Zero Trust
Zero TrustDevicesDEX Tests
resource cloudflare_zero_trust_dex_test
required
cloudflare_zero_trust_dex_test
resource "cloudflare_zero_trust_dex_test" "example_zero_trust_dex_test" {
account_id = "01a7362d577a6c3019a474fd6f485823"
data = {
host = "https://dash.cloudflare.com"
kind = "http"
method = "GET"
}
enabled = true
interval = "30m"
name = "HTTP dash health check"
description = "Checks the dash endpoint every 30 minutes"
target_policies = [{
id = "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
default = true
name = "name"
}]
}
data cloudflare_zero_trust_dex_test
computed
cloudflare_zero_trust_dex_test
data "cloudflare_zero_trust_dex_test" "example_zero_trust_dex_test" {
account_id = "01a7362d577a6c3019a474fd6f485823"
dex_test_id = "372e67954025e0ba6aaa6d586b9e0b59"
}
data cloudflare_zero_trust_dex_tests
optional
cloudflare_zero_trust_dex_tests
data "cloudflare_zero_trust_dex_tests" "example_zero_trust_dex_tests" {
account_id = "01a7362d577a6c3019a474fd6f485823"
kind = "http"
test_name = "testName"
}
Zero TrustDevicesIP Profiles
resource cloudflare_zero_trust_device_ip_profile
required
The wirefilter expression to match registrations. Available values: "identity.name", "identity.email", "identity.groups.id", "identity.groups.name", "identity.groups.email", "identity.saml_attributes".
optional
cloudflare_zero_trust_device_ip_profile
resource "cloudflare_zero_trust_device_ip_profile" "example_zero_trust_device_ip_profile" {
account_id = "account_id"
match = "identity.email == \"test@cloudflare.com\""
name = "IPv4 Cloudflare Source IPs"
precedence = 100
subnet_id = "b70ff985-a4ef-4643-bbbc-4a0ed4fc8415"
description = "example comment"
enabled = true
}
data cloudflare_zero_trust_device_ip_profile
computed
The wirefilter expression to match registrations. Available values: "identity.name", "identity.email", "identity.groups.id", "identity.groups.name", "identity.groups.email", "identity.saml_attributes".
cloudflare_zero_trust_device_ip_profile
data "cloudflare_zero_trust_device_ip_profile" "example_zero_trust_device_ip_profile" {
account_id = "account_id"
profile_id = "profile_id"
}
data cloudflare_zero_trust_device_ip_profiles
optional
cloudflare_zero_trust_device_ip_profiles
data "cloudflare_zero_trust_device_ip_profiles" "example_zero_trust_device_ip_profiles" {
account_id = "account_id"
}
Zero TrustDevicesNetworks
resource cloudflare_zero_trust_device_managed_networks
required
cloudflare_zero_trust_device_managed_networks
resource "cloudflare_zero_trust_device_managed_networks" "example_zero_trust_device_managed_networks" {
account_id = "699d98642c564d2e855e9661899b7252"
config = {
tls_sockaddr = "foo.bar:1234"
sha256 = "b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c"
}
name = "managed-network-1"
type = "tls"
}
data cloudflare_zero_trust_device_managed_networks
cloudflare_zero_trust_device_managed_networks
data "cloudflare_zero_trust_device_managed_networks" "example_zero_trust_device_managed_networks" {
account_id = "699d98642c564d2e855e9661899b7252"
network_id = "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
}
data cloudflare_zero_trust_device_managed_networks_list
cloudflare_zero_trust_device_managed_networks_list
data "cloudflare_zero_trust_device_managed_networks_list" "example_zero_trust_device_managed_networks_list" {
account_id = "699d98642c564d2e855e9661899b7252"
}
Zero TrustDevicesPoliciesDefault
resource cloudflare_zero_trust_device_default_profile
optional
The amount of time in minutes a user is allowed access to their LAN. A value of 0 will allow LAN access until the next WARP reconnection, such as a reboot or a laptop waking from sleep. Note that this field is omitted from the response if null or unset.
The size of the subnet for the local access network. Note that this field is omitted from the response if null or unset.
Whether to receive update notifications when a new version of the client is available.
If the dns_server field of a fallback domain is not present, the client will fall back to a best guess of the default/system DNS resolvers unless this policy option is set to true.
Determines if the operating system will register WARP's local interface IP with your on-premises DNS server.
Determines whether the WARP client indicates to SCCM that it is inside a VPN boundary. (Windows only).
cloudflare_zero_trust_device_default_profile
resource "cloudflare_zero_trust_device_default_profile" "example_zero_trust_device_default_profile" {
account_id = "699d98642c564d2e855e9661899b7252"
allow_mode_switch = true
allow_updates = true
allowed_to_leave = true
auto_connect = 0
captive_portal = 180
disable_auto_fallback = true
exclude = [{
address = "192.0.2.0/24"
description = "Exclude testing domains from the tunnel"
}]
exclude_office_ips = true
include = [{
address = "192.0.2.0/24"
description = "Include testing domains in the tunnel"
}]
lan_allow_minutes = 30
lan_allow_subnet_size = 24
register_interface_ip_with_dns = true
sccm_vpn_boundary_support = false
service_mode_v2 = {
mode = "proxy"
port = 3000
}
support_url = "https://1.1.1.1/help"
switch_locked = true
tunnel_protocol = "wireguard"
}
data cloudflare_zero_trust_device_default_profile
computed
Whether to receive update notifications when a new version of the client is available.
If the dns_server field of a fallback domain is not present, the client will fall back to a best guess of the default/system DNS resolvers unless this policy option is set to true.
Determines if the operating system will register WARP's local interface IP with your on-premises DNS server.
cloudflare_zero_trust_device_default_profile
data "cloudflare_zero_trust_device_default_profile" "example_zero_trust_device_default_profile" {
account_id = "699d98642c564d2e855e9661899b7252"
}
Zero TrustDevicesPoliciesDefaultFallback Domains
resource cloudflare_zero_trust_device_default_profile_local_domain_fallback
cloudflare_zero_trust_device_default_profile_local_domain_fallback
resource "cloudflare_zero_trust_device_default_profile_local_domain_fallback" "example_zero_trust_device_default_profile_local_domain_fallback" {
account_id = "699d98642c564d2e855e9661899b7252"
domains = [{
suffix = "example.com"
description = "Domain bypass for local development"
dns_server = ["1.1.1.1"]
}]
}
data cloudflare_zero_trust_device_default_profile_local_domain_fallback
cloudflare_zero_trust_device_default_profile_local_domain_fallback
data "cloudflare_zero_trust_device_default_profile_local_domain_fallback" "example_zero_trust_device_default_profile_local_domain_fallback" {
account_id = "699d98642c564d2e855e9661899b7252"
}
Zero TrustDevicesPoliciesDefaultCertificates
resource cloudflare_zero_trust_device_default_profile_certificates
cloudflare_zero_trust_device_default_profile_certificates
resource "cloudflare_zero_trust_device_default_profile_certificates" "example_zero_trust_device_default_profile_certificates" {
zone_id = "699d98642c564d2e855e9661899b7252"
enabled = true
}
data cloudflare_zero_trust_device_default_profile_certificates
cloudflare_zero_trust_device_default_profile_certificates
data "cloudflare_zero_trust_device_default_profile_certificates" "example_zero_trust_device_default_profile_certificates" {
zone_id = "699d98642c564d2e855e9661899b7252"
}
Zero TrustDevicesPoliciesCustom
resource cloudflare_zero_trust_device_custom_profile
required
optional
The amount of time in minutes a user is allowed access to their LAN. A value of 0 will allow LAN access until the next WARP reconnection, such as a reboot or a laptop waking from sleep. Note that this field is omitted from the response if null or unset.
The size of the subnet for the local access network. Note that this field is omitted from the response if null or unset.
Whether to receive update notifications when a new version of the client is available.
If the dns_server field of a fallback domain is not present, the client will fall back to a best guess of the default/system DNS resolvers unless this policy option is set to true.
Determines if the operating system will register WARP's local interface IP with your on-premises DNS server.
Determines whether the WARP client indicates to SCCM that it is inside a VPN boundary. (Windows only).
cloudflare_zero_trust_device_custom_profile
resource "cloudflare_zero_trust_device_custom_profile" "example_zero_trust_device_custom_profile" {
account_id = "699d98642c564d2e855e9661899b7252"
match = "identity.email == \"test@cloudflare.com\""
name = "Allow Developers"
precedence = 100
allow_mode_switch = true
allow_updates = true
allowed_to_leave = true
auto_connect = 0
captive_portal = 180
description = "Policy for test teams."
disable_auto_fallback = true
enabled = true
exclude = [{
address = "192.0.2.0/24"
description = "Exclude testing domains from the tunnel"
}]
exclude_office_ips = true
include = [{
address = "192.0.2.0/24"
description = "Include testing domains in the tunnel"
}]
lan_allow_minutes = 30
lan_allow_subnet_size = 24
register_interface_ip_with_dns = true
sccm_vpn_boundary_support = false
service_mode_v2 = {
mode = "proxy"
port = 3000
}
support_url = "https://1.1.1.1/help"
switch_locked = true
tunnel_protocol = "wireguard"
}
data cloudflare_zero_trust_device_custom_profile
computed
Whether to receive update notifications when a new version of the client is available.
If the dns_server field of a fallback domain is not present, the client will fall back to a best guess of the default/system DNS resolvers unless this policy option is set to true.
