Need help understanding how to deply WAF custom rulesets

[always-be-testing]

I am attempting to deploy an account level WAF custom ruleset using Terraform and I am having a difficult time understanding how to deploy the rule once it has been created:

First here is the terraform I am using to create the customer ruleset that contains one rule to log all incoming traffic:

resource "cloudflare_ruleset" "account_custom_firewall" {
  account_id  = "<ACCOUNT_ID_HERE>"
  name        = "Custom WAF rule"
  description = "Custom WAF rulesets"
  kind        = "custom"
  phase       = "http_request_firewall_custom"

  # Rule that Logs all incoming traffic
  rules {
    action      = "log"
    expression  = "(ip.src in {0.0.0.0/0})"
    description = "Log all traffic at account level"
    enabled     = false
  }
}

The above terraform works and also returns the ID of the ruleset that was created.

Now here is where I get confused. Now that the ruleset has been created I then need to deploy it. In this case because I have the ID of the ruleset I attempted this

resource "cloudflare_ruleset" "deploy_custom_ruleset" {
  account_id  = "<ACCOUNT_ID_HERE>"
  name        = "Log All"
  description = "Deploy the WAF rulesets"
  kind        = "custom"
  phase       = "http_request_firewall_custom"

    rules {
        action = "execute"
        action_parameters {
        id = "<RULESET_ID_RETURNED_BY_CREATE>"
        }
        expression  = "(http.host eq \"dev.example.com\")"
        description = "Log All Incoming Traffic"
        enabled     = false
    }
}

This ultimately produces an error of:

Error: error creating ruleset Log All: cannot reference <RULESET_ID_RETURNED_BY_CREATE>" because it would violate the invariants on referencing

I am having a difficult time understanding the API examples listed in the documentation and how they map to what I am attempting to do.

Could someone please provide me with a basic example of creating a custom ruleset and show how to then deploy it?

[Cyb3r-Jak3]

Have you tried
``hcl

resource "cloudflare_ruleset" "account_custom_firewall" {
  account_id  = "<ACCOUNT_ID_HERE>"
  name        = "Custom WAF rule"
  description = "Custom WAF rulesets"
  kind        = "custom"
  phase       = "http_request_firewall_custom"

  # Rule that Logs all incoming traffic
  rules {
    action      = "log"
    expression  = "(ip.src in {0.0.0.0/0})"
    description = "Log all traffic at account level"
    enabled     = false
  }
}

resource "cloudflare_ruleset" "deploy_custom_ruleset" {
  account_id  = "<ACCOUNT_ID_HERE>"
  name        = "Log All"
  description = "Deploy the WAF rulesets"
  kind        = "custom"
  phase       = "http_request_firewall_custom"

    rules {
        action = "execute"
        action_parameters {
        id = cloudflare_ruleset.account_custom_firewall.id
        }
        expression  = "(http.host eq \"dev.example.com\")"
        description = "Log All Incoming Traffic"
        enabled     = false
    }
}

[always-be-testing]

Thank you for the suggestion @Cyb3r-Jak3! I gave that a go however it resulted in the same error being produced.

[always-be-testing]

Solved:

For those interested the issue with my deploy ended up being that my kind value was wrong.

resource "cloudflare_ruleset" "deploy_custom_waf_ruleset" {
  account_id  = "<ACCOUNT_ID>"
  name        = "Log All"
  description = "Deploy the WAF rulesets"
  kind        = "root" # <-- to deploy at the Account level you must use "root" 
  phase       = "http_request_firewall_custom"

  rules {
    action = "execute"
    action_parameters {
      id = "<RULESET_ID>"
    }
    expression  = "(http.host eq \"dev.example.com\") and (cf.zone.plan eq \"ENT\")" 
    description = "Log All Incoming Traffic"
    enabled     = true
  }
}

Hope this can be of help to others and thank you again for the suggestion @Cyb3r-Jak3 !