Skip to content

Commit a4d7333

Browse files
maxvpmaxvp
committed
Fix misc API call styling
1 parent ef88048 commit a4d7333

File tree

4 files changed

+42
-94
lines changed

4 files changed

+42
-94
lines changed

‎src/content/docs/learning-paths/secure-internet-traffic/build-dns-policies/recommended-dns-policies.mdx‎

Lines changed: 36 additions & 88 deletions
Original file line numberDiff line numberDiff line change
@@ -28,11 +28,11 @@ Allowlist any known domains and hostnames. With this policy, you ensure that you
2828

2929
```sh
3030
curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules \
31-
--header "Content-Type: application/json" \
32-
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
33-
--data '{
31+
--header "Content-Type: application/json" \
32+
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
33+
--data '{
3434
"name": "All-DNS-Domain-Allowlist",
35-
"description": "Organization-wide allowlist. Explicitly allow resolution of these DNS domains",
35+
"description": "Allowlist any known domains and hostnames",
3636
"precedence": 0,
3737
"enabled": false,
3838
"action": "allow",
@@ -51,7 +51,7 @@ curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules \
5151
resource "cloudflare_zero_trust_gateway_policy" "dns_whitelist_policy" {
5252
account_id = var.account_id
5353
name = "All-DNS-Domain-Allowlist"
54-
description = "Organization-wide allowlist. Explicitly allow resolution of these DNS domains"
54+
description = "Allowlist any known domains and hostnames"
5555
precedence = 0
5656
enabled = false
5757
action = "allow"
@@ -83,25 +83,20 @@ resource "cloudflare_zero_trust_gateway_policy" "dns_whitelist_policy" {
8383

8484
```sh
8585
curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules \
86-
--header "Content-Type: application/json" \
87-
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
88-
--data '{
86+
--header "Content-Type: application/json" \
87+
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
88+
--data '{
8989
"name": "Quarantined-Users-DNS-Restricted-Access",
90-
"description": "Restrict quarantined users traffic to corporate policy remediation domains, so that quarantined users can obtain help and/or remediate their security posture",
90+
"description": "Restrict access for users included in an identity provider (IdP) user group for risky users",
9191
"precedence": 10,
9292
"enabled": false,
9393
"action": "block",
9494
"filters": [
9595
"dns"
9696
],
9797
"traffic": "not(any(dns.domains[*] in $<ALLOWED_REMEDIATION_DOMAINS_LIST_UUID>)) or not(any(dns.domains[*] in $<ALLOWED_REMEDIATION_DOMAINS_LIST_UUID>))",
98-
"identity": "any(identity.groups.name[*] in {\"Quarantined Users\"})",
99-
"rule_settings": {
100-
"block_page_enabled": true,
101-
"notification_settings": {
102-
"enabled": true
103-
}
104-
}'
98+
"identity": "any(identity.groups.name[*] in {\"Quarantined Users\"})"
99+
}'
105100
```
106101

107102
</TabItem>
@@ -112,19 +107,13 @@ curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules \
112107
resource "cloudflare_zero_trust_gateway_policy" "dns_restrict_quarantined_users" {
113108
account_id = var.account_id
114109
name = "Quarantined-Users-DNS-Restricted-Access"
115-
description = "Restrict quarantined users traffic to corporate policy remediation domains, so that quarantined users can obtain help and/or remediate their security posture"
110+
description = "Restrict access for users included in an identity provider (IdP) user group for risky users"
116111
precedence = 10
117112
enabled = false
118113
action = "block"
119114
filters = ["dns"]
120115
traffic = "not(any(dns.domains[*] in ${"$"}${cloudflare_zero_trust_list.allowed_remediation_domains.id})) or not(any(dns.domains[*] in ${"$"}${cloudflare_zero_trust_list.allowed_remediation_domains.id}))"
121116
identity = "any(identity.groups.name[*] in {\"Quarantined Users\"})"
122-
rule_settings {
123-
block_page_enabled = true
124-
notification_settings {
125-
enabled = true
126-
}
127-
}
128117
}
129118
```
130119

