Skip to content

Commit b487888

Browse files
ranbelranbel
committed
add Terraform examples
1 parent d1182f5 commit b487888

File tree

5 files changed

+159
-99
lines changed

5 files changed

+159
-99
lines changed

‎src/content/docs/cloudflare-one/applications/non-http/infrastructure-apps.mdx‎

Lines changed: 14 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -47,29 +47,13 @@ Access for Infrastructure currently only supports [SSH](/cloudflare-one/connecti
4747

4848
<Render file="access/add-infrastructure-app" />
4949

50-
## 3. Add a policy
51-
52-
<Render file="access/add-infrastructure-policy" />
53-
54-
### Selectors
55-
56-
The following [Access policy selectors](/cloudflare-one/policies/access/#selectors) are available for securing infrastructure applications:
57-
58-
- Email
59-
- Emails ending in
60-
- SAML group
61-
- Country
62-
- Authentication method
63-
- Device posture
64-
- Entra group, GitHub organization, Google Workspace group, Okta group
65-
66-
## 4. Configure the server
50+
## 3. Configure the server
6751

6852
Certain protocols require configuring the server to trust connections through Access for Infrastructure. For more information, refer to the protocol-specific tutorial:
6953

7054
- [SSH](/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access/#7-configure-ssh-server)
7155

72-
## Connect as a user
56+
## 4. Connect as a user
7357

7458
Users connect to the target's IP address as if they were on your private network, using their preferred client software. The user must be logged into WARP on their device, but no other system configuration is required. You can optionally configure a [private DNS resolver](/cloudflare-one/policies/gateway/resolver-policies/) to allow connections to the target's private hostname.
7559

@@ -116,3 +100,15 @@ warp-cli target list
116100
## Revoke a user's session
117101

118102
To revoke a user's access to all infrastructure targets, you can either [revoke the user from Zero Trust](/cloudflare-one/identity/users/session-management/#per-user) or revoke their device. Cloudflare does not currently support revoking a user's session for a specific target.
103+
104+
## Infrastructure policy selectors
105+
106+
The following [Access policy selectors](/cloudflare-one/policies/access/#selectors) are available for securing infrastructure applications:
107+
108+
- Email
109+
- Emails ending in
110+
- SAML group
111+
- Country
112+
- Authentication method
113+
- Device posture
114+
- Entra group, GitHub organization, Google Workspace group, Okta group

‎src/content/docs/cloudflare-one/connections/connect-networks/use-cases/ssh/ssh-infrastructure-access.mdx‎

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -40,11 +40,7 @@ To connect your devices to Cloudflare:
4040

4141
<Render file="access/add-infrastructure-app" />
4242

43-
## 6. Add a policy
44-
45-
<Render file="access/add-infrastructure-policy" />
46-
47-
## 7. Configure SSH server
43+
## 6. Configure SSH server
4844

4945
Next, configure your SSH server to trust the Cloudflare SSH CA. This allows Access to authenticate using short-lived certificates instead of traditional SSH keys.
5046

@@ -65,7 +61,7 @@ To generate a Cloudflare SSH CA and get its public key:
6561
### Restart your SSH server
6662
<Render file="ssh/restart-server" />
6763

68-
## 8. Connect as a user
64+
## 7. Connect as a user
6965

7066
Users can use any SSH client to connect to the target, as long as they are logged into the WARP client on their device. If the target is located within a particular virtual network, ensure that the WARP client is [connected to that virtual network](/cloudflare-one/connections/connect-networks/private-net/cloudflared/tunnel-virtual-networks/#connect-to-a-virtual-network) before initiating the connection. Users do not need to modify any SSH configs on their device. For example, to SSH from a terminal:
7167

