err = scm.NewSecurityRule(ctx, "allow_updates_before_web", &scm.SecurityRuleArgs{
			Folder:           pulumi.String("All"),
			Name:             pulumi.String("Allow OS Updates Before Web143"),
			Description:      pulumi.String("Allow specific OS update traffic before general web access."),
			RelativePosition: pulumi.String("before"),
			TargetRule:       standardWebAccess.ID(),
			Action:           pulumi.String("allow"),
			Froms: pulumi.StringArray{
				pulumi.String("trust"),
			},
			Tos: pulumi.StringArray{
				pulumi.String("untrust"),
			},
			Sources: pulumi.StringArray{
				pulumi.String("any"),
			},
			Destinations: pulumi.StringArray{
				pulumi.String("any"),
			},
			SourceUsers: pulumi.StringArray{
				pulumi.String("any"),
			},
			Categories: pulumi.StringArray{
				pulumi.String("any"),
			},
			Applications: pulumi.StringArray{
				pulumi.String("ms-update"),
				pulumi.String("apple-update"),
			},
			Services: pulumi.StringArray{
				pulumi.String("service-https"),
			},
			LogEnd: pulumi.Bool(true),
			Tags: pulumi.StringArray{
				outboundTag.Name,
			},
		})
		if err != nil {
			return err
		}
		// Example 4: Place a rule *after* the standard web access rule
		_, err = scm.NewSecurityRule(ctx, "allow_corp_apps_after_web", &scm.SecurityRuleArgs{
			Folder:           pulumi.String("All"),
			Name:             pulumi.String("Allow Corp Apps After Web143"),
			Description:      pulumi.String("Allow access to specific corporate apps after general web access."),
			RelativePosition: pulumi.String("after"),
			TargetRule:       standardWebAccess.ID(),
			Action:           pulumi.String("allow"),
			Froms: pulumi.StringArray{
				pulumi.String("trust"),
			},
			Tos: pulumi.StringArray{
				pulumi.String("untrust"),
			},
			Sources: pulumi.StringArray{
				pulumi.String("any"),
			},
			Destinations: pulumi.StringArray{
				pulumi.String("any"),
			},
			SourceUsers: pulumi.StringArray{
				pulumi.String("any"),
			},
			Categories: pulumi.StringArray{
				pulumi.String("any"),
			},
			Applications: pulumi.StringArray{
				pulumi.String("ms-update"),
			},
			Services: pulumi.StringArray{
				pulumi.String("service-https"),
			},
			LogEnd: pulumi.Bool(true),
			Tags: pulumi.StringArray{
				webTag.Name,
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Scm = Pulumi.Scm;

return await Deployment.RunAsync(() => 
{
    // First, create the tag objects that you will reference.
    var outboundTag = new Scm.Tag("outbound_tag", new()
    {
        Folder = "All",
        Name = "outbound143",
        Color = "Red",
    });

    var webTag = new Scm.Tag("web_tag", new()
    {
        Folder = "All",
        Name = "web143",
        Color = "Blue",
    });

    // --- Existing Rules (Backward Compatibility) ---
    var standardWebAccess = new Scm.SecurityRule("standard_web_access", new()
    {
        Folder = "All",
        Name = "Allow Standard Web Access143",
        Description = "Allow outbound web traffic to any destination...",
        Position = "pre",
        Action = "allow",
        Categories = new[]
        {
            "any",
        },
        Applications = new[]
        {
            "web-browsing",
            "ssl",
        },
        Services = new[]
        {
            "service-http",
            "service-https",
        },
        Froms = new[]
        {
            "untrust",
            "trust",
        },
        Tos = new[]
        {
            "trust",
        },
        Sources = new[]
        {
            "any",
        },
        Destinations = new[]
        {
            "any",
        },
        NegateSource = false,
        NegateDestination = false,
        SourceUsers = new[]
        {
            "any",
        },
        SourceHips = new[]
        {
            "any",
        },
        DestinationHips = new[]
        {
            "any",
        },
        LogStart = true,
        LogEnd = true,
        Disabled = false,
        Tags = new[]
        {
            outboundTag.Name,
            webTag.Name,
        },
    });

    var blockRiskySaas = new Scm.SecurityRule("block_risky_saas", new()
    {
        Folder = "All",
        Name = "Block Risky SaaS Applications143",
        Description = "Prevent data exfiltration by blocking risky SaaS apps...",
        Action = "deny",
        PolicyType = "Internet",
        SecuritySettings = new Scm.Inputs.SecurityRuleSecuritySettingsArgs
        {
            AntiSpyware = "yes",
            Vulnerability = "yes",
            VirusAndWildfireAnalysis = "yes",
        },
        BlockWebApplications = new[]
        {
            "facebook-posting",
        },
        LogSettings = new Scm.Inputs.SecurityRuleLogSettingsArgs
        {
            LogSessions = true,
        },
        Froms = new[]
        {
            "any",
        },
        Tos = new[]
        {
            "any",
        },
        Sources = new[]
        {
            "any",
        },
        Destinations = new[]
        {
            "any",
        },
        SourceUsers = new[]
        {
            "any",
        },
        Disabled = false,
        Tags = new[]
        {
            outboundTag.Name,
            webTag.Name,
        },
    });

