Skip to content

Commit 6d5ca7f

Browse files
DodgeqtrDodgeqtr
authored
Revert "add Terraform examples (cloudflare#17640)"
This reverts commit 235e0c7.
1 parent 235e0c7 commit 6d5ca7f

File tree

5 files changed

+99
-159
lines changed

5 files changed

+99
-159
lines changed

‎src/content/docs/cloudflare-one/applications/non-http/infrastructure-apps.mdx‎

Lines changed: 18 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -47,13 +47,29 @@ Access for Infrastructure currently only supports [SSH](/cloudflare-one/connecti
4747

4848
<Render file="access/add-infrastructure-app" />
4949

50-
## 3. Configure the server
50+
## 3. Add a policy
51+
52+
<Render file="access/add-infrastructure-policy" />
53+
54+
### Selectors
55+
56+
The following [Access policy selectors](/cloudflare-one/policies/access/#selectors) are available for securing infrastructure applications:
57+
58+
- Email
59+
- Emails ending in
60+
- SAML group
61+
- Country
62+
- Authentication method
63+
- Device posture
64+
- Entra group, GitHub organization, Google Workspace group, Okta group
65+
66+
## 4. Configure the server
5167

5268
Certain protocols require configuring the server to trust connections through Access for Infrastructure. For more information, refer to the protocol-specific tutorial:
5369

5470
- [SSH](/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access/#7-configure-ssh-server)
5571

56-
## 4. Connect as a user
72+
## Connect as a user
5773

5874
Users connect to the target's IP address as if they were on your private network, using their preferred client software. The user must be logged into WARP on their device, but no other system configuration is required. You can optionally configure a [private DNS resolver](/cloudflare-one/policies/gateway/resolver-policies/) to allow connections to the target's private hostname.
5975

@@ -100,15 +116,3 @@ warp-cli target list
100116
## Revoke a user's session
101117

102118
To revoke a user's access to all infrastructure targets, you can either [revoke the user from Zero Trust](/cloudflare-one/identity/users/session-management/#per-user) or revoke their device. Cloudflare does not currently support revoking a user's session for a specific target.
103-
104-
## Infrastructure policy selectors
105-
106-
The following [Access policy selectors](/cloudflare-one/policies/access/#selectors) are available for securing infrastructure applications:
107-
108-
- Email
109-
- Emails ending in
110-
- SAML group
111-
- Country
112-
- Authentication method
113-
- Device posture
114-
- Entra group, GitHub organization, Google Workspace group, Okta group

‎src/content/docs/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access.mdx‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,11 @@ To connect your devices to Cloudflare:
4040

4141
<Render file="access/add-infrastructure-app" />
4242

43-
## 6. Configure SSH server
43+
## 6. Add a policy
44+
45+
<Render file="access/add-infrastructure-policy" />
46+
47+
## 7. Configure SSH server
4448

4549
Next, configure your SSH server to trust the Cloudflare SSH CA. This allows Access to authenticate using short-lived certificates instead of traditional SSH keys.
4650

@@ -61,7 +65,7 @@ To generate a Cloudflare SSH CA and get its public key:
6165
### Restart your SSH server
6266
<Render file="ssh/restart-server" />
6367

64-
## 7. Connect as a user
68+
## 8. Connect as a user
6569

6670
Users can use any SSH client to connect to the target, as long as they are logged into the WARP client on their device. If the target is located within a particular virtual network, ensure that the WARP client is [connected to that virtual network](/cloudflare-one/connections/connect-networks/private-net/cloudflared/tunnel-virtual-networks/#connect-to-a-virtual-network) before initiating the connection. Users do not need to modify any SSH configs on their device. For example, to SSH from a terminal:
6771

‎src/content/partials/cloudflare-one/access/add-infrastructure-app.mdx‎

Lines changed: 40 additions & 98 deletions
Original file line numberDiff line numberDiff line change
@@ -15,115 +15,57 @@ import { Tabs, TabItem, Render } from "~/components"
1515
5. In **Target criteria**, select the target hostname(s) that will represent the application. The application definition will apply to all targets that share the selected hostname, including any targets added in the future.
1616
6. Enter the **Protocol** and **Port** that will be used to connect to the server.
1717
7. (Optional) If a protocol runs on more than one port, select **Add new target criteria** and reconfigure the same target hostname and protocol with a different port number.
18-
:::note
19-
Access for Infrastructure only supports assigning one protocol per port. You can reuse a port/protocol pairing across infrastructure applications, but the port cannot be reassigned to another protocol.
20-
:::
2118
8. Select **Next**.
22-
9. To secure your targets, configure a policy that defines who can connect and how they can connect:
23-
1. Enter any name for your policy.
24-
2. Create a rule that matches the users who are allowed to reach the targets. For more information, refer to [Access policies](/cloudflare-one/policies/access/) and review the list of [infrastructure policy selectors](/cloudflare-one/applications/non-http/infrastructure-apps/#infrastructure-policy-selectors).
25-
3. In **Connection context**, enter the UNIX usernames that users can log in as (for example, `root` or `ec2-user`).
26-
4. Select **Add application**.
2719
</TabItem>
2820
<TabItem label="API">
2921

