Hubert Cornet
a617d0217a
All checks were successful
Terraform Apply / Terraform Apply (push) Successful in 34s
140 lines
3.8 KiB
HCL
140 lines
3.8 KiB
HCL
# =============================================================================
|
|
# CLOUDFLARE : Gateway : Policy
|
|
# =============================================================================
|
|
|
|
#
|
|
resource "cloudflare_zero_trust_gateway_policy" "block_malware" {
|
|
account_id = local.cloudflare_account_id
|
|
|
|
name = "Block malware"
|
|
description = "Block known threats based on Cloudflare s threat intelligence"
|
|
|
|
enabled = true
|
|
precedence = 10
|
|
|
|
# Block all security risks
|
|
filters = ["dns"]
|
|
traffic = "any(dns.security_category[*] in {178 80 83 176 175 117 131 134 151 153 68})"
|
|
action = "block"
|
|
|
|
rule_settings = {
|
|
block_page_enabled = true
|
|
}
|
|
}
|
|
|
|
#
|
|
#resource "cloudflare_zero_trust_gateway_policy" "example_zero_trust_gateway_policy" {
|
|
# account_id = local.cloudflare_account_id
|
|
# action = "allow"
|
|
# name = "block bad websites"
|
|
# description = "Block bad websites based on their host name."
|
|
# device_posture = "any(device_posture.checks.passed[*] in {\"1308749e-fcfb-4ebc-b051-fe022b632644\"})"
|
|
# enabled = true
|
|
# expiration = {
|
|
# expires_at = "2026-01-01T05:20:20Z"
|
|
# duration = 10
|
|
# }
|
|
# filters = ["http"]
|
|
# identity = "any(identity.groups.name[*] in {\"finance\"})"
|
|
# precedence = 0
|
|
# rule_settings = {
|
|
# add_headers = {
|
|
# My-Next-Header = ["foo", "bar"]
|
|
# X-Custom-Header-Name = ["somecustomvalue"]
|
|
# }
|
|
# allow_child_bypass = true
|
|
# audit_ssh = {
|
|
# command_logging = false
|
|
# }
|
|
# biso_admin_controls = {
|
|
# copy = "remote_only"
|
|
# dcp = true
|
|
# dd = true
|
|
# dk = true
|
|
# download = "enabled"
|
|
# dp = false
|
|
# du = true
|
|
# keyboard = "enabled"
|
|
# paste = "enabled"
|
|
# printing = "enabled"
|
|
# upload = "enabled"
|
|
# version = "v1"
|
|
# }
|
|
# block_page = {
|
|
# target_uri = "https://example.com"
|
|
# include_context = true
|
|
# }
|
|
# block_page_enabled = true
|
|
# block_reason = "This website is a security risk"
|
|
# bypass_parent_rule = false
|
|
# check_session = {
|
|
# duration = "300s"
|
|
# enforce = true
|
|
# }
|
|
# dns_resolvers = {
|
|
# ipv4 = [{
|
|
# ip = "2.2.2.2"
|
|
# port = 5053
|
|
# route_through_private_network = true
|
|
# vnet_id = "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
|
|
# }]
|
|
# ipv6 = [{
|
|
# ip = "2001:DB8::"
|
|
# port = 5053
|
|
# route_through_private_network = true
|
|
# vnet_id = "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
|
|
# }]
|
|
# }
|
|
# egress = {
|
|
# ipv4 = "192.0.2.2"
|
|
# ipv4_fallback = "192.0.2.3"
|
|
# ipv6 = "2001:DB8::/64"
|
|
# }
|
|
# ignore_cname_category_matches = true
|
|
# insecure_disable_dnssec_validation = false
|
|
# ip_categories = true
|
|
# ip_indicator_feeds = true
|
|
# l4override = {
|
|
# ip = "1.1.1.1"
|
|
# port = 0
|
|
# }
|
|
# notification_settings = {
|
|
# enabled = true
|
|
# include_context = true
|
|
# msg = "msg"
|
|
# support_url = "support_url"
|
|
# }
|
|
# override_host = "example.com"
|
|
# override_ips = ["1.1.1.1", "2.2.2.2"]
|
|
# payload_log = {
|
|
# enabled = true
|
|
# }
|
|
# quarantine = {
|
|
# file_types = ["exe"]
|
|
# }
|
|
# redirect = {
|
|
# target_uri = "https://example.com"
|
|
# include_context = true
|
|
# preserve_path_and_query = true
|
|
# }
|
|
# resolve_dns_internally = {
|
|
# fallback = "none"
|
|
# view_id = "view_id"
|
|
# }
|
|
# resolve_dns_through_cloudflare = true
|
|
# untrusted_cert = {
|
|
# action = "error"
|
|
# }
|
|
# }
|
|
# schedule = {
|
|
# time_zone = "Europe/Paris"
|
|
# mon = "08:00-12:30,13:30-17:00"
|
|
# thu = "08:00-12:30,13:30-17:00"
|
|
# tue = "08:00-12:30,13:30-17:00"
|
|
# wed = "08:00-12:30,13:30-17:00"
|
|
# fri = "08:00-12:30,13:30-17:00"
|
|
# sat = "08:00-12:30,13:30-17:00"
|
|
# sun = "08:00-12:30,13:30-17:00"
|
|
# }
|
|
# traffic = "http.request.uri matches \".*a/partial/uri.*\" and http.request.host in $01302951-49f9-47c9-a400-0297e60b6a10"
|
|
#} |