    // --- NEW Examples Demonstrating Rule Ordering ---
    // Example 1: Place a critical block rule at the absolute top
    var criticalBlockTop = new Scm.SecurityRule("critical_block_top", new()
    {
        Folder = "All",
        Name = "CRITICAL Block Malicious IPs Top143",
        Description = "Always block known malicious IPs first.",
        RelativePosition = "top",
        Action = "deny",
        Froms = new[]
        {
            "any",
        },
        Tos = new[]
        {
            "any",
        },
        Sources = new[]
        {
            "any",
        },
        Destinations = new[]
        {
            "any",
        },
        SourceUsers = new[]
        {
            "any",
        },
        Categories = new[]
        {
            "any",
        },
        Applications = new[]
        {
            "any",
        },
        Services = new[]
        {
            "any",
        },
        LogEnd = true,
        Tags = new[]
        {
            outboundTag.Name,
        },
    });

    // Example 2: Place a cleanup rule at the absolute bottom
    var cleanupDenyBottom = new Scm.SecurityRule("cleanup_deny_bottom", new()
    {
        Folder = "All",
        Name = "Cleanup Deny All Bottom143",
        Description = "Deny any traffic not explicitly allowed.",
        RelativePosition = "bottom",
        Action = "deny",
        Froms = new[]
        {
            "any",
        },
        Tos = new[]
        {
            "any",
        },
        Sources = new[]
        {
            "any",
        },
        Destinations = new[]
        {
            "any",
        },
        SourceUsers = new[]
        {
            "any",
        },
        Categories = new[]
        {
            "any",
        },
        Applications = new[]
        {
            "any",
        },
        Services = new[]
        {
            "any",
        },
        LogEnd = true,
        Tags = new[]
        {
            outboundTag.Name,
        },
    });

    // Example 3: Place a rule *before* the standard web access rule
    var allowUpdatesBeforeWeb = new Scm.SecurityRule("allow_updates_before_web", new()
    {
        Folder = "All",
        Name = "Allow OS Updates Before Web143",
        Description = "Allow specific OS update traffic before general web access.",
        RelativePosition = "before",
        TargetRule = standardWebAccess.Id,
        Action = "allow",
        Froms = new[]
        {
            "trust",
        },
        Tos = new[]
        {
            "untrust",
        },
        Sources = new[]
        {
            "any",
        },
        Destinations = new[]
        {
            "any",
        },
        SourceUsers = new[]
        {
            "any",
        },
        Categories = new[]
        {
            "any",
        },
        Applications = new[]
        {
            "ms-update",
            "apple-update",
        },
        Services = new[]
        {
            "service-https",
        },
        LogEnd = true,
        Tags = new[]
        {
            outboundTag.Name,
        },
    });

    // Example 4: Place a rule *after* the standard web access rule
    var allowCorpAppsAfterWeb = new Scm.SecurityRule("allow_corp_apps_after_web", new()
    {
        Folder = "All",
        Name = "Allow Corp Apps After Web143",
        Description = "Allow access to specific corporate apps after general web access.",
        RelativePosition = "after",
        TargetRule = standardWebAccess.Id,
        Action = "allow",
        Froms = new[]
        {
            "trust",
        },
        Tos = new[]
        {
            "untrust",
        },
        Sources = new[]
        {
            "any",
        },
        Destinations = new[]
        {
            "any",
        },
        SourceUsers = new[]
        {
            "any",
        },
        Categories = new[]
        {
            "any",
        },
        Applications = new[]
        {
            "ms-update",
        },
        Services = new[]
        {
            "service-https",
        },
        LogEnd = true,
        Tags = new[]
        {
            webTag.Name,
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.scm.Tag;
import com.pulumi.scm.TagArgs;
import com.pulumi.scm.SecurityRule;
import com.pulumi.scm.SecurityRuleArgs;
import com.pulumi.scm.inputs.SecurityRuleSecuritySettingsArgs;
import com.pulumi.scm.inputs.SecurityRuleLogSettingsArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        // First, create the tag objects that you will reference.
        var outboundTag = new Tag("outboundTag", TagArgs.builder()
            .folder("All")
            .name("outbound143")
            .color("Red")
            .build());

        var webTag = new Tag("webTag", TagArgs.builder()
            .folder("All")
            .name("web143")
            .color("Blue")
            .build());

