Update access_groups.tf
Some checks failed
Terraform Apply / Terraform Apply (push) Failing after 13s
Some checks failed
Terraform Apply / Terraform Apply (push) Failing after 13s
This commit is contained in:
184
access_groups.tf
184
access_groups.tf
@@ -3,187 +3,3 @@
|
||||
# =============================================================================
|
||||
|
||||
#
|
||||
#==========================================================
|
||||
# Local Variables
|
||||
#==========================================================
|
||||
locals {
|
||||
# Group mapping for policies (supports both SAML and composite groups)
|
||||
policy_groups = {
|
||||
# Composite groups
|
||||
employees = cloudflare_zero_trust_access_group.employees_rule_group.id
|
||||
sales_team = cloudflare_zero_trust_access_group.sales_team_rule_group.id
|
||||
admins = cloudflare_zero_trust_access_group.admins_rule_group.id
|
||||
contractors = cloudflare_zero_trust_access_group.contractors_rule_group.id
|
||||
|
||||
# Individual SAML groups
|
||||
infrastructure_admin = cloudflare_zero_trust_access_group.saml_groups["infrastructure_admin"].id
|
||||
sales_engineering = cloudflare_zero_trust_access_group.saml_groups["sales_engineering"].id
|
||||
sales = cloudflare_zero_trust_access_group.saml_groups["sales"].id
|
||||
it_admin = cloudflare_zero_trust_access_group.saml_groups["it_admin"].id
|
||||
}
|
||||
|
||||
# Common access policy configurations
|
||||
access_policies = {
|
||||
intranet_web_app = {
|
||||
name = "Intranet App Policy"
|
||||
include_groups = ["employees", "contractors"]
|
||||
require_posture = true
|
||||
require_mfa = false
|
||||
purpose_justification = false
|
||||
}
|
||||
competition_web_app = {
|
||||
name = "Competition App Policy"
|
||||
include_groups = ["sales_team"]
|
||||
require_posture = true
|
||||
require_mfa = true
|
||||
# IMPORTANT: Comment out the next 3 lines if you haven't deployed the "Training Compliance Gateway"
|
||||
# Otherwise the Competition App won't work or show up in App Launcher
|
||||
# Repository: https://github.com/macharpe/cloudflare-access-training-evaluator
|
||||
require_external_evaluation = true
|
||||
external_evaluation_url = "https://training-status.macharpe.com"
|
||||
external_evaluation_keys_url = "https://training-status.macharpe.com/keys"
|
||||
purpose_justification = true
|
||||
purpose_justification_prompt = "Access justification required: Please provide your business reason for accessing this sensitive resource."
|
||||
lifecycle_create_before_destroy = true
|
||||
}
|
||||
employees_browser_rendering = {
|
||||
name = "Employees AWS Database Policy"
|
||||
include_groups = ["infrastructure_admin"]
|
||||
require_posture = true
|
||||
require_mfa = false
|
||||
purpose_justification = true
|
||||
purpose_justification_prompt = "Access justification required: Please provide your business reason for accessing this production system."
|
||||
require_login_method = true
|
||||
}
|
||||
contractors_browser_rendering = {
|
||||
name = "Contractors AWS Database Policy"
|
||||
include_groups = ["contractors"]
|
||||
require_posture = true
|
||||
require_mfa = false
|
||||
require_country = true
|
||||
purpose_justification = true
|
||||
purpose_justification_prompt = "Access justification required: Please provide your business reason for accessing this production system."
|
||||
}
|
||||
aws = {
|
||||
name = "AWS Cloud Policy"
|
||||
include_groups = ["sales_engineering"]
|
||||
require_posture = true
|
||||
require_mfa = true
|
||||
}
|
||||
okta = {
|
||||
name = "Okta Cloud Policy"
|
||||
include_groups = ["it_admin"]
|
||||
require_posture = true
|
||||
require_mfa = true
|
||||
}
|
||||
meraki = {
|
||||
name = "Meraki Cloud Policy"
|
||||
include_groups = ["it_admin"]
|
||||
require_posture = true
|
||||
require_mfa = true
|
||||
}
|
||||
domain_controller = {
|
||||
name = "Domain Controller Policy"
|
||||
include_groups = ["it_admin", "contractors"]
|
||||
require_posture = true
|
||||
require_mfa = true
|
||||
require_country = true
|
||||
purpose_justification = true
|
||||
purpose_justification_prompt = "Access justification required: Please provide your business reason for accessing this sensitive resource."