The amount of time in minutes a user is allowed access to their LAN. A value of 0 will allow LAN access until the next WARP reconnection, such as a reboot or a laptop waking from sleep. Note that this field is omitted from the response if null or unset.
The size of the subnet for the local access network. Note that this field is omitted from the response if null or unset.
The wirefilter expression to match devices. Available values: "identity.email", "identity.groups.id", "identity.groups.name", "identity.groups.email", "identity.service_token_uuid", "identity.saml_attributes", "network", "os.name", "os.version".
The precedence of the policy. Lower values indicate higher precedence. Policies will be evaluated in ascending order of this field.
Determines if the operating system will register WARP's local interface IP with your on-premises DNS server.
cloudflare_zero_trust_device_custom_profile
data "cloudflare_zero_trust_device_custom_profile" "example_zero_trust_device_custom_profile" {
account_id = "699d98642c564d2e855e9661899b7252"
policy_id = "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
}
data cloudflare_zero_trust_device_custom_profiles
cloudflare_zero_trust_device_custom_profiles
data "cloudflare_zero_trust_device_custom_profiles" "example_zero_trust_device_custom_profiles" {
account_id = "699d98642c564d2e855e9661899b7252"
}
Zero TrustDevicesPoliciesCustomFallback Domains
resource cloudflare_zero_trust_device_custom_profile_local_domain_fallback
cloudflare_zero_trust_device_custom_profile_local_domain_fallback
resource "cloudflare_zero_trust_device_custom_profile_local_domain_fallback" "example_zero_trust_device_custom_profile_local_domain_fallback" {
account_id = "699d98642c564d2e855e9661899b7252"
policy_id = "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
domains = [{
suffix = "example.com"
description = "Domain bypass for local development"
dns_server = ["1.1.1.1"]
}]
}
data cloudflare_zero_trust_device_custom_profile_local_domain_fallback
cloudflare_zero_trust_device_custom_profile_local_domain_fallback
data "cloudflare_zero_trust_device_custom_profile_local_domain_fallback" "example_zero_trust_device_custom_profile_local_domain_fallback" {
account_id = "699d98642c564d2e855e9661899b7252"
policy_id = "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
}
Zero TrustDevicesPosture
resource cloudflare_zero_trust_device_posture_rule
required
cloudflare_zero_trust_device_posture_rule
resource "cloudflare_zero_trust_device_posture_rule" "example_zero_trust_device_posture_rule" {
account_id = "699d98642c564d2e855e9661899b7252"
name = "Admin Serial Numbers"
type = "file"
description = "The rule for admin serial numbers"
expiration = "1h"
input = {
operating_system = "linux"
path = "/bin/cat"
exists = true
sha256 = "https://api.us-2.crowdstrike.com"
thumbprint = "0aabab210bdb998e9cf45da2c9ce352977ab531c681b74cf1e487be1bbe9fe6e"
}
match = [{
platform = "windows"
}]
schedule = "1h"
}
data cloudflare_zero_trust_device_posture_rule
cloudflare_zero_trust_device_posture_rule
data "cloudflare_zero_trust_device_posture_rule" "example_zero_trust_device_posture_rule" {
account_id = "699d98642c564d2e855e9661899b7252"
rule_id = "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
}
data cloudflare_zero_trust_device_posture_rules
cloudflare_zero_trust_device_posture_rules
data "cloudflare_zero_trust_device_posture_rules" "example_zero_trust_device_posture_rules" {
account_id = "699d98642c564d2e855e9661899b7252"
}
Zero TrustDevicesPostureIntegrations
resource cloudflare_zero_trust_device_posture_integration
required
cloudflare_zero_trust_device_posture_integration
resource "cloudflare_zero_trust_device_posture_integration" "example_zero_trust_device_posture_integration" {
account_id = "699d98642c564d2e855e9661899b7252"
config = {
api_url = "https://as123.awmdm.com/API"
auth_url = "https://na.uemauth.workspaceone.com/connect/token"
client_id = "example client id"
client_secret = "example client secret"
}
interval = "10m"
name = "My Workspace One Integration"
type = "workspace_one"
}
data cloudflare_zero_trust_device_posture_integration
cloudflare_zero_trust_device_posture_integration
data "cloudflare_zero_trust_device_posture_integration" "example_zero_trust_device_posture_integration" {
account_id = "699d98642c564d2e855e9661899b7252"
integration_id = "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
}
data cloudflare_zero_trust_device_posture_integrations
cloudflare_zero_trust_device_posture_integrations
data "cloudflare_zero_trust_device_posture_integrations" "example_zero_trust_device_posture_integrations" {
account_id = "699d98642c564d2e855e9661899b7252"
}
Zero TrustDevicesSettings
resource cloudflare_zero_trust_device_settings
optional
Sets the time limit, in seconds, that a user can use an override code to bypass WARP.
Controls whether the external emergency disconnect feature is enabled.
The SHA256 fingerprint (64 hexadecimal characters) of the HTTPS server certificate for the external_emergency_signal_url. If provided, the WARP client will use this value to verify the server's identity. The device will ignore any response if the server's certificate fingerprint does not exactly match this value.
The interval at which the WARP client fetches the emergency disconnect signal, formatted as a duration string (e.g., "5m", "2m30s", "1h"). Minimum 30 seconds.
The HTTPS URL from which to fetch the emergency disconnect signal. Must use HTTPS and have an IPv4 or IPv6 address as the host.
cloudflare_zero_trust_device_settings
resource "cloudflare_zero_trust_device_settings" "example_zero_trust_device_settings" {
account_id = "699d98642c564d2e855e9661899b7252"
disable_for_time = 0
external_emergency_signal_enabled = true
external_emergency_signal_fingerprint = "abcd1234567890abcd1234567890abcd1234567890abcd1234567890abcd1234"
external_emergency_signal_interval = "5m"
external_emergency_signal_url = "https://192.0.2.1/signal"
gateway_proxy_enabled = true
gateway_udp_proxy_enabled = true
root_certificate_installation_enabled = true
use_zt_virtual_ip = true
}
data cloudflare_zero_trust_device_settings
computed
Sets the time limit, in seconds, that a user can use an override code to bypass WARP.
Controls whether the external emergency disconnect feature is enabled.
The SHA256 fingerprint (64 hexadecimal characters) of the HTTPS server certificate for the external_emergency_signal_url. If provided, the WARP client will use this value to verify the server's identity. The device will ignore any response if the server's certificate fingerprint does not exactly match this value.
The interval at which the WARP client fetches the emergency disconnect signal, formatted as a duration string (e.g., "5m", "2m30s", "1h"). Minimum 30 seconds.
The HTTPS URL from which to fetch the emergency disconnect signal. Must use HTTPS and have an IPv4 or IPv6 address as the host.
cloudflare_zero_trust_device_settings
data "cloudflare_zero_trust_device_settings" "example_zero_trust_device_settings" {
account_id = "699d98642c564d2e855e9661899b7252"
}
Zero TrustIdentity Providers
resource cloudflare_zero_trust_access_identity_provider
required
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
optional
cloudflare_zero_trust_access_identity_provider
resource "cloudflare_zero_trust_access_identity_provider" "example_zero_trust_access_identity_provider" {
config = {
claims = ["email_verified", "preferred_username", "custom_claim_name"]
client_id = "<your client id>"
client_secret = "<your client secret>"
conditional_access_enabled = true
directory_id = "<your azure directory uuid>"
email_claim_name = "custom_claim_name"
prompt = "login"
support_groups = true
}
name = "Widget Corps IDP"
type = "onetimepin"
zone_id = "zone_id"
scim_config = {
enabled = true
identity_update_behavior = "automatic"
seat_deprovision = true
user_deprovision = true
}
}
data cloudflare_zero_trust_access_identity_provider
optional
computed
The type of identity provider. To determine the value for a specific provider, refer to our developer documentation.
cloudflare_zero_trust_access_identity_provider
data "cloudflare_zero_trust_access_identity_provider" "example_zero_trust_access_identity_provider" {
identity_provider_id = "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
account_id = "account_id"
zone_id = "zone_id"
}
data cloudflare_zero_trust_access_identity_providers
cloudflare_zero_trust_access_identity_providers
data "cloudflare_zero_trust_access_identity_providers" "example_zero_trust_access_identity_providers" {
account_id = "account_id"
zone_id = "zone_id"
scim_enabled = "scim_enabled"
}
Zero TrustOrganizations
resource cloudflare_zero_trust_organization
optional
Determines whether to deny all requests to Cloudflare-protected resources that lack an associated Access application. If enabled, you must explicitly configure an Access application and policy to allow traffic to your Cloudflare-protected resources. For domains you want to be public across all subdomains, add the domain to the deny_unmatched_requests_exempted_zone_names array.
The amount of time that tokens issued for applications will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count. Minimum value for this setting is 1 month (730h). Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
The amount of time that tokens issued for applications will be valid. Must be in the format 30m or 2h45m. Valid time units are: m, h.
Contains zone names to exempt from the deny_unmatched_requests feature. Requests to a subdomain in an exempted zone will block unauthenticated traffic by default if there is a configured Access application and policy that matches the request.
When set to true, users can authenticate via WARP for any application in your organization. Application settings will take precedence over this value.
When set to true, users skip the identity provider selection step during login.
Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled.
cloudflare_zero_trust_organization
resource "cloudflare_zero_trust_organization" "example_zero_trust_organization" {
zone_id = "zone_id"
allow_authenticate_via_warp = true
auth_domain = "test.cloudflareaccess.com"
auto_redirect_to_identity = true
custom_pages = {
forbidden = "699d98642c564d2e855e9661899b7252"
identity_denied = "699d98642c564d2e855e9661899b7252"
}
deny_unmatched_requests = true
deny_unmatched_requests_exempted_zone_names = ["example.com"]
is_ui_read_only = true
login_design = {
background_color = "#c5ed1b"
footer_text = "This is an example description."
header_text = "This is an example description."
logo_path = "https://example.com/logo.png"
text_color = "#c5ed1b"
}
mfa_config = {
allowed_authenticators = ["totp", "biometrics", "security_key"]
session_duration = "24h"
}
mfa_required_for_all_apps = false
name = "Widget Corps Internal Applications"
session_duration = "24h"
ui_read_only_toggle_reason = "Temporarily turn off the UI read only lock to make a change via the UI"
user_seat_expiration_inactive_time = "730h"
warp_auth_session_duration = "24h"
}
data cloudflare_zero_trust_organization
optional
computed
When set to true, users can authenticate via WARP for any application in your organization. Application settings will take precedence over this value.
When set to true, users skip the identity provider selection step during login.
Determines whether to deny all requests to Cloudflare-protected resources that lack an associated Access application. If enabled, you must explicitly configure an Access application and policy to allow traffic to your Cloudflare-protected resources. For domains you want to be public across all subdomains, add the domain to the deny_unmatched_requests_exempted_zone_names array.
Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled.
Determines whether global MFA settings apply to applications by default. The organization must have MFA enabled with at least one authentication method and a session duration configured.
The amount of time that tokens issued for applications will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
A description of the reason why the UI read only field is being toggled.
The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count. Minimum value for this setting is 1 month (730h). Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
The amount of time that tokens issued for applications will be valid. Must be in the format 30m or 2h45m. Valid time units are: m, h.
cloudflare_zero_trust_organization
data "cloudflare_zero_trust_organization" "example_zero_trust_organization" {
account_id = "account_id"
zone_id = "zone_id"
}
Zero TrustAccessAI ControlsMcpPortals
resource cloudflare_zero_trust_access_ai_controls_mcp_portal
optional
cloudflare_zero_trust_access_ai_controls_mcp_portal
resource "cloudflare_zero_trust_access_ai_controls_mcp_portal" "example_zero_trust_access_ai_controls_mcp_portal" {
account_id = "a86a8f5c339544d7bdc89926de14fb8c"
id = "my-mcp-portal"
hostname = "exmaple.com"
name = "My MCP Portal"
allow_code_mode = true
description = "This is my custom MCP Portal"
secure_web_gateway = false
servers = [{
server_id = "my-mcp-server"
default_disabled = true
on_behalf = true
updated_prompts = [{
name = "name"
alias = "my-custom-alias"
description = "description"
enabled = true
}]
updated_tools = [{
name = "name"
alias = "my-custom-alias"
description = "description"
enabled = true
}]
}]
}
data cloudflare_zero_trust_access_ai_controls_mcp_portal
cloudflare_zero_trust_access_ai_controls_mcp_portal
data "cloudflare_zero_trust_access_ai_controls_mcp_portal" "example_zero_trust_access_ai_controls_mcp_portal" {
account_id = "a86a8f5c339544d7bdc89926de14fb8c"
id = "my-mcp-portal"
}
data cloudflare_zero_trust_access_ai_controls_mcp_portals
optional
cloudflare_zero_trust_access_ai_controls_mcp_portals
data "cloudflare_zero_trust_access_ai_controls_mcp_portals" "example_zero_trust_access_ai_controls_mcp_portals" {
account_id = "a86a8f5c339544d7bdc89926de14fb8c"
search = "search"
}
Zero TrustAccessAI ControlsMcpServers
resource cloudflare_zero_trust_access_ai_controls_mcp_server
cloudflare_zero_trust_access_ai_controls_mcp_server
resource "cloudflare_zero_trust_access_ai_controls_mcp_server" "example_zero_trust_access_ai_controls_mcp_server" {
account_id = "a86a8f5c339544d7bdc89926de14fb8c"
id = "my-mcp-server"
auth_type = "unauthenticated"
hostname = "https://example.com/mcp"
name = "My MCP Server"
auth_credentials = "auth_credentials"
description = "This is one remote mcp server"
}
data cloudflare_zero_trust_access_ai_controls_mcp_server
cloudflare_zero_trust_access_ai_controls_mcp_server
data "cloudflare_zero_trust_access_ai_controls_mcp_server" "example_zero_trust_access_ai_controls_mcp_server" {
account_id = "a86a8f5c339544d7bdc89926de14fb8c"
id = "my-mcp-server"
}
data cloudflare_zero_trust_access_ai_controls_mcp_servers
cloudflare_zero_trust_access_ai_controls_mcp_servers
data "cloudflare_zero_trust_access_ai_controls_mcp_servers" "example_zero_trust_access_ai_controls_mcp_servers" {
account_id = "a86a8f5c339544d7bdc89926de14fb8c"
search = "search"
}
Zero TrustAccessInfrastructureTargets
resource cloudflare_zero_trust_access_infrastructure_target
required
cloudflare_zero_trust_access_infrastructure_target
resource "cloudflare_zero_trust_access_infrastructure_target" "example_zero_trust_access_infrastructure_target" {
account_id = "023e105f4ecef8ad9ca31a8372d0c353"
hostname = "infra-access-target"
ip = {
ipv4 = {
ip_addr = "187.26.29.249"
virtual_network_id = "c77b744e-acc8-428f-9257-6878c046ed55"
}
ipv6 = {
ip_addr = "64c0:64e8:f0b4:8dbf:7104:72b0:ec8f:f5e0"
virtual_network_id = "c77b744e-acc8-428f-9257-6878c046ed55"
}
}
}
data cloudflare_zero_trust_access_infrastructure_target
cloudflare_zero_trust_access_infrastructure_target
data "cloudflare_zero_trust_access_infrastructure_target" "example_zero_trust_access_infrastructure_target" {
account_id = "023e105f4ecef8ad9ca31a8372d0c353"
target_id = "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"
}
data cloudflare_zero_trust_access_infrastructure_targets
optional
Filters for targets whose IP addresses look like the specified string.
Supports * as a wildcard character
Defines an IPv4 filter range's ending value (inclusive). Requires
ipv4_start to be specified as well.
Defines an IPv4 filter range's starting value (inclusive). Requires
ipv4_end to be specified as well.
Defines an IPv6 filter range's ending value (inclusive). Requires
ipv6_start to be specified as well.
Defines an IPv6 filter range's starting value (inclusive). Requires
ipv6_end to be specified as well.
Filters for targets that have any of the following IP addresses. Specify
ips multiple times in query parameter to build list of candidates.
cloudflare_zero_trust_access_infrastructure_targets
data "cloudflare_zero_trust_access_infrastructure_targets" "example_zero_trust_access_infrastructure_targets" {
account_id = "023e105f4ecef8ad9ca31a8372d0c353"
created_after = "2019-12-27T18:11:19.117Z"
created_before = "2019-12-27T18:11:19.117Z"
direction = "asc"
hostname = "hostname"
hostname_contains = "hostname_contains"
ip_like = "ip_like"
ip_v4 = "ip_v4"
ip_v6 = "ip_v6"
ips = ["string"]
ipv4_end = "ipv4_end"
ipv4_start = "ipv4_start"
ipv6_end = "ipv6_end"
ipv6_start = "ipv6_start"
modified_after = "2019-12-27T18:11:19.117Z"
modified_before = "2019-12-27T18:11:19.117Z"
order = "hostname"
target_ids = ["182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"]
virtual_network_id = "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"
}
Zero TrustAccessApplicationsCAs
resource cloudflare_zero_trust_access_short_lived_certificate
optional
cloudflare_zero_trust_access_short_lived_certificate
resource "cloudflare_zero_trust_access_short_lived_certificate" "example_zero_trust_access_short_lived_certificate" {
app_id = "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
zone_id = "zone_id"
}
data cloudflare_zero_trust_access_short_lived_certificate
optional
cloudflare_zero_trust_access_short_lived_certificate
data "cloudflare_zero_trust_access_short_lived_certificate" "example_zero_trust_access_short_lived_certificate" {
app_id = "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
account_id = "account_id"
zone_id = "zone_id"
}
data cloudflare_zero_trust_access_short_lived_certificates
optional
cloudflare_zero_trust_access_short_lived_certificates
data "cloudflare_zero_trust_access_short_lived_certificates" "example_zero_trust_access_short_lived_certificates" {
account_id = "account_id"
zone_id = "zone_id"
}
Zero TrustAccessCertificates
resource cloudflare_zero_trust_access_mtls_certificate
optional
cloudflare_zero_trust_access_mtls_certificate
resource "cloudflare_zero_trust_access_mtls_certificate" "example_zero_trust_access_mtls_certificate" {
certificate = <<EOT
-----BEGIN CERTIFICATE-----
MIIGAjCCA+qgAwIBAgIJAI7kymlF7CWT...N4RI7KKB7nikiuUf8vhULKy5IX10
DrUtmu/B
-----END CERTIFICATE-----
EOT
name = "Allow devs"
zone_id = "zone_id"
associated_hostnames = ["admin.example.com"]
}
data cloudflare_zero_trust_access_mtls_certificate
optional
cloudflare_zero_trust_access_mtls_certificate
data "cloudflare_zero_trust_access_mtls_certificate" "example_zero_trust_access_mtls_certificate" {
certificate_id = "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
account_id = "account_id"
zone_id = "zone_id"
}
data cloudflare_zero_trust_access_mtls_certificates
optional
cloudflare_zero_trust_access_mtls_certificates
data "cloudflare_zero_trust_access_mtls_certificates" "example_zero_trust_access_mtls_certificates" {
account_id = "account_id"
zone_id = "zone_id"
}
Zero TrustAccessCertificatesSettings
resource cloudflare_zero_trust_access_mtls_hostname_settings
optional
computed
Request client certificates for this hostname in China. Can only be set to true if this zone is china network enabled.