30-
1. [Create an API token](/fundamentals/api/get-started/create-token/) with the following permissions:
31-
| Type | Item | Permission |
32-
| ------- | ---------------- | ---------- |
33-
| Account | Access: Apps & Policies | Edit |
34-
35-
2. Make a `POST` request to the [Access applications](/api/operations/access-applications-add-an-application) endpoint:
36-
37-
```sh
38-
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/access/apps \
39-
--header "Authorization: Bearer <API_TOKEN>" \
40-
--header "Content-Type: application/json" \
41-
--data '{
42-
"name": "Example infrastructure app",
43-
"type": "infrastructure",
44-
"target_criteria": [
45-
{
46-
"target_attributes": {
47-
"hostname": [
48-
"infra-access-target"
49-
]
50-
},
51-
"port": 22,
52-
"protocol": "SSH"
53-
}
54-
],
55-
"policies": [
56-
{
57-
"name": "Allow a specific email",
58-
"decision": "allow",
59-
"include": [
60-
{
61-
"email": {
62-
"email": "[email protected]"
63-
}
64-
}
65-
],
66-
"connection_rules": {
67-
"ssh": {
68-
"usernames": [
69-
"root",
70-
"ec2-user"
71-
]
22+
To add an infrastructure application using the [API](/api/operations/access-applications-add-an-application):
23+
24+
```sh
25+
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/access/apps \
26+
--header "Authorization: Bearer <API_TOKEN>" \
27+
--header "Content-Type: application/json" \
28+
--data '{
29+
"name": "example app",
30+
"type": "infrastructure",
31+
"target_criteria": [
32+
{
33+
"target_attributes": {
34+
"hostname": [
35+
"infra-access-target"
36+
]
37+
},
38+
"port": 22,
39+
"protocol": "SSH"
40+
}
41+
],
42+
"policies": [
43+
{
44+
"name": "Allow a specific email",
45+
"decision": "allow",
46+
"include": [
47+
{
48+
"email": {
49+
"email": "[email protected]"
7250
}
7351
}
52+
],
53+
"connection_rules": {
54+
"ssh": {
55+
"usernames": [
56+
"root",
57+
"ec2-user"
58+
]
59+
}
7460
}
75-
]
76-
}'
77-
```
78-
79-
</TabItem>
80-
<TabItem label="Terraform">
81-
82-
1. Use the [`cloudflare_zero_trust_access_application`](https://registry.terraform.io/providers/cloudflare/cloudflare/4.44.0/docs/resources/zero_trust_access_application) resource to create an infrastructure application:
83-
84-
```tf
85-
resource "cloudflare_zero_trust_access_application" "infra-app" {
86-
account_id = "f037e56e89293a057740de681ac9abbe"
87-
name = "Example infrastructure app"
88-
type = "infrastructure"
89-
90-
target_criteria {
91-
port = 22
92-
protocol = "SSH"
93-
target_attributes {
94-
name = "hostname"
95-
values = ["infra-access-target"]
96-
}
97-
}
98-
}
99-
```
100-
101-
2. Use the [`cloudflare_zero_trust_access_policy`](https://registry.terraform.io/providers/cloudflare/cloudflare/4.44.0/docs/resources/zero_trust_access_policy) resource to add an infrastructure policy to the application:
102-
103-
```tf
104-
resource "cloudflare_zero_trust_access_policy" "infra-app-policy" {
105-
application_id = cloudflare_zero_trust_access_application.infra-app.id
106-
account_id = "f037e56e89293a057740de681ac9abbe"
107-
name = "Allow a specific email"
108-
decision = "allow"
109-
precedence = 1
110-
111-
include {
112-
email = ["[email protected]"]
11361
}
62+
]
63+
}'
64+
```
11465

115-
connection_rules {
116-
ssh {
117-
usernames = ["root", "ec2-user"]
118-
}
119-
}
120-
}
121-
```
12266
</TabItem>
12367
</Tabs>
12468