@@ -179,9 +168,9 @@ Block websites hosted in countries categorized as high risk. The designation of
179168

180169
```sh
181170
curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules \
182-
--header "Content-Type: application/json" \
183-
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
184-
--data '{
171+
--header "Content-Type: application/json" \
172+
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
173+
--data '{
185174
"name": "All-DNS-GeoCountryIP-Blocklist",
186175
"description": "Block traffic hosted in countries categorized as high security risks",
187176
"precedence": 50,
@@ -190,11 +179,7 @@ curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules \
190179
"filters": [
191180
"dns"
192181
],
193-
"traffic": "any(dns.dst.geo.country[*] in {\"AF\" \"BY\" \"CD\" \"CU\" \"IR\" \"IQ\" \"KP\" \"MM\" \"RU\" \"SD\" \"SY\" \"UA\" \"ZW\"})",
194-
"rule_settings": {
195-
"block_page_enabled": true,
196-
"block_reason": "This domain was blocked due to being classified as a security risk to the organization"
197-
}
182+
"traffic": "any(dns.dst.geo.country[*] in {\"AF\" \"BY\" \"CD\" \"CU\" \"IR\" \"IQ\" \"KP\" \"MM\" \"RU\" \"SD\" \"SY\" \"UA\" \"ZW\"})"
198183
}'
199184
```
200185

@@ -212,10 +197,6 @@ resource "cloudflare_zero_trust_gateway_policy" "dns_geolocation_block_policy" {
212197
action = "block"
213198
filters = ["dns"]
214199
traffic = "any(dns.dst.geo.country[*] in {\"AF\" \"BY\" \"CD\" \"CU\" \"IR\" \"IQ\" \"KP\" \"MM\" \"RU\" \"SD\" \"SY\" \"UA\" \"ZW\"})"
215-
rule_settings {
216-
block_page_enabled = true
217-
block_page_reason = "This domain was blocked due to being classified as a security risk to the organization"
218-
}
219200
}
220201
```
221202

@@ -240,9 +221,9 @@ Block frequently misused top-level domains (TLDs) to reduce security risks, espe
240221

241222
```sh
242223
curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules \
243-
--header "Content-Type: application/json" \
244-
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
245-
--data '{
224+
--header "Content-Type: application/json" \
225+
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
226+
--data '{
246227
"name": "All-DNS-DomainTopLevel-Blocklist",
247228
"description": "Block DNS queries of known risky TLDs",
248229
"precedence": 60,
@@ -251,12 +232,8 @@ curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules \
251232
"filters": [
252233
"dns"
253234
],
254-
"traffic": "any(dns.domains[*] matches \"[.](cn|ru)$ or [.](rest|hair|top|live|cfd|boats|beauty|mom|skin|okinawa)$ or [.](zip|mobi)$\")",
255-
"rule_settings": {
256-
"block_page_enabled": true,
257-
"block_reason": "This domain was blocked due to being classified as a security risk to the organization"
258-
}
259-
}'
235+
"traffic": "any(dns.domains[*] matches \"[.](cn|ru)$ or [.](rest|hair|top|live|cfd|boats|beauty|mom|skin|okinawa)$ or [.](zip|mobi)$\")"
236+
}'
260237
```
261238

262239
</TabItem>
@@ -273,10 +250,6 @@ resource "cloudflare_zero_trust_gateway_policy" "dns_blacklist_policy" {
273250
action = "block"
274251
filters = ["dns"]
275252
traffic = "any(dns.domains[*] matches \"[.](cn|ru)$ or [.](rest|hair|top|live|cfd|boats|beauty|mom|skin|okinawa)$ or [.](zip|mobi)$\")"
276-
rule_settings {
277-
block_page_enabled = true
278-
block_page_reason = "This domain was blocked due to being classified as a security risk to the organization"
279-
}
280253
}
281254
```
282255