‎src/content/partials/cloudflare-one/access/add-infrastructure-app.mdx‎

Lines changed: 98 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -15,57 +15,115 @@ import { Tabs, TabItem, Render } from "~/components"
1515
5. In **Target criteria**, select the target hostname(s) that will represent the application. The application definition will apply to all targets that share the selected hostname, including any targets added in the future.
1616
6. Enter the **Protocol** and **Port** that will be used to connect to the server.
1717
7. (Optional) If a protocol runs on more than one port, select **Add new target criteria** and reconfigure the same target hostname and protocol with a different port number.
18+
:::note
19+
Access for Infrastructure only supports assigning one protocol per port. You can reuse a port/protocol pairing across infrastructure applications, but the port cannot be reassigned to another protocol.
20+
:::
1821
8. Select **Next**.
22+
9. To secure your targets, configure a policy that defines who can connect and how they can connect:
23+
1. Enter any name for your policy.
24+
2. Create a rule that matches the users who are allowed to reach the targets. For more information, refer to [Access policies](/cloudflare-one/policies/access/) and review the list of [infrastructure policy selectors](/cloudflare-one/applications/non-http/infrastructure-apps/#infrastructure-policy-selectors).
25+
3. In **Connection context**, enter the UNIX usernames that users can log in as (for example, `root` or `ec2-user`).
26+
4. Select **Add application**.
1927
</TabItem>
2028
<TabItem label="API">
2129

22-
To add an infrastructure application using the [API](/api/operations/access-applications-add-an-application):
23-
24-
```sh
25-
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/access/apps \
26-
--header "Authorization: Bearer <API_TOKEN>" \
27-
--header "Content-Type: application/json" \
28-
--data '{
29-
"name": "example app",
30-
"type": "infrastructure",
31-
"target_criteria": [
32-
{
33-
"target_attributes": {
34-
"hostname": [
35-
"infra-access-target"
36-
]
37-
},
38-
"port": 22,
39-
"protocol": "SSH"
40-
}
41-
],
42-
"policies": [
43-
{
44-
"name": "Allow a specific email",
45-
"decision": "allow",
46-
"include": [
47-
{
48-
"email": {
49-
"email": "[email protected]"
50-
}
51-
}
52-
],
53-
"connection_rules": {
54-
"ssh": {
55-
"usernames": [
56-
"root",
57-
"ec2-user"
30+
1. [Create an API token](/fundamentals/api/get-started/create-token/) with the following permissions:
31+
| Type | Item | Permission |
32+
| ------- | ---------------- | ---------- |
33+
| Account | Access: Apps & Policies | Edit |
34+
35+
2. Make a `POST` request to the [Access applications](/api/operations/access-applications-add-an-application) endpoint:
36+
37+
```sh
38+
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/access/apps \
39+
--header "Authorization: Bearer <API_TOKEN>" \
40+
--header "Content-Type: application/json" \
41+
--data '{
42+
"name": "Example infrastructure app",
43+
"type": "infrastructure",
44+
"target_criteria": [
45+
{
46+
"target_attributes": {
47+
"hostname": [
48+
"infra-access-target"
5849
]
50+
},
51+
"port": 22,
52+
"protocol": "SSH"
53+
}
54+
],
55+
"policies": [
56+
{
57+
"name": "Allow a specific email",
58+
"decision": "allow",
59+
"include": [
60+
{
61+
"email": {
62+
"email": "[email protected]"
63+
}
64+
}
65+
],
66+
"connection_rules": {
67+
"ssh": {
68+
"usernames": [
69+
"root",
70+
"ec2-user"
71+
]
72+
}
5973
}
6074
}
75+
]
76+
}'
77+
```
78+
79+
</TabItem>
80+
<TabItem label="Terraform">
81+
82+
1. Use the [`cloudflare_zero_trust_access_application`](https://registry.terraform.io/providers/cloudflare/cloudflare/4.44.0/docs/resources/zero_trust_access_application) resource to create an infrastructure application:
83+
84+
```tf
85+
resource "cloudflare_zero_trust_access_application" "infra-app" {
86+
account_id = "f037e56e89293a057740de681ac9abbe"
87+
name = "Example infrastructure app"
88+
type = "infrastructure"
89+
90+
target_criteria {
91+
port = 22
92+
protocol = "SSH"
93+
target_attributes {
94+
name = "hostname"
95+
values = ["infra-access-target"]
96+
}
97+
}
98+
}
99+
```
100+
101+
2. Use the [`cloudflare_zero_trust_access_policy`](https://registry.terraform.io/providers/cloudflare/cloudflare/4.44.0/docs/resources/zero_trust_access_policy) resource to add an infrastructure policy to the application:
102+
103+
```tf
104+
resource "cloudflare_zero_trust_access_policy" "infra-app-policy" {
105+
application_id = cloudflare_zero_trust_access_application.infra-app.id
106+
account_id = "f037e56e89293a057740de681ac9abbe"
107+
name = "Allow a specific email"
108+
decision = "allow"
109+
precedence = 1
110+
111+
include {
112+
email = ["[email protected]"]
61113
}
62-
]
63-
}'
64-
```
65114
115+
connection_rules {
116+
ssh {
117+
usernames = ["root", "ec2-user"]
118+
}
119+
}
120+
}
121+
```
66122
</TabItem>
67123
</Tabs>
68124