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#==========================================================
|
||||
# Access Policies
|
||||
#==========================================================
|
||||
resource "cloudflare_zero_trust_access_policy" "policies" {
|
||||
for_each = local.access_policies
|
||||
|
||||
account_id = local.cloudflare_account_id
|
||||
decision = "allow"
|
||||
name = each.value.name
|
||||
session_duration = "0s"
|
||||
|
||||
# Purpose justification
|
||||
purpose_justification_prompt = try(each.value.purpose_justification_prompt, null)
|
||||
purpose_justification_required = try(each.value.purpose_justification, false)
|
||||
|
||||
# Include groups
|
||||
include = concat(
|
||||
# Groups (both SAML and composite groups via mapping)
|
||||
[
|
||||
for group in each.value.include_groups : {
|
||||
group = {
|
||||
id = local.policy_groups[group]
|
||||
}
|
||||
}
|
||||
],
|
||||
# Email domain (for contractors)
|
||||
try(each.value.include_email_domain, false) ? [{
|
||||
email_domain = {
|
||||
domain = var.cloudflare_email_domain
|
||||
}
|
||||
}] : []
|
||||
)
|
||||
|
||||
# Require conditions
|
||||
require = concat(
|
||||
# Device posture (always required if specified)
|
||||
try(each.value.require_posture, false) ? [{
|
||||
device_posture = {
|
||||
integration_uid = var.cloudflare_gateway_posture_id
|
||||
}
|
||||
}] : [],
|
||||
# MFA requirement
|
||||
try(each.value.require_mfa, false) ? [{
|
||||
auth_method = {
|
||||
auth_method = "mfa"
|
||||
}
|
||||
}] : [],
|
||||
# Login method (for specific policies)
|
||||
try(each.value.require_login_method, false) ? [{
|
||||
login_method = {
|
||||
id = var.cloudflare_okta_identity_provider_id
|
||||
}
|
||||
}] : [],
|
||||
# Country requirements
|
||||
try(each.value.require_country, false) ? [{
|
||||
group = {
|
||||
id = cloudflare_zero_trust_access_group.country_requirements_rule_group.id
|
||||
}
|
||||
}] : [],
|
||||
# OS version requirements
|
||||
try(each.value.require_os_version, false) ? [{
|
||||
group = {
|
||||
id = cloudflare_zero_trust_access_group.latest_os_version_requirements_rule_group.id
|
||||
}
|
||||
}] : [],
|
||||
# External evaluation requirements
|
||||
try(each.value.require_external_evaluation, false) ? [{
|
||||
external_evaluation = {
|
||||
evaluate_url = each.value.external_evaluation_url
|
||||
keys_url = each.value.external_evaluation_keys_url
|
||||
}
|
||||
}] : []
|
||||
)
|
||||
|
||||
# Exclude SMS (for MFA policies)
|
||||
exclude = try(each.value.require_mfa, false) ? [{
|
||||
auth_method = {
|
||||
auth_method = "sms"
|
||||
}
|
||||
}] : []
|
||||
|
||||
# Explicit dependencies to ensure proper destruction order:
|
||||
# Policies → Composite Groups → Individual SAML Groups
|
||||
depends_on = [
|
||||
cloudflare_zero_trust_access_group.employees_rule_group,
|
||||
cloudflare_zero_trust_access_group.sales_team_rule_group,
|
||||
cloudflare_zero_trust_access_group.admins_rule_group,
|
||||
cloudflare_zero_trust_access_group.contractors_rule_group,
|
||||
cloudflare_zero_trust_access_group.saml_groups
|
||||
]
|
||||
|
||||
# Note: lifecycle blocks cannot be conditional in for_each resources
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user