cloudflare_zero_trust_access_mtls_hostname_settings
resource "cloudflare_zero_trust_access_mtls_hostname_settings" "example_zero_trust_access_mtls_hostname_settings" {
settings = [{
china_network = false
client_certificate_forwarding = true
hostname = "admin.example.com"
}]
zone_id = "zone_id"
}
data cloudflare_zero_trust_access_mtls_hostname_settings
optional
computed
Request client certificates for this hostname in China. Can only be set to true if this zone is china network enabled.
cloudflare_zero_trust_access_mtls_hostname_settings
data "cloudflare_zero_trust_access_mtls_hostname_settings" "example_zero_trust_access_mtls_hostname_settings" {
account_id = "account_id"
zone_id = "zone_id"
}
Zero TrustAccessGroups
resource cloudflare_zero_trust_access_group
optional
cloudflare_zero_trust_access_group
resource "cloudflare_zero_trust_access_group" "example_zero_trust_access_group" {
include = [{
group = {
id = "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
}
}]
name = "Allow devs"
zone_id = "zone_id"
exclude = [{
group = {
id = "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
}
}]
is_default = true
require = [{
group = {
id = "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
}
}]
}
data cloudflare_zero_trust_access_group
optional
cloudflare_zero_trust_access_group
data "cloudflare_zero_trust_access_group" "example_zero_trust_access_group" {
group_id = "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
account_id = "account_id"
zone_id = "zone_id"
}
data cloudflare_zero_trust_access_groups
optional
cloudflare_zero_trust_access_groups
data "cloudflare_zero_trust_access_groups" "example_zero_trust_access_groups" {
account_id = "account_id"
zone_id = "zone_id"
name = "name"
search = "search"
}
Zero TrustAccessService Tokens
resource cloudflare_zero_trust_access_service_token
optional
The expiration of the previous client_secret. This can be modified at any point after a rotation. For example, you may extend it further into the future if you need more time to update services with the new secret; or move it into the past to immediately invalidate the previous token in case of compromise.
cloudflare_zero_trust_access_service_token
resource "cloudflare_zero_trust_access_service_token" "example_zero_trust_access_service_token" {
name = "CI/CD token"
zone_id = "zone_id"
client_secret_version = 0
duration = "60m"
previous_client_secret_expires_at = "2014-01-01T05:20:00.12345Z"
}
data cloudflare_zero_trust_access_service_token
optional
computed
The Client ID for the service token. Access will check for this value in the CF-Access-Client-ID request header.
cloudflare_zero_trust_access_service_token
data "cloudflare_zero_trust_access_service_token" "example_zero_trust_access_service_token" {
service_token_id = "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
account_id = "account_id"
zone_id = "zone_id"
}
data cloudflare_zero_trust_access_service_tokens
optional
cloudflare_zero_trust_access_service_tokens
data "cloudflare_zero_trust_access_service_tokens" "example_zero_trust_access_service_tokens" {
account_id = "account_id"
zone_id = "zone_id"
name = "name"
search = "search"
}
Zero TrustAccessKeys
resource cloudflare_zero_trust_access_key_configuration
required
cloudflare_zero_trust_access_key_configuration
resource "cloudflare_zero_trust_access_key_configuration" "example_zero_trust_access_key_configuration" {
account_id = "023e105f4ecef8ad9ca31a8372d0c353"
key_rotation_interval_days = 30
}
data cloudflare_zero_trust_access_key_configuration
cloudflare_zero_trust_access_key_configuration
data "cloudflare_zero_trust_access_key_configuration" "example_zero_trust_access_key_configuration" {
account_id = "023e105f4ecef8ad9ca31a8372d0c353"
}
Zero TrustAccessCustom Pages
resource cloudflare_zero_trust_access_custom_page
required
cloudflare_zero_trust_access_custom_page
resource "cloudflare_zero_trust_access_custom_page" "example_zero_trust_access_custom_page" {
account_id = "023e105f4ecef8ad9ca31a8372d0c353"
custom_html = "<html><body><h1>Access Denied</h1></body></html>"
name = "name"
type = "identity_denied"
}
data cloudflare_zero_trust_access_custom_page
cloudflare_zero_trust_access_custom_page
data "cloudflare_zero_trust_access_custom_page" "example_zero_trust_access_custom_page" {
account_id = "023e105f4ecef8ad9ca31a8372d0c353"
custom_page_id = "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
}
data cloudflare_zero_trust_access_custom_pages
cloudflare_zero_trust_access_custom_pages
data "cloudflare_zero_trust_access_custom_pages" "example_zero_trust_access_custom_pages" {
account_id = "023e105f4ecef8ad9ca31a8372d0c353"
}
Zero TrustAccessTags
Zero TrustAccessPolicies
resource cloudflare_zero_trust_access_policy
required
optional
Requires the user to request access from an administrator at the start of each session.
Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.
A custom message that will appear on the purpose justification screen.
Require users to enter a justification when they log in to the application.
cloudflare_zero_trust_access_policy
resource "cloudflare_zero_trust_access_policy" "example_zero_trust_access_policy" {
account_id = "023e105f4ecef8ad9ca31a8372d0c353"
decision = "allow"
include = [{
group = {
id = "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
}
}]
name = "Allow devs"
approval_groups = [{
approvals_needed = 1
email_addresses = ["test1@cloudflare.com", "test2@cloudflare.com"]
email_list_uuid = "email_list_uuid"
}, {
approvals_needed = 3
email_addresses = ["test@cloudflare.com", "test2@cloudflare.com"]
email_list_uuid = "597147a1-976b-4ef2-9af0-81d5d007fc34"
}]
approval_required = true
connection_rules = {
rdp = {
allowed_clipboard_local_to_remote_formats = ["text"]
allowed_clipboard_remote_to_local_formats = ["text"]
}
}
exclude = [{
group = {
id = "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
}
}]
isolation_required = false
mfa_config = {
allowed_authenticators = ["totp", "biometrics", "security_key"]
mfa_disabled = false
session_duration = "24h"
}
purpose_justification_prompt = "Please enter a justification for entering this protected domain."
purpose_justification_required = true
require = [{
group = {
id = "aa0a4aab-672b-4bdb-bc33-a59f1130a11f"
}
}]
session_duration = "24h"
}
data cloudflare_zero_trust_access_policy
computed
Requires the user to request access from an administrator at the start of each session.
The action Access will take if a user matches this policy. Infrastructure application policies can only use the Allow action.
Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.
A custom message that will appear on the purpose justification screen.
Require users to enter a justification when they log in to the application.
cloudflare_zero_trust_access_policy
data "cloudflare_zero_trust_access_policy" "example_zero_trust_access_policy" {
account_id = "023e105f4ecef8ad9ca31a8372d0c353"
policy_id = "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
}
data cloudflare_zero_trust_access_policies
cloudflare_zero_trust_access_policies
data "cloudflare_zero_trust_access_policies" "example_zero_trust_access_policies" {
account_id = "023e105f4ecef8ad9ca31a8372d0c353"
}
Zero TrustDEXRules
resource cloudflare_zero_trust_dex_rule
required
cloudflare_zero_trust_dex_rule
resource "cloudflare_zero_trust_dex_rule" "example_zero_trust_dex_rule" {
account_id = "01a7362d577a6c3019a474fd6f485823"
match = "match"
name = "name"
description = "description"
}
data cloudflare_zero_trust_dex_rule
cloudflare_zero_trust_dex_rule
data "cloudflare_zero_trust_dex_rule" "example_zero_trust_dex_rule" {
account_id = "01a7362d577a6c3019a474fd6f485823"
rule_id = "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
}
data cloudflare_zero_trust_dex_rules
optional
cloudflare_zero_trust_dex_rules
data "cloudflare_zero_trust_dex_rules" "example_zero_trust_dex_rules" {
account_id = "01a7362d577a6c3019a474fd6f485823"
name = "name"
}
Zero TrustTunnelsCloudflared
resource cloudflare_zero_trust_tunnel_cloudflared
optional
computed
Timestamp of when the tunnel established at least one connection to Cloudflare's edge. If null, the tunnel is inactive.
Timestamp of when the tunnel became inactive (no connections to Cloudflare's edge). If null, the tunnel is active.
Timestamp of when the resource was deleted. If null, the resource has not been deleted.
If true, the tunnel can be configured remotely from the Zero Trust dashboard. If false, the tunnel must be configured locally on the origin machine.
