117 lines
3.7 KiB
Terraform
117 lines
3.7 KiB
Terraform
# =============================================================================
|
|
# CLOUDFLARE : Team & Resources : Devices : Device posture
|
|
# =============================================================================
|
|
# BRIQUE AGENT WARP (2/2) : vérifications de posture des postes.
|
|
#
|
|
# Jusqu'ici le projet consommait des posture checks créés À LA MAIN dans le
|
|
# dashboard (variables cloudflare_*_posture_id du tfvars). Cette brique montre
|
|
# comment les gérer entièrement en Terraform : les IDs deviennent des
|
|
# attributs de ressources, plus rien à recopier depuis le dashboard.
|
|
#
|
|
# Les deux approches cohabitent volontairement (c'est un repo d'exemples) :
|
|
# - ancienne : IDs manuels via variables (utilisés par Rule_Groups.tf)
|
|
# - nouvelle : ressources ci-dessous, référencées par leur attribut .id
|
|
# =============================================================================
|
|
|
|
#======================================================
|
|
# Le client WARP est installé et connecté
|
|
#======================================================
|
|
resource "cloudflare_zero_trust_device_posture_rule" "warp_installed" {
|
|
account_id = local.cloudflare_account_id
|
|
|
|
name = "TF - WARP installe"
|
|
description = "Le poste execute le client WARP"
|
|
type = "warp"
|
|
|
|
match = [
|
|
{ platform = "windows" },
|
|
{ platform = "mac" },
|
|
{ platform = "linux" },
|
|
]
|
|
}
|
|
|
|
#======================================================
|
|
# Pare-feu actif (Windows / macOS)
|
|
#======================================================
|
|
resource "cloudflare_zero_trust_device_posture_rule" "firewall_enabled" {
|
|
account_id = local.cloudflare_account_id
|
|
|
|
name = "TF - Pare-feu actif"
|
|
description = "Le pare-feu local du poste doit etre active"
|
|
type = "firewall"
|
|
schedule = "5m"
|
|
|
|
match = [
|
|
{ platform = "windows" },
|
|
{ platform = "mac" },
|
|
]
|
|
|
|
input = {
|
|
enabled = true
|
|
}
|
|
}
|
|
|
|
#======================================================
|
|
# Disque chiffré
|
|
#======================================================
|
|
resource "cloudflare_zero_trust_device_posture_rule" "disk_encrypted" {
|
|
account_id = local.cloudflare_account_id
|
|
|
|
name = "TF - Disque chiffre"
|
|
description = "Tous les volumes du poste doivent etre chiffres (BitLocker / FileVault / LUKS)"
|
|
type = "disk_encryption"
|
|
schedule = "5m"
|
|
|
|
match = [
|
|
{ platform = "windows" },
|
|
{ platform = "mac" },
|
|
{ platform = "linux" },
|
|
]
|
|
|
|
input = {
|
|
require_all = true
|
|
}
|
|
}
|
|
|
|
#======================================================
|
|
# Version d'OS minimale (exemple Windows 11 23H2)
|
|
#======================================================
|
|
resource "cloudflare_zero_trust_device_posture_rule" "windows_os_version" {
|
|
account_id = local.cloudflare_account_id
|
|
|
|
name = "TF - Windows a jour"
|
|
description = "Version minimale de Windows exigee"
|
|
type = "os_version"
|
|
schedule = "5m"
|
|
|
|
match = [
|
|
{ platform = "windows" },
|
|
]
|
|
|
|
input = {
|
|
version = "10.0.22631"
|
|
operator = ">="
|
|
}
|
|
}
|
|
|
|
#======================================================
|
|
# Rule group Access s'appuyant sur ces postures Terraform
|
|
# (équivalent "new generation" de latest_os_version_requirements_rule_group)
|
|
#======================================================
|
|
resource "cloudflare_zero_trust_access_group" "tf_managed_posture_rule_group" {
|
|
account_id = local.cloudflare_account_id
|
|
name = "GL_TF Managed Device Posture"
|
|
|
|
include = [
|
|
for rule in [
|
|
cloudflare_zero_trust_device_posture_rule.warp_installed,
|
|
cloudflare_zero_trust_device_posture_rule.firewall_enabled,
|
|
cloudflare_zero_trust_device_posture_rule.disk_encrypted,
|
|
] : {
|
|
device_posture = {
|
|
integration_uid = rule.id
|
|
}
|
|
}
|
|
]
|
|
}
|