125+
The targets in this application are now secured by your infrastructure policies.
126+
69127
:::note
70-
Access for Infrastructure only supports assigning one protocol per port. You can reuse a port/protocol pairing across infrastructure applications, but the port cannot be reassigned to another protocol.
128+
Gateway [network policies](/cloudflare-one/policies/gateway/network-policies/) take precedence over infrastructure policies. For example, if you block port `22` for all users in Gateway, then no one can SSH over port `22` to your targets.
71129
:::

‎src/content/partials/cloudflare-one/access/add-infrastructure-policy.mdx‎

Lines changed: 0 additions & 19 deletions
This file was deleted.

‎src/content/partials/cloudflare-one/access/add-target.mdx‎

Lines changed: 45 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ A target represents a single resource in your infrastructure (such as a server,
99

1010
To create a new target:
1111

12-
<Tabs>
12+
<Tabs syncKey="dashPlusAPI">
1313
<TabItem label="Dashboard">
1414
1. In [Zero Trust](https://one.dash.cloudflare.com/), go to **Network** > **Targets**.
1515
2. Select **Add a target**.
@@ -30,22 +30,51 @@ To create a new target:
3030
</TabItem>
3131
<TabItem label="API">
3232

33-
```sh
34-
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/infrastructure/targets \
35-
--header "Authorization: Bearer <API_TOKEN>" \
36-
--data '{
37-
"hostname": "infra-access-target",
38-
"ip": {
39-
"ipv4": {
40-
"ip_addr": "187.26.29.249",
41-
"virtual_network_id": "c77b744e-acc8-428f-9257-6878c046ed55"
42-
},
43-
"ipv6": {
44-
"ip_addr": "64c0:64e8:f0b4:8dbf:7104:72b0:ec8f:f5e0",
45-
"virtual_network_id": "c77b744e-acc8-428f-9257-6878c046ed55"
33+
1. [Create an API token](/fundamentals/api/get-started/create-token/) with the following permissions:
34+
| Type | Item | Permission |
35+
| ------- | ---------------- | ---------- |
36+
| Account | Zero Trust | Edit |
37+
38+
2. Make a `POST` request to the [Infrastructure Access Targets](/api/operations/infra-targets-post) endpoint:
39+
40+
```sh
41+
curl https://api.cloudflare.com/client/v4/accounts/{account_id}/infrastructure/targets \
42+
--header "Authorization: Bearer <API_TOKEN>" \
43+
--data '{
44+
"hostname": "infra-access-target",
45+
"ip": {
46+
"ipv4": {
47+
"ip_addr": "187.26.29.249",
48+
"virtual_network_id": "c77b744e-acc8-428f-9257-6878c046ed55"
49+
},
50+
"ipv6": {
51+
"ip_addr": "64c0:64e8:f0b4:8dbf:7104:72b0:ec8f:f5e0",
52+
"virtual_network_id": "c77b744e-acc8-428f-9257-6878c046ed55"
53+
}
54+
}
55+
}'
56+
```
57+
58+
</TabItem>
59+
<TabItem label="Terraform">
60+
61+
Configure the [`cloudflare_infrastructure_access_target`](https://registry.terraform.io/providers/cloudflare/cloudflare/4.44.0/docs/resources/infrastructure_access_target) resource:
62+
63+
```tf
64+
resource "cloudflare_infrastructure_access_target" "infra-ssh-target" {
65+
account_id = "f037e56e89293a057740de681ac9abbe"
66+
hostname = "infra-access-target"
67+
ip = {
68+
ipv4 = {
69+
ip_addr = "187.26.29.249"
70+
virtual_network_id = "c77b744e-acc8-428f-9257-6878c046ed55"
71+
}
72+
ipv6 = {
73+
ip_addr = "64c0:64e8:f0b4:8dbf:7104:72b0:ec8f:f5e0"
74+
virtual_network_id = "c77b744e-acc8-428f-9257-6878c046ed55"
75+
}
4676
}
47-
}
48-
}'
77+
}
4978
```
5079

5180
</TabItem>

0 commit comments

Comments
 (0)