The status of the tunnel. Valid values are inactive (tunnel has never been run), degraded (tunnel is active and able to serve traffic but in an unhealthy state), healthy (tunnel is active and able to serve traffic), or down (tunnel can not serve traffic as it has no connections to the Cloudflare Edge).
cloudflare_zero_trust_tunnel_cloudflared
resource "cloudflare_zero_trust_tunnel_cloudflared" "example_zero_trust_tunnel_cloudflared" {
account_id = "699d98642c564d2e855e9661899b7252"
name = "blog"
config_src = "cloudflare"
tunnel_secret = "AQIDBAUGBwgBAgMEBQYHCAECAwQFBgcIAQIDBAUGBwg="
}
data cloudflare_zero_trust_tunnel_cloudflared
computed
Indicates if this is a locally or remotely configured tunnel. If local, manage the tunnel using a YAML file on the origin machine. If cloudflare, manage the tunnel on the Zero Trust dashboard.
Timestamp of when the tunnel established at least one connection to Cloudflare's edge. If null, the tunnel is inactive.
Timestamp of when the tunnel became inactive (no connections to Cloudflare's edge). If null, the tunnel is active.
Timestamp of when the resource was deleted. If null, the resource has not been deleted.
If true, the tunnel can be configured remotely from the Zero Trust dashboard. If false, the tunnel must be configured locally on the origin machine.
The status of the tunnel. Valid values are inactive (tunnel has never been run), degraded (tunnel is active and able to serve traffic but in an unhealthy state), healthy (tunnel is active and able to serve traffic), or down (tunnel can not serve traffic as it has no connections to the Cloudflare Edge).
cloudflare_zero_trust_tunnel_cloudflared
data "cloudflare_zero_trust_tunnel_cloudflared" "example_zero_trust_tunnel_cloudflared" {
account_id = "699d98642c564d2e855e9661899b7252"
tunnel_id = "f70ff985-a4ef-4643-bbbc-4a0ed4fc8415"
}
data cloudflare_zero_trust_tunnel_cloudflareds
optional
If provided, include only resources that were created (and not deleted) before this time. URL encoded.
If true, only include deleted tunnels. If false, exclude deleted tunnels. If empty, all tunnels will be included.
The status of the tunnel. Valid values are inactive (tunnel has never been run), degraded (tunnel is active and able to serve traffic but in an unhealthy state), healthy (tunnel is active and able to serve traffic), or down (tunnel can not serve traffic as it has no connections to the Cloudflare Edge).
cloudflare_zero_trust_tunnel_cloudflareds
data "cloudflare_zero_trust_tunnel_cloudflareds" "example_zero_trust_tunnel_cloudflareds" {
account_id = "699d98642c564d2e855e9661899b7252"
exclude_prefix = "vpc1-"
existed_at = "2019-10-12T07%3A20%3A50.52Z"
include_prefix = "vpc1-"
is_deleted = true
name = "blog"
status = "healthy"
uuid = "f70ff985-a4ef-4643-bbbc-4a0ed4fc8415"
was_active_at = "2009-11-10T23:00:00Z"
was_inactive_at = "2009-11-10T23:00:00Z"
}
Zero TrustTunnelsCloudflaredConfigurations
resource cloudflare_zero_trust_tunnel_cloudflared_config
cloudflare_zero_trust_tunnel_cloudflared_config
resource "cloudflare_zero_trust_tunnel_cloudflared_config" "example_zero_trust_tunnel_cloudflared_config" {
account_id = "023e105f4ecef8ad9ca31a8372d0c353"
tunnel_id = "f70ff985-a4ef-4643-bbbc-4a0ed4fc8415"
config = {
ingress = [{
hostname = "tunnel.example.com"
service = "https://localhost:8001"
origin_request = {
access = {
aud_tag = ["string"]
team_name = "zero-trust-organization-name"
required = false
}
ca_pool = "caPool"
connect_timeout = 10
disable_chunked_encoding = true
http2_origin = true
http_host_header = "httpHostHeader"
keep_alive_connections = 100
keep_alive_timeout = 90
match_sn_ito_host = false
no_happy_eyeballs = false
no_tls_verify = false
origin_server_name = "originServerName"
proxy_type = "proxyType"
tcp_keep_alive = 30
tls_timeout = 10
}
path = "subpath"
}]
origin_request = {
access = {
aud_tag = ["string"]
team_name = "zero-trust-organization-name"
required = false
}
ca_pool = "caPool"
connect_timeout = 10
disable_chunked_encoding = true
http2_origin = true
http_host_header = "httpHostHeader"
keep_alive_connections = 100
keep_alive_timeout = 90
match_sn_ito_host = false
no_happy_eyeballs = false
no_tls_verify = false
origin_server_name = "originServerName"
proxy_type = "proxyType"
tcp_keep_alive = 30
tls_timeout = 10
}
}
}
data cloudflare_zero_trust_tunnel_cloudflared_config
computed
cloudflare_zero_trust_tunnel_cloudflared_config
data "cloudflare_zero_trust_tunnel_cloudflared_config" "example_zero_trust_tunnel_cloudflared_config" {
account_id = "023e105f4ecef8ad9ca31a8372d0c353"
tunnel_id = "f70ff985-a4ef-4643-bbbc-4a0ed4fc8415"
}
Zero TrustTunnelsCloudflaredToken
data cloudflare_zero_trust_tunnel_cloudflared_token
cloudflare_zero_trust_tunnel_cloudflared_token
data "cloudflare_zero_trust_tunnel_cloudflared_token" "example_zero_trust_tunnel_cloudflared_token" {
account_id = "699d98642c564d2e855e9661899b7252"
tunnel_id = "f70ff985-a4ef-4643-bbbc-4a0ed4fc8415"
}
Zero TrustTunnelsWARP Connector
resource cloudflare_zero_trust_tunnel_warp_connector
optional
computed
Timestamp of when the tunnel established at least one connection to Cloudflare's edge. If null, the tunnel is inactive.
Timestamp of when the tunnel became inactive (no connections to Cloudflare's edge). If null, the tunnel is active.
Timestamp of when the resource was deleted. If null, the resource has not been deleted.
The status of the tunnel. Valid values are inactive (tunnel has never been run), degraded (tunnel is active and able to serve traffic but in an unhealthy state), healthy (tunnel is active and able to serve traffic), or down (tunnel can not serve traffic as it has no connections to the Cloudflare Edge).
cloudflare_zero_trust_tunnel_warp_connector
resource "cloudflare_zero_trust_tunnel_warp_connector" "example_zero_trust_tunnel_warp_connector" {
account_id = "699d98642c564d2e855e9661899b7252"
name = "blog"
ha = true
}
data cloudflare_zero_trust_tunnel_warp_connector
computed
Timestamp of when the tunnel established at least one connection to Cloudflare's edge. If null, the tunnel is inactive.
Timestamp of when the tunnel became inactive (no connections to Cloudflare's edge). If null, the tunnel is active.
Timestamp of when the resource was deleted. If null, the resource has not been deleted.
The status of the tunnel. Valid values are inactive (tunnel has never been run), degraded (tunnel is active and able to serve traffic but in an unhealthy state), healthy (tunnel is active and able to serve traffic), or down (tunnel can not serve traffic as it has no connections to the Cloudflare Edge).
cloudflare_zero_trust_tunnel_warp_connector
data "cloudflare_zero_trust_tunnel_warp_connector" "example_zero_trust_tunnel_warp_connector" {
account_id = "699d98642c564d2e855e9661899b7252"
tunnel_id = "f70ff985-a4ef-4643-bbbc-4a0ed4fc8415"
}
data cloudflare_zero_trust_tunnel_warp_connectors
optional
If provided, include only resources that were created (and not deleted) before this time. URL encoded.
If true, only include deleted tunnels. If false, exclude deleted tunnels. If empty, all tunnels will be included.
The status of the tunnel. Valid values are inactive (tunnel has never been run), degraded (tunnel is active and able to serve traffic but in an unhealthy state), healthy (tunnel is active and able to serve traffic), or down (tunnel can not serve traffic as it has no connections to the Cloudflare Edge).
cloudflare_zero_trust_tunnel_warp_connectors
data "cloudflare_zero_trust_tunnel_warp_connectors" "example_zero_trust_tunnel_warp_connectors" {
account_id = "699d98642c564d2e855e9661899b7252"
exclude_prefix = "vpc1-"
existed_at = "2019-10-12T07%3A20%3A50.52Z"
include_prefix = "vpc1-"
is_deleted = true
name = "blog"
status = "healthy"
uuid = "f70ff985-a4ef-4643-bbbc-4a0ed4fc8415"
was_active_at = "2009-11-10T23:00:00Z"
was_inactive_at = "2009-11-10T23:00:00Z"
}
Zero TrustTunnelsWARP ConnectorToken
data cloudflare_zero_trust_tunnel_warp_connector_token
cloudflare_zero_trust_tunnel_warp_connector_token
data "cloudflare_zero_trust_tunnel_warp_connector_token" "example_zero_trust_tunnel_warp_connector_token" {
account_id = "699d98642c564d2e855e9661899b7252"
tunnel_id = "f70ff985-a4ef-4643-bbbc-4a0ed4fc8415"
}
Zero TrustDLPDatasets
resource cloudflare_zero_trust_dlp_dataset
optional
Dataset encoding version
Non-secret custom word lists with no header are always version 1. Secret EDM lists with no header are version 1. Multicolumn CSV with headers are version 2. Omitting this field provides the default value 0, which is interpreted the same as 1.
Generate a secret dataset.