        // --- Existing Rules (Backward Compatibility) ---
        var standardWebAccess = new SecurityRule("standardWebAccess", SecurityRuleArgs.builder()
            .folder("All")
            .name("Allow Standard Web Access143")
            .description("Allow outbound web traffic to any destination...")
            .position("pre")
            .action("allow")
            .categories("any")
            .applications(            
                "web-browsing",
                "ssl")
            .services(            
                "service-http",
                "service-https")
            .froms(            
                "untrust",
                "trust")
            .tos("trust")
            .sources("any")
            .destinations("any")
            .negateSource(false)
            .negateDestination(false)
            .sourceUsers("any")
            .sourceHips("any")
            .destinationHips("any")
            .logStart(true)
            .logEnd(true)
            .disabled(false)
            .tags(            
                outboundTag.name(),
                webTag.name())
            .build());

        var blockRiskySaas = new SecurityRule("blockRiskySaas", SecurityRuleArgs.builder()
            .folder("All")
            .name("Block Risky SaaS Applications143")
            .description("Prevent data exfiltration by blocking risky SaaS apps...")
            .action("deny")
            .policyType("Internet")
            .securitySettings(SecurityRuleSecuritySettingsArgs.builder()
                .antiSpyware("yes")
                .vulnerability("yes")
                .virusAndWildfireAnalysis("yes")
                .build())
            .blockWebApplications("facebook-posting")
            .logSettings(SecurityRuleLogSettingsArgs.builder()
                .logSessions(true)
                .build())
            .froms("any")
            .tos("any")
            .sources("any")
            .destinations("any")
            .sourceUsers("any")
            .disabled(false)
            .tags(            
                outboundTag.name(),
                webTag.name())
            .build());

        // --- NEW Examples Demonstrating Rule Ordering ---
        // Example 1: Place a critical block rule at the absolute top
        var criticalBlockTop = new SecurityRule("criticalBlockTop", SecurityRuleArgs.builder()
            .folder("All")
            .name("CRITICAL Block Malicious IPs Top143")
            .description("Always block known malicious IPs first.")
            .relativePosition("top")
            .action("deny")
            .froms("any")
            .tos("any")
            .sources("any")
            .destinations("any")
            .sourceUsers("any")
            .categories("any")
            .applications("any")
            .services("any")
            .logEnd(true)
            .tags(outboundTag.name())
            .build());

        // Example 2: Place a cleanup rule at the absolute bottom
        var cleanupDenyBottom = new SecurityRule("cleanupDenyBottom", SecurityRuleArgs.builder()
            .folder("All")
            .name("Cleanup Deny All Bottom143")
            .description("Deny any traffic not explicitly allowed.")
            .relativePosition("bottom")
            .action("deny")
            .froms("any")
            .tos("any")
            .sources("any")
            .destinations("any")
            .sourceUsers("any")
            .categories("any")
            .applications("any")
            .services("any")
            .logEnd(true)
            .tags(outboundTag.name())
            .build());

        // Example 3: Place a rule *before* the standard web access rule
        var allowUpdatesBeforeWeb = new SecurityRule("allowUpdatesBeforeWeb", SecurityRuleArgs.builder()
            .folder("All")
            .name("Allow OS Updates Before Web143")
            .description("Allow specific OS update traffic before general web access.")
            .relativePosition("before")
            .targetRule(standardWebAccess.id())
            .action("allow")
            .froms("trust")
            .tos("untrust")
            .sources("any")
            .destinations("any")
            .sourceUsers("any")
            .categories("any")
            .applications(            
                "ms-update",
                "apple-update")
            .services("service-https")
            .logEnd(true)
            .tags(outboundTag.name())
            .build());

        // Example 4: Place a rule *after* the standard web access rule
        var allowCorpAppsAfterWeb = new SecurityRule("allowCorpAppsAfterWeb", SecurityRuleArgs.builder()
            .folder("All")
            .name("Allow Corp Apps After Web143")
            .description("Allow access to specific corporate apps after general web access.")
            .relativePosition("after")
            .targetRule(standardWebAccess.id())
            .action("allow")
            .froms("trust")
            .tos("untrust")
            .sources("any")
            .destinations("any")
            .sourceUsers("any")
            .categories("any")
            .applications("ms-update")
            .services("service-https")
            .logEnd(true)
            .tags(webTag.name())
            .build());

