Skip to content

Commit 08d4a71

Browse files
ranbeljacobbednarz
ranbel
and
jacobbednarz
authored
[ZT] Terraform examples (device enrollment, infra access) (#17936)
* rename infrastructure access resource * device enrollment examples * Update src/content/partials/cloudflare-one/access/create-service-token.mdx Co-authored-by: Jacob Bednarz <[email protected]> --------- Co-authored-by: Jacob Bednarz <[email protected]>
1 parent 0002cf9 commit 08d4a71

File tree

6 files changed

+196
-23
lines changed

6 files changed

+196
-23
lines changed

‎src/content/partials/cloudflare-one/access/add-infrastructure-app.mdx‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -79,11 +79,14 @@ import { Tabs, TabItem, Render } from "~/components"
7979
</TabItem>
8080
<TabItem label="Terraform">
8181

82-
1. Use the [`cloudflare_zero_trust_access_application`](https://registry.terraform.io/providers/cloudflare/cloudflare/4.44.0/docs/resources/zero_trust_access_application) resource to create an infrastructure application:
82+
1. Add the following permission to your [`cloudflare_api_token`](https://registry.terraform.io/providers/cloudflare/cloudflare/4.40.0/docs/resources/api_token):
83+
- `Access: Apps and Policies Write`
84+
85+
2. Use the [`cloudflare_zero_trust_access_application`](https://registry.terraform.io/providers/cloudflare/cloudflare/4.45.0/docs/resources/zero_trust_access_application) resource to create an infrastructure application:
8386

8487
```tf
8588
resource "cloudflare_zero_trust_access_application" "infra-app" {
86-
account_id = "f037e56e89293a057740de681ac9abbe"
89+
account_id = var.cloudflare_account_id
8790
name = "Example infrastructure app"
8891
type = "infrastructure"
8992
@@ -98,12 +101,12 @@ import { Tabs, TabItem, Render } from "~/components"
98101
}
99102
```
100103

101-
2. Use the [`cloudflare_zero_trust_access_policy`](https://registry.terraform.io/providers/cloudflare/cloudflare/4.44.0/docs/resources/zero_trust_access_policy) resource to add an infrastructure policy to the application:
104+
3. Use the [`cloudflare_zero_trust_access_policy`](https://registry.terraform.io/providers/cloudflare/cloudflare/4.45.0/docs/resources/zero_trust_access_policy) resource to add an infrastructure policy to the application:
102105

