Gateway
GatewayCategories
data cloudflare_zero_trust_gateway_categories_list
cloudflare_zero_trust_gateway_categories_list
data "cloudflare_zero_trust_gateway_categories_list" "example_zero_trust_gateway_categories_list" {
account_id = "023e105f4ecef8ad9ca31a8372d0c353"
}
GatewayApp Types
data cloudflare_zero_trust_gateway_app_types_list
cloudflare_zero_trust_gateway_app_types_list
data "cloudflare_zero_trust_gateway_app_types_list" "example_zero_trust_gateway_app_types_list" {
account_id = "023e105f4ecef8ad9ca31a8372d0c353"
}
GatewayConfigurations
resource cloudflare_zero_trust_gateway_settings
cloudflare_zero_trust_gateway_settings
resource "cloudflare_zero_trust_gateway_settings" "example_zero_trust_gateway_settings" {
account_id = "699d98642c564d2e855e9661899b7252"
settings = {
activity_log = {
enabled = true
}
antivirus = {
enabled_download_phase = false
enabled_upload_phase = false
fail_closed = false
notification_settings = {
enabled = true
include_context = true
msg = "msg"
support_url = "support_url"
}
}
block_page = {
background_color = "background_color"
enabled = true
footer_text = "--footer--"
header_text = "--header--"
include_context = true
logo_path = "https://logos.com/a.png"
mailto_address = "admin@example.com"
mailto_subject = "Blocked User Inquiry"
mode = ""
name = "Cloudflare"
suppress_footer = false
target_uri = "https://example.com"
}
body_scanning = {
inspection_mode = "deep"
}
browser_isolation = {
non_identity_enabled = true
url_browser_isolation_enabled = true
}
certificate = {
id = "d1b364c5-1311-466e-a194-f0e943e0799f"
}
custom_certificate = {
enabled = true
id = "d1b364c5-1311-466e-a194-f0e943e0799f"
}
extended_email_matching = {
enabled = true
}
fips = {
tls = true
}
host_selector = {
enabled = false
}
inspection = {
mode = "static"
}
protocol_detection = {
enabled = true
}
sandbox = {
enabled = true
fallback_action = "allow"
}
tls_decrypt = {
enabled = true
}
}
}
GatewayLists
resource cloudflare_zero_trust_list
cloudflare_zero_trust_list
resource "cloudflare_zero_trust_list" "example_zero_trust_list" {
account_id = "699d98642c564d2e855e9661899b7252"
name = "Admin Serial Numbers"
type = "SERIAL"
description = "The serial numbers for administrators"
items = [{
description = "Austin office IP"
value = "8GE8721REF"
}]
}
data cloudflare_zero_trust_list
cloudflare_zero_trust_list
data "cloudflare_zero_trust_list" "example_zero_trust_list" {
account_id = "699d98642c564d2e855e9661899b7252"
list_id = "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
}
data cloudflare_zero_trust_lists
cloudflare_zero_trust_lists
data "cloudflare_zero_trust_lists" "example_zero_trust_lists" {
account_id = "699d98642c564d2e855e9661899b7252"
type = "SERIAL"
}
GatewayLocations
resource cloudflare_zero_trust_dns_location
optional
Specify the identifier of the pair of IPv4 addresses assigned to this location. When creating a location, if this field is absent or set to null, the pair of shared IPv4 addresses (0e4a32c6-6fb8-4858-9296-98f51631e8e6) is auto-assigned. When updating a location, if this field is absent or set to null, the pre-assigned pair remains unchanged.
computed
Specify the UUID of the IPv6 block brought to the gateway so that this location's IPv6 address is allocated from the Bring Your Own IPv6 (BYOIPv6) block rather than the standard Cloudflare IPv6 block.
Specify the DNS over HTTPS domain that receives DNS requests. Gateway automatically generates this value.
Defines the automatically generated IPv6 destination IP assigned to this location. Gateway counts all DNS requests sent to this IP as requests under this location.
Show the primary destination IPv4 address from the pair identified dns_destination_ips_id. This field read-only.
cloudflare_zero_trust_dns_location
resource "cloudflare_zero_trust_dns_location" "example_zero_trust_dns_location" {
account_id = "699d98642c564d2e855e9661899b7252"
name = "Austin Office Location"
client_default = false
dns_destination_ips_id = "0e4a32c6-6fb8-4858-9296-98f51631e8e6"
ecs_support = false
endpoints = {
doh = {
enabled = true
networks = [{
network = "2001:85a3::/64"
}]
require_token = true
}
dot = {
enabled = true
networks = [{
network = "2001:85a3::/64"
}]
}
ipv4 = {
enabled = true
}
ipv6 = {
enabled = true
networks = [{
network = "2001:85a3::/64"
}]
}
}
networks = [{
network = "192.0.2.1/32"
}]
}
data cloudflare_zero_trust_dns_location
computed
Indicate the identifier of the pair of IPv4 addresses assigned to this location.
Specify the UUID of the IPv6 block brought to the gateway so that this location's IPv6 address is allocated from the Bring Your Own IPv6 (BYOIPv6) block rather than the standard Cloudflare IPv6 block.
Specify the DNS over HTTPS domain that receives DNS requests. Gateway automatically generates this value.
Defines the automatically generated IPv6 destination IP assigned to this location. Gateway counts all DNS requests sent to this IP as requests under this location.