If true, the response will include a secret to use with the EDM encoder. If false, the response has no secret and the dataset is uploaded in plaintext.
cloudflare_zero_trust_dlp_dataset
resource "cloudflare_zero_trust_dlp_dataset" "example_zero_trust_dlp_dataset" {
account_id = "account_id"
name = "name"
case_sensitive = true
description = "description"
encoding_version = 0
secret = true
}
data cloudflare_zero_trust_dlp_dataset
computed
cloudflare_zero_trust_dlp_dataset
data "cloudflare_zero_trust_dlp_dataset" "example_zero_trust_dlp_dataset" {
account_id = "account_id"
dataset_id = "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"
}
Zero TrustDLPProfilesCustom
resource cloudflare_zero_trust_dlp_custom_profile
cloudflare_zero_trust_dlp_custom_profile
resource "cloudflare_zero_trust_dlp_custom_profile" "example_zero_trust_dlp_custom_profile" {
account_id = "account_id"
name = "name"
ai_context_enabled = true
allowed_match_count = 5
confidence_threshold = "confidence_threshold"
context_awareness = {
enabled = true
skip = {
files = true
}
}
data_classes = ["182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"]
data_tags = ["182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"]
description = "description"
ocr_enabled = true
sensitivity_levels = [["182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"]]
shared_entries = [{
enabled = true
entry_id = "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"
}]
}
data cloudflare_zero_trust_dlp_custom_profile
cloudflare_zero_trust_dlp_custom_profile
data "cloudflare_zero_trust_dlp_custom_profile" "example_zero_trust_dlp_custom_profile" {
account_id = "account_id"
profile_id = "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"
}
Zero TrustDLPProfilesPredefined
resource cloudflare_zero_trust_dlp_predefined_profile
optional
cloudflare_zero_trust_dlp_predefined_profile
resource "cloudflare_zero_trust_dlp_predefined_profile" "example_zero_trust_dlp_predefined_profile" {
account_id = "account_id"
profile_id = "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"
ai_context_enabled = true
allowed_match_count = 5
confidence_threshold = "confidence_threshold"
enabled_entries = ["182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"]
entries = [{
id = "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"
enabled = true
}]
ocr_enabled = true
}
data cloudflare_zero_trust_dlp_predefined_profile
cloudflare_zero_trust_dlp_predefined_profile
data "cloudflare_zero_trust_dlp_predefined_profile" "example_zero_trust_dlp_predefined_profile" {
account_id = "account_id"
profile_id = "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"
}
Zero TrustDLPEntries
resource cloudflare_zero_trust_dlp_entry
cloudflare_zero_trust_dlp_entry
resource "cloudflare_zero_trust_dlp_entry" "example_zero_trust_dlp_entry" {
account_id = "account_id"
enabled = true
name = "name"
pattern = {
regex = "regex"
validation = "luhn"
}
description = "description"
profile_id = "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"
}
data cloudflare_zero_trust_dlp_entry
cloudflare_zero_trust_dlp_entry
data "cloudflare_zero_trust_dlp_entry" "example_zero_trust_dlp_entry" {
account_id = "account_id"
entry_id = "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"
}
Zero TrustDLPEntriesCustom
resource cloudflare_zero_trust_dlp_custom_entry
cloudflare_zero_trust_dlp_custom_entry
resource "cloudflare_zero_trust_dlp_custom_entry" "example_zero_trust_dlp_custom_entry" {
account_id = "account_id"
enabled = true
name = "name"
pattern = {
regex = "regex"
validation = "luhn"
}
description = "description"
profile_id = "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"
}
data cloudflare_zero_trust_dlp_custom_entry
cloudflare_zero_trust_dlp_custom_entry
data "cloudflare_zero_trust_dlp_custom_entry" "example_zero_trust_dlp_custom_entry" {
account_id = "account_id"
entry_id = "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"
}
Zero TrustDLPEntriesPredefined
resource cloudflare_zero_trust_dlp_predefined_entry
optional
computed
cloudflare_zero_trust_dlp_predefined_entry
resource "cloudflare_zero_trust_dlp_predefined_entry" "example_zero_trust_dlp_predefined_entry" {
account_id = "account_id"
enabled = true
entry_id = "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"
profile_id = "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"
}
data cloudflare_zero_trust_dlp_predefined_entry
cloudflare_zero_trust_dlp_predefined_entry
data "cloudflare_zero_trust_dlp_predefined_entry" "example_zero_trust_dlp_predefined_entry" {
account_id = "account_id"
entry_id = "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"
}
data cloudflare_zero_trust_dlp_predefined_entries
cloudflare_zero_trust_dlp_predefined_entries
data "cloudflare_zero_trust_dlp_predefined_entries" "example_zero_trust_dlp_predefined_entries" {
account_id = "account_id"
}
Zero TrustDLPEntriesIntegration
resource cloudflare_zero_trust_dlp_integration_entry
optional
computed
cloudflare_zero_trust_dlp_integration_entry
resource "cloudflare_zero_trust_dlp_integration_entry" "example_zero_trust_dlp_integration_entry" {
account_id = "account_id"
enabled = true
entry_id = "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"
profile_id = "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"
}
data cloudflare_zero_trust_dlp_integration_entry
cloudflare_zero_trust_dlp_integration_entry
data "cloudflare_zero_trust_dlp_integration_entry" "example_zero_trust_dlp_integration_entry" {
account_id = "account_id"
entry_id = "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"
}
data cloudflare_zero_trust_dlp_integration_entries
cloudflare_zero_trust_dlp_integration_entries
data "cloudflare_zero_trust_dlp_integration_entries" "example_zero_trust_dlp_integration_entries" {
account_id = "account_id"
}
Zero TrustGatewayCategories
data cloudflare_zero_trust_gateway_categories_list
cloudflare_zero_trust_gateway_categories_list
data "cloudflare_zero_trust_gateway_categories_list" "example_zero_trust_gateway_categories_list" {
account_id = "023e105f4ecef8ad9ca31a8372d0c353"
}
Zero TrustGatewayApp Types
data cloudflare_zero_trust_gateway_app_types_list
cloudflare_zero_trust_gateway_app_types_list
data "cloudflare_zero_trust_gateway_app_types_list" "example_zero_trust_gateway_app_types_list" {
account_id = "023e105f4ecef8ad9ca31a8372d0c353"
}
Zero TrustGatewayConfigurations
resource cloudflare_zero_trust_gateway_settings
cloudflare_zero_trust_gateway_settings
resource "cloudflare_zero_trust_gateway_settings" "example_zero_trust_gateway_settings" {
account_id = "699d98642c564d2e855e9661899b7252"
settings = {
activity_log = {
enabled = true
}
antivirus = {
enabled_download_phase = false
enabled_upload_phase = false
fail_closed = false
notification_settings = {
enabled = true
include_context = true
msg = "msg"
support_url = "support_url"
}
}
block_page = {
background_color = "background_color"
enabled = true
footer_text = "--footer--"
header_text = "--header--"
include_context = true
logo_path = "https://logos.com/a.png"
mailto_address = "admin@example.com"
mailto_subject = "Blocked User Inquiry"
mode = ""
name = "Cloudflare"
suppress_footer = false
target_uri = "https://example.com"
}
body_scanning = {
inspection_mode = "deep"
}
browser_isolation = {
non_identity_enabled = true
url_browser_isolation_enabled = true
}
certificate = {
id = "d1b364c5-1311-466e-a194-f0e943e0799f"
}
custom_certificate = {
enabled = true
id = "d1b364c5-1311-466e-a194-f0e943e0799f"
}
extended_email_matching = {
enabled = true
}
fips = {
tls = true
}
host_selector = {
enabled = false
}
inspection = {
mode = "static"
}
protocol_detection = {
enabled = true
}
sandbox = {
enabled = true
fallback_action = "allow"
}
tls_decrypt = {
enabled = true
}
}
}
Zero TrustGatewayLists
resource cloudflare_zero_trust_list
cloudflare_zero_trust_list
resource "cloudflare_zero_trust_list" "example_zero_trust_list" {
account_id = "699d98642c564d2e855e9661899b7252"
name = "Admin Serial Numbers"
type = "SERIAL"
description = "The serial numbers for administrators"
items = [{
description = "Austin office IP"
value = "8GE8721REF"
}]
}
data cloudflare_zero_trust_list
cloudflare_zero_trust_list
data "cloudflare_zero_trust_list" "example_zero_trust_list" {
account_id = "699d98642c564d2e855e9661899b7252"
list_id = "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
}
data cloudflare_zero_trust_lists
cloudflare_zero_trust_lists
data "cloudflare_zero_trust_lists" "example_zero_trust_lists" {
account_id = "699d98642c564d2e855e9661899b7252"
type = "SERIAL"
}
Zero TrustGatewayLocations
resource cloudflare_zero_trust_dns_location
optional
Specify the identifier of the pair of IPv4 addresses assigned to this location. When creating a location, if this field is absent or set to null, the pair of shared IPv4 addresses (0e4a32c6-6fb8-4858-9296-98f51631e8e6) is auto-assigned. When updating a location, if this field is absent or set to null, the pre-assigned pair remains unchanged.
computed
Specify the UUID of the IPv6 block brought to the gateway so that this location's IPv6 address is allocated from the Bring Your Own IPv6 (BYOIPv6) block rather than the standard Cloudflare IPv6 block.
Specify the DNS over HTTPS domain that receives DNS requests. Gateway automatically generates this value.
Defines the automatically generated IPv6 destination IP assigned to this location. Gateway counts all DNS requests sent to this IP as requests under this location.