103106
```tf
104107
resource "cloudflare_zero_trust_access_policy" "infra-app-policy" {
105108
application_id = cloudflare_zero_trust_access_application.infra-app.id
106-
account_id = "f037e56e89293a057740de681ac9abbe"
109+
account_id = var.cloudflare_account_id
107110
name = "Allow a specific email"
108111
decision = "allow"
109112
precedence = 1

‎src/content/partials/cloudflare-one/access/add-target.mdx‎

Lines changed: 19 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -58,24 +58,27 @@ To create a new target:
5858
</TabItem>
5959
<TabItem label="Terraform">
6060

61-
Configure the [`cloudflare_infrastructure_access_target`](https://registry.terraform.io/providers/cloudflare/cloudflare/4.44.0/docs/resources/infrastructure_access_target) resource:
61+
1. Add the following permission to your [`cloudflare_api_token`](https://registry.terraform.io/providers/cloudflare/cloudflare/4.40.0/docs/resources/api_token):
62+
- `Teams Write`
6263

63-
```tf
64-
resource "cloudflare_infrastructure_access_target" "infra-ssh-target" {
65-
account_id = "f037e56e89293a057740de681ac9abbe"
66-
hostname = "infra-access-target"
67-
ip = {
68-
ipv4 = {
69-
ip_addr = "187.26.29.249"
70-
virtual_network_id = "c77b744e-acc8-428f-9257-6878c046ed55"
71-
}
72-
ipv6 = {
73-
ip_addr = "64c0:64e8:f0b4:8dbf:7104:72b0:ec8f:f5e0"
74-
virtual_network_id = "c77b744e-acc8-428f-9257-6878c046ed55"
64+
2. Configure the [`cloudflare_zero_trust_infrastructure_access_target`](https://registry.terraform.io/providers/cloudflare/cloudflare/4.45.0/docs/resources/zero_trust_infrastructure_access_target) resource:
65+
66+
```tf
67+
resource "cloudflare_zero_trust_infrastructure_access_target" "infra-ssh-target" {
68+
account_id = var.cloudflare_account_id
69+
hostname = "infra-access-target"
70+
ip = {
71+
ipv4 = {
72+
ip_addr = "187.26.29.249"
73+
virtual_network_id = "c77b744e-acc8-428f-9257-6878c046ed55"
74+
}
75+
ipv6 = {
76+
ip_addr = "64c0:64e8:f0b4:8dbf:7104:72b0:ec8f:f5e0"
77+
virtual_network_id = "c77b744e-acc8-428f-9257-6878c046ed55"
78+
}
7579
}
76-
}
77-
}
78-
```
80+
}
81+
```
7982

8083
</TabItem>
8184
</Tabs>

‎src/content/partials/cloudflare-one/access/create-service-token.mdx‎

Lines changed: 47 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,10 @@
33

44
---
55

6+
import { Tabs, TabItem } from '~/components';
7+
8+
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
9+
610
1. In [Zero Trust](https://one.dash.cloudflare.com), go to **Access** > **Service Auth** > **Service Tokens**.
711

812
2. Select **Create Service Token**.
@@ -16,5 +20,47 @@
1620
6. Copy the Client Secret.
1721

1822
:::caution
19-
This is the only time Cloudflare Access will display the Client Secret. If you lose the Client Secret, you must generate a new service token.
23+
This is the only time Cloudflare Access will display the Client Secret. If you lose the Client Secret, you must generate a new service token.
2024
:::
25+
26+
</TabItem> <TabItem label="Terraform">
27+
28+
1. Add the following permission to your [`cloudflare_api_token`](https://registry.terraform.io/providers/cloudflare/cloudflare/4.40.0/docs/resources/api_token):
29+
- `Access: Service Tokens Write`
30+
31+
2. Configure the [`cloudflare_zero_trust_access_service_token`](https://registry.terraform.io/providers/cloudflare/cloudflare/4.40.0/docs/resources/zero_trust_access_service_token) resource:
32+
33+
```tf
34+
resource "cloudflare_zero_trust_access_service_token" "example_service_token" {
35+
account_id = var.cloudflare_account_id
36+
name = "Example service token"
37+
duration = "8760h"
38+
}
39+
```
40+
41+
3. Output the Client ID and Client Secret to the Terraform state file:
42+
43+
```tf
44+
output "example_service_token_client_id" {
45+
value = cloudflare_zero_trust_access_service_token.example_service_token.client_id
46+
}
47+
48+
output "example_service_token_client_secret" {
49+
value = cloudflare_zero_trust_access_service_token.example_service_token.client_secret
50+
sensitive = true
51+
}
52+
```
53+
4. Apply the configuration:
54+
```sh
55+
terraform apply
