157 lines
4.8 KiB
HCL
157 lines
4.8 KiB
HCL
# =============================================================================
|
|
# CLOUDFLARE : Access Controls : Applications
|
|
# =============================================================================
|
|
|
|
#======================================================
|
|
# INFRASTRUCTURE APP: TEST
|
|
#======================================================
|
|
|
|
resource "cloudflare_zero_trust_access_application" "zero_trust_access_application" {
|
|
account_id = local.cloudflare_account_id
|
|
|
|
type = "self_hosted"
|
|
name = "Home Network Access Application"
|
|
domain = "home.tips-of-mine.org"
|
|
session_duration = "24h"
|
|
skip_interstitial = true
|
|
# tags = ["engineers"]
|
|
tags = [for tag in cloudflare_zero_trust_access_tag.tags : tag.name]
|
|
|
|
depends_on = [
|
|
cloudflare_zero_trust_access_tag.tags
|
|
]
|
|
}
|
|
|
|
data "cloudflare_zero_trust_access_application" "zero_trust_access_application" {
|
|
account_id = local.cloudflare_account_id
|
|
|
|
app_id = cloudflare_zero_trust_access_application.zero_trust_access_application.id
|
|
}
|
|
|
|
#======================================================
|
|
# INFRASTRUCTURE APP: MySQL Database (Infrastructure)
|
|
#======================================================
|
|
|
|
# Creating the Target
|
|
resource "cloudflare_zero_trust_access_infrastructure_target" "gcp_ssh_target" {
|
|
account_id = local.cloudflare_account_id
|
|
|
|
hostname = var.cloudflare_target_ssh_name
|
|
ip = {
|
|
ipv4 = {
|
|
ip_addr = var.gcp_vm_internal_ip
|
|
}
|
|
}
|
|
}
|
|
|
|
# Creating the infrastructure Application
|
|
resource "cloudflare_zero_trust_access_application" "cloudflare_app_ssh_infra" {
|
|
account_id = local.cloudflare_account_id
|
|
|
|
type = "infrastructure"
|
|
name = var.cloudflare_infra_app_name
|
|
logo_url = "https://upload.wikimedia.org/wikipedia/commons/0/01/Google-cloud-platform.svg"
|
|
tags = ["engineers"]
|
|
custom_deny_url = "https://denied.tips-of-mine.org/"
|
|
custom_non_identity_deny_url = "https://denied.tips-of-mine.org/"
|
|
|
|
target_criteria = [{
|
|
port = "22",
|
|
protocol = "SSH"
|
|
target_attributes = {
|
|
hostname = [var.cloudflare_target_ssh_name]
|
|
},
|
|
}]
|
|
|
|
policies = [{
|
|
name = "SSH GCP Infrastructure Policy"
|
|
decision = "allow"
|
|
|
|
allowed_idps = [var.cloudflare_okta_identity_provider_id]
|
|
auto_redirect_to_identity = true
|
|
allow_authenticate_via_warp = false
|
|
|
|
include = [
|
|
{
|
|
saml = {
|
|
identity_provider_id = var.cloudflare_okta_identity_provider_id
|
|
attribute_name = "groups"
|
|
attribute_value = var.okta_infra_admin_saml_group_name
|
|
}
|
|
},
|
|
{
|
|
saml = {
|
|
identity_provider_id = var.cloudflare_okta_identity_provider_id
|
|
attribute_name = "groups"
|
|
attribute_value = var.okta_contractors_saml_group_name
|
|
}
|
|
},
|
|
{
|
|
email_domain = {
|
|
domain = var.cloudflare_email_domain
|
|
}
|
|
}
|
|
]
|
|
require = [
|
|
{
|
|
device_posture = {
|
|
integration_uid = var.cloudflare_gateway_posture_id
|
|
}
|
|
},
|
|
{
|
|
auth_method = {
|
|
auth_method = "mfa"
|
|
}
|
|
}
|
|
]
|
|
exclude = [
|
|
{
|
|
auth_method = {
|
|
auth_method = "sms"
|
|
}
|
|
}
|
|
]
|
|
connection_rules = {
|
|
ssh = {
|
|
allow_email_alias = true
|
|
usernames = [] # None
|
|
}
|
|
}
|
|
}]
|
|
}
|
|
|
|
#======================================================
|
|
# SELF-HOSTED APP: DB Server
|
|
#======================================================
|
|
|
|
# Creating the Self-hosted Application for Browser rendering SSH
|
|
resource "cloudflare_zero_trust_access_application" "cloudflare_app_ssh_browser" {
|
|
account_id = local.cloudflare_account_id
|
|
|
|
type = "ssh"
|
|
name = var.cloudflare_browser_ssh_app_name
|
|
app_launcher_visible = true
|
|
logo_url = "https://cdn.iconscout.com/icon/free/png-256/free-database-icon-download-in-svg-png-gif-file-formats--ui-elements-pack-user-interface-icons-444649.png"
|
|
tags = ["engineers"]
|
|
session_duration = "0s"
|
|
custom_deny_url = "https://denied.tips-of-mine.org/"
|
|
custom_non_identity_deny_url = "https://denied.tips-of-mine.org/"
|
|
|
|
destinations = [{
|
|
type = "public"
|
|
uri = var.cloudflare_subdomain_ssh
|
|
}]
|
|
|
|
allowed_idps = [var.cloudflare_okta_identity_provider_id, var.cloudflare_otp_identity_provider_id]
|
|
auto_redirect_to_identity = false
|
|
allow_authenticate_via_warp = false
|
|
|
|
policies = [
|
|
{
|
|
id = cloudflare_zero_trust_access_policy.policies["employees_browser_rendering"].id
|
|
},
|
|
{
|
|
id = cloudflare_zero_trust_access_policy.policies["contractors_browser_rendering"].id
|
|
}
|
|
]
|
|
} |