125-
The targets in this application are now secured by your infrastructure policies.
126-
12769
:::note
128-
Gateway [network policies](/cloudflare-one/policies/gateway/network-policies/) take precedence over infrastructure policies. For example, if you block port `22` for all users in Gateway, then no one can SSH over port `22` to your targets.
70+
Access for Infrastructure only supports assigning one protocol per port. You can reuse a port/protocol pairing across infrastructure applications, but the port cannot be reassigned to another protocol.
12971
:::

‎src/content/partials/cloudflare-one/access/add-infrastructure-policy.mdx‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
---
2+
{}
3+
4+
---
5+
6+
import { Tabs, TabItem, Render } from "~/components"
7+
8+
To secure your targets, configure a policy that defines who can connect and how they can connect:
9+
10+
1. Enter any name for your policy.
11+
2. Create a rule that matches the users who are allowed to reach the targets. For more information, refer to [Access policies](/cloudflare-one/policies/access/).
12+
3. In **Connection context**, enter the UNIX usernames that users can log in as (for example, `root` or `ec2-user`).
13+
4. Select **Add application**.
14+
15+
The targets in this application are now secured by your infrastructure policies.
16+
17+
:::note
18+
Gateway [network policies](/cloudflare-one/policies/gateway/network-policies/) take precedence over infrastructure policies. For example, if you block port `22` for all users in Gateway, then no one can SSH over port `22` to your targets.
19+
:::

‎src/content/partials/cloudflare-one/access/add-target.mdx‎

Lines changed: 16 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ A target represents a single resource in your infrastructure (such as a server,
99

1010
To create a new target:
1111

12-
<Tabs syncKey="dashPlusAPI">
12+
<Tabs>
1313
<TabItem label="Dashboard">
1414
1. In [Zero Trust](https://one.dash.cloudflare.com/), go to **Network** > **Targets**.
1515
2. Select **Add a target**.
@@ -30,51 +30,22 @@ To create a new target:
3030
</TabItem>
3131
<TabItem label="API">
3232

33-
1. [Create an API token](/fundamentals/api/get-started/create-token/) with the following permissions:
34-
| Type | Item | Permission |
35-
| ------- | ---------------- | ---------- |
36-
| Account | Zero Trust | Edit |
37-
38-
2. Make a `POST` request to the [Infrastructure Access Targets](/api/operations/infra-targets-post) endpoint:
39-
40-
```sh
41-
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/infrastructure/targets \
42-
--header "Authorization: Bearer <API_TOKEN>" \
43-
--data '{
44-
"hostname": "infra-access-target",
45-
"ip": {
46-
"ipv4": {
47-
"ip_addr": "187.26.29.249",
48-
"virtual_network_id": "c77b744e-acc8-428f-9257-6878c046ed55"
49-
},
50-
"ipv6": {
51-
"ip_addr": "64c0:64e8:f0b4:8dbf:7104:72b0:ec8f:f5e0",
52-
"virtual_network_id": "c77b744e-acc8-428f-9257-6878c046ed55"
53-
}
54-
}
55-
}'
56-
```
57-
58-
</TabItem>
59-
<TabItem label="Terraform">
60-
61-
Configure the [`cloudflare_infrastructure_access_target`](https://registry.terraform.io/providers/cloudflare/cloudflare/4.44.0/docs/resources/infrastructure_access_target) resource:
62-
63-
```tf
64-
resource "cloudflare_infrastructure_access_target" "infra-ssh-target" {
65-
account_id = "f037e56e89293a057740de681ac9abbe"
66-
hostname = "infra-access-target"
67-
ip = {
68-
ipv4 = {
69-
ip_addr = "187.26.29.249"
70-
virtual_network_id = "c77b744e-acc8-428f-9257-6878c046ed55"
71-
}
72-
ipv6 = {
73-
ip_addr = "64c0:64e8:f0b4:8dbf:7104:72b0:ec8f:f5e0"
74-
virtual_network_id = "c77b744e-acc8-428f-9257-6878c046ed55"
75-
}
33+
```sh
34+
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/infrastructure/targets \
35+
--header "Authorization: Bearer <API_TOKEN>" \
36+
--data '{
37+
"hostname": "infra-access-target",
38+
"ip": {
39+
"ipv4": {
40+
"ip_addr": "187.26.29.249",
41+
"virtual_network_id": "c77b744e-acc8-428f-9257-6878c046ed55"
42+
},
43+
"ipv6": {
44+
"ip_addr": "64c0:64e8:f0b4:8dbf:7104:72b0:ec8f:f5e0",
45+
"virtual_network_id": "c77b744e-acc8-428f-9257-6878c046ed55"
7646
}
77-
}
47+
}
48+
}'
7849
```
7950

8051
</TabItem>

0 commit comments

Comments
 (0)