56+
```
57+
58+
5. Read the Client ID and Client Secret:
59+
```sh
60+
terraform output -raw example_service_token_client_id
61+
```
62+
```sh
63+
terraform output -raw example_service_token_client_secret
64+
```
65+
66+
</TabItem> </Tabs>

‎src/content/partials/cloudflare-one/warp/device-enrollment-mtls.mdx‎

Lines changed: 49 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,12 @@
33

44
---
55

6-
import { GlossaryTooltip } from "~/components"
6+
import { GlossaryTooltip, Tabs, TabItem } from "~/components"
77

88
To check for an mTLS certificate:
99

10+
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
11+
1012
1. [Add an mTLS certificate](/cloudflare-one/identity/devices/access-integrations/mutual-tls-authentication/#add-mtls-authentication-to-your-access-configuration) to your account. You can generate a sample certificate using the [Cloudflare PKI toolkit](/cloudflare-one/identity/devices/access-integrations/mutual-tls-authentication/#test-mtls-using-cloudflare-pki).
1113

1214
2. In **Associated hostnames**, enter your Zero Trust <GlossaryTooltip term="team domain">team domain</GlossaryTooltip>: `<team-name>.cloudflareaccess.com`
@@ -18,3 +20,49 @@ To check for an mTLS certificate:
1820
| Allow | Require | Common Name | `<CERT-COMMON-NAME>` |
1921

2022
4. On your device, add the client certificate to the [system keychain](/cloudflare-one/identity/devices/access-integrations/mutual-tls-authentication/#test-in-the-browser).
23+
24+
</TabItem> <TabItem label="Terraform">
25+
26+
1. Add the following permissions to your [`cloudflare_api_token`](https://registry.terraform.io/providers/cloudflare/cloudflare/4.40.0/docs/resources/api_token):
27+
- `Access: Mutual TLS Certificates Write`
28+
- `Access: Apps and Policies Write`
29+
30+
2. Use the [`cloudflare_zero_trust_access_mtls_certificate`](https://registry.terraform.io/providers/cloudflare/cloudflare/4.40.0/docs/resources/zero_trust_access_mtls_certificate) resource to add an mTLS certificate to your account:
31+
32+
```tf
33+
resource "cloudflare_zero_trust_access_mtls_certificate" "example_mtls_cert" {
34+
account_id = var.cloudflare_account_id
35+
name = "WARP enrollment mTLS cert"
36+
certificate = <<EOT
37+
-----BEGIN CERTIFICATE-----
38+
xxxx
39+
xxxx
40+
-----END CERTIFICATE-----
41+
EOT
42+
associated_hostnames = ["your-team-name.cloudflareaccess.com"]
43+
}
44+
```
45+
46+
3. Add the following policy to your [WARP enrollment Access application](/cloudflare-one/connections/connect-devices/warp/deployment/device-enrollment/#set-device-enrollment-permissions):
47+
48+
```tf
49+
resource "cloudflare_zero_trust_access_policy" "warp_enrollment_employees" {
50+
application_id = cloudflare_zero_trust_access_application.warp_enrollment_app.id
51+
account_id = var.cloudflare_account_id
52+
name = "Allow company emails"
53+
decision = "allow"
54+
precedence = 1
55+
56+
include {
57+
email_domain = ["company.com"]
58+
}
59+
60+
require {
61+
common_names = ["Common name 1", "Common name 2"]
62+
}
63+
}
64+
```
65+
66+
4. On your device, add the client certificate to the [system keychain](/cloudflare-one/identity/devices/access-integrations/mutual-tls-authentication/#test-in-the-browser).
67+
68+
</TabItem> </Tabs>

‎src/content/partials/cloudflare-one/warp/device-enrollment.mdx‎

Lines changed: 42 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,10 @@
33

44
---
55

6+
import { Tabs, TabItem } from '~/components';
7+
8+
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
9+
610
1. In [Zero Trust](https://one.dash.cloudflare.com), go to **Settings** > **WARP Client**.
711
2. In **Device enrollment permissions**, select **Manage**.
812
3. In the **Rules** tab, configure one or more [Access policies](/cloudflare-one/policies/access/) to define who can join their device. For example, you could allow all users with a company email address:
@@ -12,8 +16,45 @@
1216

1317
:::note
1418

15-
Device posture checks are not supported in device enrollment policies. WARP can only perform posture checks after the device is enrolled.