Show the primary destination IPv4 address from the pair identified dns_destination_ips_id. This field read-only.
cloudflare_zero_trust_dns_location
resource "cloudflare_zero_trust_dns_location" "example_zero_trust_dns_location" {
account_id = "699d98642c564d2e855e9661899b7252"
name = "Austin Office Location"
client_default = false
dns_destination_ips_id = "0e4a32c6-6fb8-4858-9296-98f51631e8e6"
ecs_support = false
endpoints = {
doh = {
enabled = true
networks = [{
network = "2001:85a3::/64"
}]
require_token = true
}
dot = {
enabled = true
networks = [{
network = "2001:85a3::/64"
}]
}
ipv4 = {
enabled = true
}
ipv6 = {
enabled = true
networks = [{
network = "2001:85a3::/64"
}]
}
}
networks = [{
network = "192.0.2.1/32"
}]
}
data cloudflare_zero_trust_dns_location
computed
Indicate the identifier of the pair of IPv4 addresses assigned to this location.
Specify the UUID of the IPv6 block brought to the gateway so that this location's IPv6 address is allocated from the Bring Your Own IPv6 (BYOIPv6) block rather than the standard Cloudflare IPv6 block.
Specify the DNS over HTTPS domain that receives DNS requests. Gateway automatically generates this value.
Defines the automatically generated IPv6 destination IP assigned to this location. Gateway counts all DNS requests sent to this IP as requests under this location.
Show the primary destination IPv4 address from the pair identified dns_destination_ips_id. This field read-only.
cloudflare_zero_trust_dns_location
data "cloudflare_zero_trust_dns_location" "example_zero_trust_dns_location" {
account_id = "699d98642c564d2e855e9661899b7252"
location_id = "ed35569b41ce4d1facfe683550f54086"
}
data cloudflare_zero_trust_dns_locations
cloudflare_zero_trust_dns_locations
data "cloudflare_zero_trust_dns_locations" "example_zero_trust_dns_locations" {
account_id = "699d98642c564d2e855e9661899b7252"
}
Zero TrustGatewayLogging
resource cloudflare_zero_trust_gateway_logging
optional
cloudflare_zero_trust_gateway_logging
resource "cloudflare_zero_trust_gateway_logging" "example_zero_trust_gateway_logging" {
account_id = "699d98642c564d2e855e9661899b7252"
redact_pii = true
settings_by_rule_type = {
dns = {
log_all = false
log_blocks = true
}
http = {
log_all = false
log_blocks = true
}
l4 = {
log_all = false
log_blocks = true
}
}
}
data cloudflare_zero_trust_gateway_logging
cloudflare_zero_trust_gateway_logging
data "cloudflare_zero_trust_gateway_logging" "example_zero_trust_gateway_logging" {
account_id = "699d98642c564d2e855e9661899b7252"
}
Zero TrustGatewayProxy Endpoints
resource cloudflare_zero_trust_gateway_proxy_endpoint
optional
cloudflare_zero_trust_gateway_proxy_endpoint
resource "cloudflare_zero_trust_gateway_proxy_endpoint" "example_zero_trust_gateway_proxy_endpoint" {
account_id = "699d98642c564d2e855e9661899b7252"
name = "Devops team"
kind = "ip"
}
data cloudflare_zero_trust_gateway_proxy_endpoint
computed
cloudflare_zero_trust_gateway_proxy_endpoint
data "cloudflare_zero_trust_gateway_proxy_endpoint" "example_zero_trust_gateway_proxy_endpoint" {
account_id = "699d98642c564d2e855e9661899b7252"
proxy_endpoint_id = "ed35569b41ce4d1facfe683550f54086"
}
data cloudflare_zero_trust_gateway_proxy_endpoints
cloudflare_zero_trust_gateway_proxy_endpoints
data "cloudflare_zero_trust_gateway_proxy_endpoints" "example_zero_trust_gateway_proxy_endpoints" {
account_id = "699d98642c564d2e855e9661899b7252"
}
Zero TrustGatewayRules
resource cloudflare_zero_trust_gateway_policy
required
optional
Specify the protocol or layer to evaluate the traffic, identity, and device posture expressions. Can only contain a single value.
Specify the wirefilter expression used for device posture check. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response.
Specify the wirefilter expression used for identity matching. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response.
Set the order of your rules. Lower values indicate higher precedence. At each processing phase, evaluate applicable rules in ascending order of this value. Refer to Order of enforcement to manage precedence via Terraform.
computed
cloudflare_zero_trust_gateway_policy
resource "cloudflare_zero_trust_gateway_policy" "example_zero_trust_gateway_policy" {
account_id = "699d98642c564d2e855e9661899b7252"
action = "allow"
name = "block bad websites"
description = "Block bad websites based on their host name."
device_posture = "any(device_posture.checks.passed[*] in {\"1308749e-fcfb-4ebc-b051-fe022b632644\"})"
enabled = true
expiration = {
expires_at = "2014-01-01T05:20:20Z"
duration = 10
}
filters = ["http"]
identity = "any(identity.groups.name[*] in {\"finance\"})"
precedence = 0
rule_settings = {
add_headers = {
My-Next-Header = ["foo", "bar"]
X-Custom-Header-Name = ["somecustomvalue"]
}
allow_child_bypass = false
audit_ssh = {
command_logging = false
}
biso_admin_controls = {
copy = "remote_only"
dcp = true
dd = true
dk = true
download = "enabled"
dp = false
du = true
keyboard = "enabled"
paste = "enabled"
printing = "enabled"
upload = "enabled"
version = "v1"
}
block_page = {
target_uri = "https://example.com"
include_context = true
}
block_page_enabled = true
block_reason = "This website is a security risk"
bypass_parent_rule = false
check_session = {
duration = "300s"
enforce = true
}
dns_resolvers = {
ipv4 = [{
ip = "2.2.2.2"
port = 5053
route_through_private_network = true
vnet_id = "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
}]
ipv6 = [{
ip = "2001:DB8::"
port = 5053
route_through_private_network = true
vnet_id = "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
}]
}
egress = {
ipv4 = "192.0.2.2"
ipv4_fallback = "192.0.2.3"
ipv6 = "2001:DB8::/64"
}
forensic_copy = {
enabled = true
}
ignore_cname_category_matches = true
insecure_disable_dnssec_validation = false
ip_categories = true
ip_indicator_feeds = true
l4override = {
ip = "1.1.1.1"
port = 0
}
notification_settings = {
enabled = true
include_context = true
msg = "msg"
support_url = "support_url"
}
override_host = "example.com"
override_ips = ["1.1.1.1", "2.2.2.2"]
payload_log = {
enabled = true
}
quarantine = {
file_types = ["exe"]
}
redirect = {
target_uri = "https://example.com"
include_context = true
preserve_path_and_query = true
}
resolve_dns_internally = {
fallback = "none"
view_id = "view_id"
}
resolve_dns_through_cloudflare = true
untrusted_cert = {
action = "error"
}
}
schedule = {
fri = "08:00-12:30,13:30-17:00"
mon = "08:00-12:30,13:30-17:00"
sat = "08:00-12:30,13:30-17:00"
sun = "08:00-12:30,13:30-17:00"
thu = "08:00-12:30,13:30-17:00"
time_zone = "America/New York"
tue = "08:00-12:30,13:30-17:00"
wed = "08:00-12:30,13:30-17:00"
}
traffic = "http.request.uri matches \".*a/partial/uri.*\" and http.request.host in $01302951-49f9-47c9-a400-0297e60b6a10"
}
data cloudflare_zero_trust_gateway_policy
computed
Specify the action to perform when the associated traffic, identity, and device posture expressions either absent or evaluate to true.
Specify the wirefilter expression used for device posture check. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response.
Specify the wirefilter expression used for identity matching. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response.
Set the order of your rules. Lower values indicate higher precedence. At each processing phase, evaluate applicable rules in ascending order of this value. Refer to Order of enforcement to manage precedence via Terraform.
Specify the wirefilter expression used for traffic matching. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response.
cloudflare_zero_trust_gateway_policy
data "cloudflare_zero_trust_gateway_policy" "example_zero_trust_gateway_policy" {
account_id = "699d98642c564d2e855e9661899b7252"
rule_id = "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
}
data cloudflare_zero_trust_gateway_policies
cloudflare_zero_trust_gateway_policies
data "cloudflare_zero_trust_gateway_policies" "example_zero_trust_gateway_policies" {
account_id = "699d98642c564d2e855e9661899b7252"
}
Zero TrustGatewayCertificates
resource cloudflare_zero_trust_gateway_certificate
optional
Sets the certificate validity period in days (range: 1-10,950 days / ~30 years). Defaults to 1,825 days (5 years). Important: This field is only settable during the certificate creation. Certificates becomes immutable after creation - use the /activate and /deactivate endpoints to manage certificate lifecycle.
computed
Indicate the read-only deployment status of the certificate on Cloudflare's edge. Gateway TLS interception can use certificates in the 'available' (previously called 'active') state.
cloudflare_zero_trust_gateway_certificate
resource "cloudflare_zero_trust_gateway_certificate" "example_zero_trust_gateway_certificate" {
account_id = "699d98642c564d2e855e9661899b7252"
validity_period_days = 1826
}
data cloudflare_zero_trust_gateway_certificate
computed
Indicate the read-only deployment status of the certificate on Cloudflare's edge. Gateway TLS interception can use certificates in the 'available' (previously called 'active') state.