    }
}

resources:
  # First, create the tag objects that you will reference.
  outboundTag:
    type: scm:Tag
    name: outbound_tag
    properties:
      folder: All
      name: outbound143
      color: Red
  webTag:
    type: scm:Tag
    name: web_tag
    properties:
      folder: All
      name: web143
      color: Blue
  # --- Existing Rules (Backward Compatibility) ---
  standardWebAccess:
    type: scm:SecurityRule
    name: standard_web_access
    properties:
      folder: All
      name: Allow Standard Web Access143
      description: Allow outbound web traffic to any destination...
      position: pre
      action: allow
      categories:
        - any
      applications:
        - web-browsing
        - ssl
      services:
        - service-http
        - service-https
      froms:
        - untrust
        - trust
      tos:
        - trust
      sources:
        - any
      destinations:
        - any
      negateSource: false
      negateDestination: false # Identity & Content
      sourceUsers: #
        - any
      sourceHips: # Security-only
        - any
      destinationHips: # Security-only
        - any
      logStart: true # Security-only
      logEnd: true # Optional fields
      disabled: false # Use the names of the tags you just created.
      tags: #
        - ${outboundTag.name}
        - ${webTag.name}
  blockRiskySaas: # --- NEW Examples Demonstrating Rule Ordering ---
    type: scm:SecurityRule
    name: block_risky_saas
    properties:
      folder: All
      name: Block Risky SaaS Applications143
      description: Prevent data exfiltration by blocking risky SaaS apps...
      action: deny
      policyType: Internet
      securitySettings:
        antiSpyware: yes
        vulnerability: yes
        virusAndWildfireAnalysis: yes
      blockWebApplications:
        - facebook-posting
      logSettings:
        logSessions: true
      froms:
        - any
      tos:
        - any
      sources:
        - any
      destinations:
        - any
      sourceUsers:
        - any
      disabled: false
      tags:
        - ${outboundTag.name}
        - ${webTag.name}
  # Example 1: Place a critical block rule at the absolute top
  criticalBlockTop:
    type: scm:SecurityRule
    name: critical_block_top
    properties:
      folder: All
      name: CRITICAL Block Malicious IPs Top143
      description: Always block known malicious IPs first.
      relativePosition: top
      action: deny
      froms:
        - any
      tos:
        - any
      sources:
        - any
      destinations:
        - any
      sourceUsers:
        - any
      categories:
        - any
      applications:
        - any
      services:
        - any
      logEnd: true
      tags:
        - ${outboundTag.name}
  # Example 2: Place a cleanup rule at the absolute bottom
  cleanupDenyBottom:
    type: scm:SecurityRule
    name: cleanup_deny_bottom
    properties:
      folder: All
      name: Cleanup Deny All Bottom143
      description: Deny any traffic not explicitly allowed.
      relativePosition: bottom
      action: deny
      froms:
        - any
      tos:
        - any
      sources:
        - any
      destinations:
        - any
      sourceUsers:
        - any
      categories:
        - any
      applications:
        - any
      services:
        - any
      logEnd: true
      tags:
        - ${outboundTag.name}
  # Example 3: Place a rule *before* the standard web access rule
  allowUpdatesBeforeWeb:
    type: scm:SecurityRule
    name: allow_updates_before_web
    properties:
      folder: All
      name: Allow OS Updates Before Web143
      description: Allow specific OS update traffic before general web access.
      relativePosition: before
      targetRule: ${standardWebAccess.id}
      action: allow
      froms:
        - trust
      tos:
        - untrust
      sources: # Assumes this group exists
        - any
      destinations: # Assumes this group exists
        - any
      sourceUsers:
        - any
      categories:
        - any
      applications: # Example apps
        - ms-update
        - apple-update
      services:
        - service-https
      logEnd: true
      tags:
        - ${outboundTag.name}
  # Example 4: Place a rule *after* the standard web access rule
  allowCorpAppsAfterWeb:
    type: scm:SecurityRule
    name: allow_corp_apps_after_web
    properties:
      folder: All
      name: Allow Corp Apps After Web143
      description: Allow access to specific corporate apps after general web access.
      relativePosition: after
      targetRule: ${standardWebAccess.id}
      action: allow
      froms:
        - trust
      tos:
        - untrust
      sources:
        - any
      destinations: # Assumes this group exists
        - any
      sourceUsers:
        - any
      categories:
        - any
      applications: # Example app
        - ms-update
      services: # Example services
        - service-https
      logEnd: true
      tags:
        - ${webTag.name}