Add DDoS Custom Policy mitigation-rule support to Azure CLI #34215

Preconditions

• No need to upgrade Python SDK or the Python SDK is ready.

Related command

Existing commands:

az network ddos-custom-policy create
az network ddos-custom-policy update
az network ddos-custom-policy show
az network ddos-custom-policy list

Requested support:

• Upgrade the DDoS Custom Policy command group from API version 2025-07-01 to 2026-03-01.
• Add --mitigation-rules support to az network ddos-custom-policy create.
• Add --mitigation-rules support to az network ddos-custom-policy update.
• Return mitigationRules through the existing show and list commands.

The CLI currently supports detectionRules, but does not serialize or deserialize the new mitigationRules property.

Resource Provider

Microsoft.Network/ddosCustomPolicies

Description of Feature or Work Requested

Add Azure CLI support for DDoS Custom Policy mitigation rules introduced in Network API version 2026-03-01.

The existing az network ddos-custom-policy commands use API version 2025-07-01 and currently expose only DDoS detection rules. The command group should be regenerated or updated against 2026-03-01 so customers can create, update, retrieve, and list policies containing mitigation rules.

The --mitigation-rules parameter should support the complete released contract:

• Rule name
• Traffic scope:
  • Tcp
  • Udp
• TCP default mitigations:
  • Per-source packet rate limit
  • Per-source connection-establishment rate limit
• UDP default mitigations:
  • Per-source packet rate limit
• Source policy overrides:
  • Deny
  • Permit
• Source match conditions:
  • IP prefixes
  • Continent
  • ISO 3166-1 alpha-2 country code
  • Combined continent and country match

The existing show and list commands must deserialize and return mitigation rules without dropping rule properties or unknown service-returned values.

The CLI should preserve detection rules when mitigation rules are updated and preserve mitigation rules when unrelated policy properties are updated. Mutable rule constraints and subscription-specific limits should be validated by the Network Resource Provider.

Minimum API Version Required

2026-03-01

Swagger PR link / SDK link

Mitigation-rule Swagger PR:

Azure/azure-rest-api-specs#46716

Network API 2026-03-01 release PR:

Azure/azure-rest-api-specs#47015

Released Swagger:

https://github.com/Azure/azure-rest-api-specs/blob/main/specification/network/resource-manager/Microsoft.Network/Network/stable/2026-03-01/virtualNetwork.json

Create request/response example:

https://github.com/Azure/azure-rest-api-specs/blob/main/specification/network/resource-manager/Microsoft.Network/Network/stable/2026-03-01/examples/DdosCustomPolicyCreate.json

Get response example:

https://github.com/Azure/azure-rest-api-specs/blob/main/specification/network/resource-manager/Microsoft.Network/Network/stable/2026-03-01/examples/DdosCustomPolicyGet.json

• Merged Azure PowerShell mitigation-rule cmdlets:
  [Network] Add DDoS custom policy mitigation rule cmdlets azure-powershell#30238

Request Example

REST request and response example:

https://github.com/Azure/azure-rest-api-specs/blob/main/specification/network/resource-manager/Microsoft.Network/Network/stable/2026-03-01/examples/DdosCustomPolicyCreate.json

Expected Azure CLI workflow:

az network ddos-custom-policy create \
  --resource-group rg1 \
  --name test-ddos-custom-policy \
  --location centraluseuap \
  --mitigation-rules '[
    {
      "name": "mitigationRuleTcp",
      "traffic-scope": "Tcp",
      "tcp-default-mitigations": {
        "per-source-rate-limiting": {
          "packets-per-second": 100000
        },
        "per-source-connection-rate-limiting": {
          "connections-per-second": 1000
        }
      },
      "source-policy-overrides": [
        {
          "policy-action": {
            "action-type": "Deny"
          },
          "conditions": {
            "ip-prefixes": ["198.51.100.0/24"],
            "geo-matches": [
              {
                "country-code": "CA"
              }
            ]
          }
        },
        {
          "policy-action": {
            "action-type": "Permit"
          },
          "conditions": {
            "ip-prefixes": ["203.0.113.0/24"],
            "geo-matches": [
              {
                "continent": "NorthAmerica"
              }
            ]
          }
        }
      ]
    },
    {
      "name": "mitigationRuleUdp",
      "traffic-scope": "Udp",
      "udp-default-mitigations": {
        "per-source-rate-limiting": {
          "packets-per-second": 50000
        }
      }
    }

  ]'

Target Date

2026-11-01

PM Contact

jdasari

Engineer Contact

venm

Additional context

This request continues the end-to-end delivery of DDoS Custom Policy mitigation rules across the Azure networking stack.

Completed prerequisites include:

• Network Resource Provider support for mitigation-only and combined detection/mitigation policies.
• Downstream SLB support for projecting default mitigations and source-specific Permit/Deny actions.
• Stable public Swagger contract in Network API version 2026-03-01.
• Public REST examples covering TCP and UDP mitigation rules.
• Merged Azure PowerShell mitigation-rule cmdlets:
  [Network] Add DDoS custom policy mitigation rule cmdlets azure-powershell#30238

The existing Azure CLI DDoS Custom Policy commands currently use API version 2025-07-01 and expose only detectionRules. Azure CLI does not currently expose the released mitigationRules contract and is the next planned client surface requiring support.

Requested E2E coverage should verify:

1. Create a policy containing both detection and mitigation rules.
2. Create a mitigation-only policy without detection rules.
3. Round-trip TCP and UDP default mitigations through create and show.
4. Round-trip Deny and Permit IP-prefix and geographic conditions.
5. Update mitigation rules without losing detection rules or unrelated mitigation rules.
6. Clear or replace source-policy override collections.
7. Verify that show and list return the complete mitigation-rule contract.
8. Verify that service validation errors are surfaced when invalid protocol combinations or rate values are persisted.

Reference for the earlier DDoS Custom Policy Azure CLI request:

#33383