cloudflare_zero_trust_gateway_certificate
data "cloudflare_zero_trust_gateway_certificate" "example_zero_trust_gateway_certificate" {
account_id = "699d98642c564d2e855e9661899b7252"
certificate_id = "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
}
data cloudflare_zero_trust_gateway_certificates
cloudflare_zero_trust_gateway_certificates
data "cloudflare_zero_trust_gateway_certificates" "example_zero_trust_gateway_certificates" {
account_id = "699d98642c564d2e855e9661899b7252"
}
Zero TrustGatewayPacfiles
resource cloudflare_zero_trust_gateway_pacfile
required
optional
cloudflare_zero_trust_gateway_pacfile
resource "cloudflare_zero_trust_gateway_pacfile" "example_zero_trust_gateway_pacfile" {
account_id = "699d98642c564d2e855e9661899b7252"
contents = "function FindProxyForURL(url, host) { return \"DIRECT\"; }"
name = "Devops team"
description = "PAC file for Devops team"
slug = "pac_devops"
}
data cloudflare_zero_trust_gateway_pacfile
cloudflare_zero_trust_gateway_pacfile
data "cloudflare_zero_trust_gateway_pacfile" "example_zero_trust_gateway_pacfile" {
account_id = "699d98642c564d2e855e9661899b7252"
pacfile_id = "ed35569b41ce4d1facfe683550f54086"
}
data cloudflare_zero_trust_gateway_pacfiles
cloudflare_zero_trust_gateway_pacfiles
data "cloudflare_zero_trust_gateway_pacfiles" "example_zero_trust_gateway_pacfiles" {
account_id = "699d98642c564d2e855e9661899b7252"
}
Zero TrustNetworksRoutes
resource cloudflare_zero_trust_tunnel_cloudflared_route
required
optional
cloudflare_zero_trust_tunnel_cloudflared_route
resource "cloudflare_zero_trust_tunnel_cloudflared_route" "example_zero_trust_tunnel_cloudflared_route" {
account_id = "699d98642c564d2e855e9661899b7252"
network = "172.16.0.0/16"
tunnel_id = "f70ff985-a4ef-4643-bbbc-4a0ed4fc8415"
comment = "Example comment for this route."
virtual_network_id = "f70ff985-a4ef-4643-bbbc-4a0ed4fc8415"
}
data cloudflare_zero_trust_tunnel_cloudflared_route
cloudflare_zero_trust_tunnel_cloudflared_route
data "cloudflare_zero_trust_tunnel_cloudflared_route" "example_zero_trust_tunnel_cloudflared_route" {
account_id = "699d98642c564d2e855e9661899b7252"
route_id = "f70ff985-a4ef-4643-bbbc-4a0ed4fc8415"
}
data cloudflare_zero_trust_tunnel_cloudflared_routes
cloudflare_zero_trust_tunnel_cloudflared_routes
data "cloudflare_zero_trust_tunnel_cloudflared_routes" "example_zero_trust_tunnel_cloudflared_routes" {
account_id = "699d98642c564d2e855e9661899b7252"
existed_at = "2019-10-12T07%3A20%3A50.52Z"
is_deleted = true
network_subset = "172.16.0.0/16"
network_superset = "172.16.0.0/16"
route_id = "f70ff985-a4ef-4643-bbbc-4a0ed4fc8415"
tun_types = ["cfd_tunnel"]
tunnel_id = "f70ff985-a4ef-4643-bbbc-4a0ed4fc8415"
virtual_network_id = "f70ff985-a4ef-4643-bbbc-4a0ed4fc8415"
}
Zero TrustNetworksVirtual Networks
resource cloudflare_zero_trust_tunnel_cloudflared_virtual_network
required
optional
cloudflare_zero_trust_tunnel_cloudflared_virtual_network
resource "cloudflare_zero_trust_tunnel_cloudflared_virtual_network" "example_zero_trust_tunnel_cloudflared_virtual_network" {
account_id = "699d98642c564d2e855e9661899b7252"
name = "us-east-1-vpc"
comment = "Staging VPC for data science"
is_default = true
is_default_network = false
}
data cloudflare_zero_trust_tunnel_cloudflared_virtual_network
cloudflare_zero_trust_tunnel_cloudflared_virtual_network
data "cloudflare_zero_trust_tunnel_cloudflared_virtual_network" "example_zero_trust_tunnel_cloudflared_virtual_network" {
account_id = "699d98642c564d2e855e9661899b7252"
virtual_network_id = "f70ff985-a4ef-4643-bbbc-4a0ed4fc8415"
}
data cloudflare_zero_trust_tunnel_cloudflared_virtual_networks
optional
If true, only include the default virtual network. If false, exclude the default virtual network. If empty, all virtual networks will be included.
If true, only include the default virtual network. If false, exclude the default virtual network. If empty, all virtual networks will be included.
cloudflare_zero_trust_tunnel_cloudflared_virtual_networks
data "cloudflare_zero_trust_tunnel_cloudflared_virtual_networks" "example_zero_trust_tunnel_cloudflared_virtual_networks" {
account_id = "699d98642c564d2e855e9661899b7252"
id = "f70ff985-a4ef-4643-bbbc-4a0ed4fc8415"
is_default = true
is_default_network = true
is_deleted = true
name = "us-east-1-vpc"
}
Zero TrustNetworksSubnetsWARP
resource cloudflare_zero_trust_device_subnet
required
optional
cloudflare_zero_trust_device_subnet
resource "cloudflare_zero_trust_device_subnet" "example_zero_trust_device_subnet" {
account_id = "699d98642c564d2e855e9661899b7252"
name = "IPv4 Cloudflare Source IPs"
network = "100.64.0.0/12"
comment = "example comment"
is_default_network = true
}
data cloudflare_zero_trust_device_subnet
cloudflare_zero_trust_device_subnet
data "cloudflare_zero_trust_device_subnet" "example_zero_trust_device_subnet" {
account_id = "699d98642c564d2e855e9661899b7252"
subnet_id = "f70ff985-a4ef-4643-bbbc-4a0ed4fc8415"
}
Zero TrustNetworksHostname Routes
resource cloudflare_zero_trust_network_hostname_route
optional
cloudflare_zero_trust_network_hostname_route
resource "cloudflare_zero_trust_network_hostname_route" "example_zero_trust_network_hostname_route" {
account_id = "699d98642c564d2e855e9661899b7252"
comment = "example comment"
hostname = "office-1.local"
tunnel_id = "f70ff985-a4ef-4643-bbbc-4a0ed4fc8415"
}
data cloudflare_zero_trust_network_hostname_route
cloudflare_zero_trust_network_hostname_route
data "cloudflare_zero_trust_network_hostname_route" "example_zero_trust_network_hostname_route" {
account_id = "699d98642c564d2e855e9661899b7252"
hostname_route_id = "f70ff985-a4ef-4643-bbbc-4a0ed4fc8415"
}
data cloudflare_zero_trust_network_hostname_routes
optional
If provided, include only resources that were created (and not deleted) before this time. URL encoded.
If set, only list hostname routes that contain a substring of the given value, the filter is case-insensitive.
cloudflare_zero_trust_network_hostname_routes
data "cloudflare_zero_trust_network_hostname_routes" "example_zero_trust_network_hostname_routes" {
account_id = "699d98642c564d2e855e9661899b7252"
id = "f70ff985-a4ef-4643-bbbc-4a0ed4fc8415"
comment = "example%20comment"
existed_at = "2019-10-12T07%3A20%3A50.52Z"
hostname = "office-1.local"
tunnel_id = "f70ff985-a4ef-4643-bbbc-4a0ed4fc8415"
}
Zero TrustRisk ScoringBehaviours
Zero TrustRisk ScoringIntegrations
resource cloudflare_zero_trust_risk_scoring_integration
required
The base url of the tenant, e.g. "https://tenant.okta.com".
optional
Whether this integration is enabled. If disabled, no risk changes will be exported to the third-party.
A reference id that can be supplied by the client. Currently this should be set to the Access-Okta IDP ID (a UUIDv4). https://developers.cloudflare.com/api/operations/access-identity-providers-get-an-access-identity-provider
computed
The URL for the Shared Signals Framework configuration, e.g. "/.well-known/sse-configuration/{integration_uuid}/". https://openid.net/specs/openid-sse-framework-1_0.html#rfc.section.6.2.1.
cloudflare_zero_trust_risk_scoring_integration
resource "cloudflare_zero_trust_risk_scoring_integration" "example_zero_trust_risk_scoring_integration" {
account_id = "account_id"
integration_type = "Okta"
tenant_url = "https://example.com"
reference_id = "reference_id"
}
data cloudflare_zero_trust_risk_scoring_integration
computed
A reference ID defined by the client. Should be set to the Access-Okta IDP integration ID. Useful when the risk-score integration needs to be associated with a secondary asset and recalled using that ID.
The base URL for the tenant. E.g. "https://tenant.okta.com".
The URL for the Shared Signals Framework configuration, e.g. "/.well-known/sse-configuration/{integration_uuid}/". https://openid.net/specs/openid-sse-framework-1_0.html#rfc.section.6.2.1.
cloudflare_zero_trust_risk_scoring_integration
data "cloudflare_zero_trust_risk_scoring_integration" "example_zero_trust_risk_scoring_integration" {
account_id = "account_id"
integration_id = "182bd5e5-6e1a-4fe4-a799-aa6d9a6ab26e"
}
data cloudflare_zero_trust_risk_scoring_integrations
cloudflare_zero_trust_risk_scoring_integrations
data "cloudflare_zero_trust_risk_scoring_integrations" "example_zero_trust_risk_scoring_integrations" {
account_id = "account_id"
}