@@ -302,9 +275,9 @@ Block misused domains to protect your users against sophisticated phishing attac
302275

303276
```sh
304277
curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules \
305-
--header "Content-Type: application/json" \
306-
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
307-
--data '{
278+
--header "Content-Type: application/json" \
279+
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
280+
--data '{
308281
"name": "All-DNS-DomainPhishing-Blocklist",
309282
"description": "Block misused domains used in phishing campaigns",
310283
"precedence": 70,
@@ -313,13 +286,8 @@ curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules \
313286
"filters": [
314287
"dns"
315288
],
316-
"traffic": "any(dns.domains[*] matches \".*okta.*|.*cloudflare.*|.*mfa.*|.sso.*\") and not(any(dns.domains[*] in $<Known Phishing Domains List UUID>))",
317-
"rule_settings": {
318-
"block_page_enabled": true,
319-
"block_reason": "This domain was blocked due to being classified as a security risk to the organization"
320-
}
321-
322-
}'
289+
"traffic": "any(dns.domains[*] matches \".*okta.*|.*cloudflare.*|.*mfa.*|.sso.*\") and not(any(dns.domains[*] in $<KNOWN_DOMAINS_LIST_UUID>))"
290+
}'
323291
```
324292

325293
</TabItem>
@@ -336,10 +304,6 @@ resource "cloudflare_zero_trust_gateway_policy" "dns_phishing_domains_block" {
336304
action = "block"
337305
filters = ["dns"]
338306
traffic = "any(dns.domains[*] matches \".*okta.*|.*cloudflare.*|.*mfa.*|.sso.*\") and not(any(dns.domains[*] in ${"$"}${cloudflare_zero_trust_list.known_phishing_domains_list.id}))"
339-
rule_settings {
340-
block_page_enabled = true
341-
block_page_reason = "This domain was blocked due to being classified as a security risk to the organization"
342-
}
343307
}
344308
```
345309

@@ -366,9 +330,9 @@ Block specific IP addresses that are malicious or pose a threat to your organiza
366330

367331
```sh
368332
curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules \
369-
--header "Content-Type: application/json" \
370-
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
371-
--data '{
333+
--header "Content-Type: application/json" \
334+
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
335+
--data '{
372336
"name": "All-DNS-ResolvedIP-Blocklist",
373337
"description": "Block specific IP addresses deemed to be a risk to the Organization",
374338
"precedence": 80,
@@ -377,12 +341,8 @@ curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules \
377341
"filters": [
378342
"dns"
379343
],
380-
"traffic": "any(dns.resolved_ips[*] in $<IP_BLOCKLIST_UUID>)",
381-
"rule_settings": {
382-
"block_page_enabled": true,
383-
"block_reason": "This domain was blocked due to being classified as a security risk to the organization"
384-
}
385-
}'
344+
"traffic": "any(dns.resolved_ips[*] in $<IP_BLOCKLIST_UUID>)"
345+
}'
386346
```
387347

388348
</TabItem>
@@ -399,10 +359,6 @@ resource "cloudflare_zero_trust_gateway_policy" "dns_resolvedip_blocklist_rule"
399359
action = "block"
400360
filters = ["dns"]
401361
traffic = "any(dns.resolved_ips[*] in ${"$"}${cloudflare_zero_trust_list.ip_blocklist.id}"
402-
rule_settings {
403-
block_page_enabled = true
404-
block_page_reason = "This domain was blocked due to being classified as a security risk to the organization"
405-
}
406362
}
407363
```
408364

@@ -432,9 +388,9 @@ resource "cloudflare_zero_trust_gateway_policy" "dns_resolvedip_blocklist_rule"
432388

