{Network} az network ddos-custom-policy: Support DDoS mitigation rules with API version 2026-03-01

[Jian Hui (huiii99)]

🤖 PR Validation — ⚠️ Review suggested

Breaking Changes	Tests
⚠️ None	️✔️ 130/130

⚠️AzureCLI-BreakingChangeTest

⚠️network

rule	cmd_name	rule_message	suggest_message
⚠️ 1006 - ParaAdd	network ddos-custom-policy create	cmd network ddos-custom-policy create added parameter mitigation_rules
⚠️ 1009 - ParaPropRemove	network ddos-custom-policy list	cmd network ddos-custom-policy list update parameter resource_group: removed property required=True
⚠️ 1006 - ParaAdd	network ddos-custom-policy update	cmd network ddos-custom-policy update added parameter mitigation_rules

Related command
az network ddos-custom-policy create
az network ddos-custom-policy update
az network ddos-custom-policy show
az network ddos-custom-policy list

Description
Resolves #34215.

Adds DDoS Custom Policy mitigation-rule support introduced in Network API 2026-03-01.

• Upgrade az network ddos-custom-policy from API version 2025-07-01 to 2026-03-01 (AAZ: faet: upgrade ddos custom policy api version aaz#1118).
• create: add --mitigation-rules. The argument reuses the generated AAZ argument, so shorthand syntax, JSON, @file and ?? help are supported. Re-running create merges detection and mitigation rules by name instead of dropping existing mitigation rules.
• create: no longer injects an empty detection rule when no detection-rule arguments are given, which enables mitigation-only policies.
• update: --mitigation-rules (from regenerated AAZ) replaces the whole collection; generic --set / --remove can be used for partial changes.
• show / list: return mitigationRules. list now also supports listing at subscription scope when --resource-group is omitted (from regenerated AAZ).
• Existing recordings: bump api-version for ddosCustomPolicies requests to 2026-03-01.

Notes:

• mitigationRules is currently supported in centraluseuap only; other regions such as eastus reject the property, so the new scenario test runs in centraluseuap.

Testing Guide

# detection + mitigation rules
az network ddos-custom-policy create -g rg1 -n policy1 --location centraluseuap \
  --detection-rule-name dr1 --detection-mode TrafficThreshold --traffic-type Tcp --packets-per-second 1000000 \
  --mitigation-rules "[{name:mrTcp,traffic-scope:Tcp,tcp-default-mitigations:{per-source-rate-limiting:{packets-per-second:100000},per-source-connection-rate-limiting:{connections-per-second:1000}},source-policy-overrides:[{policy-action:{action-type:Deny},conditions:{ip-prefixes:[198.51.100.0/24],geo-matches:[{country-code:CA}]}}]}]"

# mitigation-only policy
az network ddos-custom-policy create -g rg1 -n policy2 --location centraluseuap \
  --mitigation-rules "[{name:mrUdp,traffic-scope:Udp,udp-default-mitigations:{per-source-rate-limiting:{packets-per-second:50000}}}]"

# replace mitigation rules, detection rules are kept
az network ddos-custom-policy update -g rg1 -n policy1 \
  --mitigation-rules "[{name:mrUdp,traffic-scope:Udp,udp-default-mitigations:{per-source-rate-limiting:{packets-per-second:50000}}}]"

# clear source policy overrides of one rule
az network ddos-custom-policy update -g rg1 -n policy1 --remove mitigationRules[0].properties.sourcePolicyOverrides

az network ddos-custom-policy show -g rg1 -n policy1
az network ddos-custom-policy list

Tests (playback):

• test_ddos_custom_policy_mitigation_rules (new, recorded live in centraluseuap): covers all E2E scenarios listed in Add DDoS Custom Policy mitigation-rule support to Azure CLI #34215 — passed
• test_ddos_custom_policy — passed
• test_ddos_custom_policy_attach_to_lb_fip — passed
• test_ddos_custom_policy_attach_to_public_ip — passed
• azdev linter network — passed

History Notes

---

This checklist is used to make sure that common guidelines for a pull request are followed.

• The PR title and description has followed the guideline in Submitting Pull Requests.

• I adhere to the Command Guidelines.

• I adhere to the Error Handling Guidelines.

[Yong Zhang (yonzhan)]

Network

[Copilot]

🟢 Approval recommended

The generated schemas, custom merge behavior, API-version updates, and comprehensive scenario coverage are consistent and complete.

0 open findings

What changed in this PR

Adds Network API 2026-03-01 support for DDoS custom-policy mitigation rules.

Changes:

• Adds mitigation-rule create, update, show, and list support.
• Preserves existing rules during repeated creates and enables subscription-scoped listing.
• Adds scenario coverage and updates recordings for the new API version.

File	Description
_help.py	Adds mitigation-rule example.
_params.py	Exposes generated mitigation-rule parsing.
_template_builder.py	Builds mitigation-only policies.
custom.py	Materializes and merges mitigation rules.
operations/​ddos_custom_policy.py	Converts and merges rule collections.
aaz/​.../​_create.py	Adds mitigation-rule create schema.
aaz/​.../​_update.py	Adds mitigation-rule update support.
aaz/​.../​_show.py	Returns mitigation rules.
aaz/​.../​_list.py	Adds mitigation rules and subscription listing.
aaz/​.../​_delete.py	Updates the API version.
aaz/​.../​_wait.py	Updates API and response schemas.
test_network_commands.py	Adds end-to-end mitigation-rule coverage.
test_ddos_custom_policy_mitigation_rules.yaml	Records the new scenarios.
test_ddos_custom_policy.yaml	Updates playback API versions.
test_ddos_custom_policy_attach_to_public_ip.yaml	Updates playback API versions.
test_ddos_custom_policy_attach_to_lb_fip.yaml	Updates playback API versions.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Yong Zhang (yonzhan)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).