19+
Device posture checks are not supported in device enrollment policies. WARP can only perform posture checks after the device is enrolled.
1620
:::
1721

1822
4. In the **Authentication** tab, select the [identity providers](/cloudflare-one/identity/idp-integration/) users can authenticate with. If you have not integrated an identity provider, you can use the [one-time PIN](/cloudflare-one/identity/one-time-pin/).
1923
5. Select **Save**.
24+
25+
</TabItem> <TabItem label="Terraform">
26+
27+
1. Add the following permission to your [`cloudflare_api_token`](https://registry.terraform.io/providers/cloudflare/cloudflare/4.40.0/docs/resources/api_token):
28+
- `Access: Apps and Policies Write`
29+
30+
2. Use the [`cloudflare_zero_trust_access_application`](https://registry.terraform.io/providers/cloudflare/cloudflare/4.45.0/docs/resources/zero_trust_access_application) resource to create an application with type `warp`.
31+
32+
```tf
33+
resource "cloudflare_zero_trust_access_application" "warp_enrollment_app" {
34+
account_id = var.cloudflare_account_id
35+
session_duration = "18h"
36+
name = "Warp device enrollment"
37+
allowed_idps = [cloudflare_zero_trust_access_identity_provider.microsoft_entra_id.id]
38+
auto_redirect_to_identity = true
39+
type = "warp"
40+
app_launcher_visible = false
41+
}
42+
```
43+
44+
3. Use the [`cloudflare_zero_trust_access_policy`](https://registry.terraform.io/providers/cloudflare/cloudflare/4.45.0/docs/resources/zero_trust_access_policy) resource to define enrollment permissions.
45+
46+
```tf
47+
resource "cloudflare_zero_trust_access_policy" "warp_enrollment_employees" {
48+
application_id = cloudflare_zero_trust_access_application.warp_enrollment_app.id
49+
account_id = var.cloudflare_account_id
50+
name = "Allow company emails"
51+
decision = "allow"
52+
precedence = 1
53+
54+
include {
55+
email_domain = ["company.com"]
56+
}
57+
}
58+
```
59+
60+
</TabItem> </Tabs>

‎src/content/partials/cloudflare-one/warp/service-token-enrollment.mdx‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,10 @@
33

44
---
55

6+
import { Tabs, TabItem } from '~/components';
7+
8+
<Tabs syncKey="dashPlusAPI"> <TabItem label="Dashboard">
9+
610
1. [Create a service token](/cloudflare-one/identity/service-tokens/#create-a-service-token).
711

812
2. Copy the token's **Client ID** and **Client Secret**.
@@ -17,4 +21,32 @@
1721
* `auth_client_id`: The **Client ID** of your service token.
1822
* `auth_client_secret`: The **Client Secret** of your service token.
1923

24+
</TabItem> <TabItem label="Terraform">
25+
26+
1. Add the following permission to your [`cloudflare_api_token`](https://registry.terraform.io/providers/cloudflare/cloudflare/4.40.0/docs/resources/api_token):
27+
- `Access: Apps and Policies Write`
28+
29+
2. [Create a service token](/cloudflare-one/identity/service-tokens/#create-a-service-token) and copy its **Client ID** and **Client Secret**.
30+
31+
3. Add the following policy to your [WARP enrollment Access application](/cloudflare-one/connections/connect-devices/warp/deployment/device-enrollment/#set-device-enrollment-permissions):
32+
33+
```tf
34+
resource "cloudflare_zero_trust_access_policy" "warp_enrollment_service_token" {
35+
application_id = cloudflare_zero_trust_access_application.warp_enrollment_app.id
36+
account_id = var.cloudflare_account_id
37+
name = "Allow service token"
38+
decision = "non_identity"
39+
precedence = 2
40+
41+
include {
42+
service_token = [cloudflare_zero_trust_access_service_token.example_service_token.id]
43+
}
44+
}
45+
```
46+
4. In your MDM [deployment parameters](/cloudflare-one/connections/connect-devices/warp/deployment/mdm-deployment/parameters/), add the following fields:
47+
* `auth_client_id`: The **Client ID** of your service token.
48+
* `auth_client_secret`: The **Client Secret** of your service token.
49+
50+
</TabItem> </Tabs>
51+
2052
When you deploy the WARP client with your MDM provider, WARP will automatically connect the device to your Zero Trust organization.

0 commit comments

Comments
 (0)