433389
```sh
434390
curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules \
435-
--header "Content-Type: application/json" \
436-
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN>" \
437-
--data '{
391+
--header "Content-Type: application/json" \
392+
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN>" \
393+
--data '{
438394
"name": "All-DNS-DomainHost-Blocklist",
439395
"description": "Block specific domains or hosts that are malicious or pose a threat to your organization.",
440396
"precedence": 90,
@@ -443,12 +399,8 @@ curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules \
443399
"filters": [
444400
"dns"
445401
],
446-
"traffic": "any(dns.domains[*] in $<DOMAIN_BLOCKLIST_UUID>) and dns.fqdn in $<HOST_BLOCKLIST_UUID> and dns.fqdn matches \".*example\\.com\"",
447-
"rule_settings": {
448-
"block_page_enabled": true,
449-
"block_reason": "This domain was blocked due to being classified as a security risk to the organization"
450-
}
451-
}'
402+
"traffic": "any(dns.domains[*] in $<DOMAIN_BLOCKLIST_UUID>) and dns.fqdn in $<HOST_BLOCKLIST_UUID> and dns.fqdn matches \".*example\\.com\""
403+
}'
452404
```
453405

454406
</TabItem>
@@ -465,10 +417,6 @@ resource "cloudflare_zero_trust_gateway_policy" "block_dns_domain_host" {
465417
action = "block"
466418
filters = ["dns"]
467419
traffic = "any(dns.domains[*] in ${"$"}${cloudflare_zero_trust_list.domain_blocklist.id}) and dns.fqdn in ${"$"}${cloudflare_zero_trust_list.host_blocklist.id} and dns.fqdn matches \".*example\\.com\""
468-
rule_settings = {
469-
block_page_enabled = true
470-
block_reason = "This domain was blocked due to being classified as a security risk to the organization"
471-
}
472420
}
473421
```
474422

‎src/content/partials/cloudflare-one/gateway/policies/dash-plus-api/dns/block-applications.mdx‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rule \
1818
--header "Content-Type: application/json" \
1919
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN>" \
2020
--data '{
21-
"name": "Block unauthorized applications",
21+
"name": "All-DNS-Application-Blocklist",
2222
"description": "Block access to unauthorized AI applications",
2323
"precedence": 40,
2424
"enabled": true,

‎src/content/partials/cloudflare-one/gateway/policies/dash-plus-api/dns/block-content-categories.mdx‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rule \
1818
--header "Content-Type: application/json" \
1919
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
2020
--data '{
21-
"name": "Block content categories",
21+
"name": "All-DNS-ContentCategories-Blocklist",
2222
"description": "Block common content categories that may pose a risk",
2323
"precedence": 30,
2424
"enabled": true,
@@ -37,7 +37,7 @@ curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rule \
3737
```tf
3838
resource "cloudflare_zero_trust_gateway_policy" "block_content_categories" {
3939
account_id = var.account_id
40-
name = "Block content categories"
40+
name = "All-DNS-ContentCategories-Blocklist"
4141
description = "Block common content categories that may pose a risk"
4242
enabled = true
4343
action = "block"

‎src/content/partials/cloudflare-one/gateway/policies/dash-plus-api/dns/block-security-categories.mdx‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,8 +19,8 @@ curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rule \
1919
--header "Content-Type: application/json" \
2020
--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
2121
--data '{
22-
"name": "Block security threats",
23-
"description": "Block all default Cloudflare DNS security categories",
22+
"name": "All-DNS-SecurityCategories-Blocklist",
23+
"description": "Block security categories based on Cloudflare's threat intelligence",
2424
"precedence": 20,
2525
"enabled": true,
2626
"action": "block",
@@ -39,7 +39,7 @@ curl https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rule \
3939
resource "cloudflare_zero_trust_gateway_policy" "block_security_threats" {
4040
account_id = var.account_id
4141
name = "All-DNS-SecurityCategories-Blocklist"
42-
description = "Block all default Cloudflare DNS security categories"
42+
description = "Block security categories based on Cloudflare's threat intelligence"
4343
precedence = 20
4444
enabled = false
4545
action = "block"

0 commit comments

Comments
 (0)