Show the primary destination IPv4 address from the pair identified dns_destination_ips_id. This field read-only.
cloudflare_zero_trust_dns_location
data "cloudflare_zero_trust_dns_location" "example_zero_trust_dns_location" {
account_id = "699d98642c564d2e855e9661899b7252"
location_id = "ed35569b41ce4d1facfe683550f54086"
}
data cloudflare_zero_trust_dns_locations
cloudflare_zero_trust_dns_locations
data "cloudflare_zero_trust_dns_locations" "example_zero_trust_dns_locations" {
account_id = "699d98642c564d2e855e9661899b7252"
}
GatewayLogging
resource cloudflare_zero_trust_gateway_logging
optional
cloudflare_zero_trust_gateway_logging
resource "cloudflare_zero_trust_gateway_logging" "example_zero_trust_gateway_logging" {
account_id = "699d98642c564d2e855e9661899b7252"
redact_pii = true
settings_by_rule_type = {
dns = {
log_all = false
log_blocks = true
}
http = {
log_all = false
log_blocks = true
}
l4 = {
log_all = false
log_blocks = true
}
}
}
data cloudflare_zero_trust_gateway_logging
cloudflare_zero_trust_gateway_logging
data "cloudflare_zero_trust_gateway_logging" "example_zero_trust_gateway_logging" {
account_id = "699d98642c564d2e855e9661899b7252"
}
GatewayProxy Endpoints
resource cloudflare_zero_trust_gateway_proxy_endpoint
optional
cloudflare_zero_trust_gateway_proxy_endpoint
resource "cloudflare_zero_trust_gateway_proxy_endpoint" "example_zero_trust_gateway_proxy_endpoint" {
account_id = "699d98642c564d2e855e9661899b7252"
name = "Devops team"
kind = "ip"
}
data cloudflare_zero_trust_gateway_proxy_endpoint
computed
cloudflare_zero_trust_gateway_proxy_endpoint
data "cloudflare_zero_trust_gateway_proxy_endpoint" "example_zero_trust_gateway_proxy_endpoint" {
account_id = "699d98642c564d2e855e9661899b7252"
proxy_endpoint_id = "ed35569b41ce4d1facfe683550f54086"
}
data cloudflare_zero_trust_gateway_proxy_endpoints
cloudflare_zero_trust_gateway_proxy_endpoints
data "cloudflare_zero_trust_gateway_proxy_endpoints" "example_zero_trust_gateway_proxy_endpoints" {
account_id = "699d98642c564d2e855e9661899b7252"
}
GatewayRules
resource cloudflare_zero_trust_gateway_policy
required
optional
Specify the protocol or layer to evaluate the traffic, identity, and device posture expressions. Can only contain a single value.
Specify the wirefilter expression used for device posture check. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response.
Specify the wirefilter expression used for identity matching. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response.
Set the order of your rules. Lower values indicate higher precedence. At each processing phase, evaluate applicable rules in ascending order of this value. Refer to Order of enforcement to manage precedence via Terraform.
computed
cloudflare_zero_trust_gateway_policy
resource "cloudflare_zero_trust_gateway_policy" "example_zero_trust_gateway_policy" {
account_id = "699d98642c564d2e855e9661899b7252"
action = "allow"
name = "block bad websites"
description = "Block bad websites based on their host name."
device_posture = "any(device_posture.checks.passed[*] in {\"1308749e-fcfb-4ebc-b051-fe022b632644\"})"
enabled = true
expiration = {
expires_at = "2014-01-01T05:20:20Z"
duration = 10
}
filters = ["http"]
identity = "any(identity.groups.name[*] in {\"finance\"})"
precedence = 0
rule_settings = {
add_headers = {
My-Next-Header = ["foo", "bar"]
X-Custom-Header-Name = ["somecustomvalue"]
}
allow_child_bypass = false
audit_ssh = {
command_logging = false
}
biso_admin_controls = {
copy = "remote_only"
dcp = true
dd = true
dk = true
download = "enabled"
dp = false
du = true
keyboard = "enabled"
paste = "enabled"
printing = "enabled"
upload = "enabled"
version = "v1"
}
block_page = {
target_uri = "https://example.com"
include_context = true
}
block_page_enabled = true
block_reason = "This website is a security risk"
bypass_parent_rule = false
check_session = {
duration = "300s"
enforce = true
}
dns_resolvers = {
ipv4 = [{
ip = "2.2.2.2"
port = 5053
route_through_private_network = true
vnet_id = "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
}]
ipv6 = [{
ip = "2001:DB8::"
port = 5053
route_through_private_network = true
vnet_id = "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
}]
}
egress = {
ipv4 = "192.0.2.2"
ipv4_fallback = "192.0.2.3"
ipv6 = "2001:DB8::/64"
}
forensic_copy = {
enabled = true
}
ignore_cname_category_matches = true
insecure_disable_dnssec_validation = false
ip_categories = true
ip_indicator_feeds = true
l4override = {
ip = "1.1.1.1"
port = 0
}
notification_settings = {
enabled = true
include_context = true
msg = "msg"
support_url = "support_url"
}
override_host = "example.com"
override_ips = ["1.1.1.1", "2.2.2.2"]
payload_log = {
enabled = true
}
quarantine = {
file_types = ["exe"]
}
redirect = {
target_uri = "https://example.com"
include_context = true
preserve_path_and_query = true
}
resolve_dns_internally = {
fallback = "none"
view_id = "view_id"
}
resolve_dns_through_cloudflare = true
untrusted_cert = {
action = "error"
}
}
schedule = {
fri = "08:00-12:30,13:30-17:00"
mon = "08:00-12:30,13:30-17:00"
sat = "08:00-12:30,13:30-17:00"
sun = "08:00-12:30,13:30-17:00"
thu = "08:00-12:30,13:30-17:00"
time_zone = "America/New York"
tue = "08:00-12:30,13:30-17:00"
wed = "08:00-12:30,13:30-17:00"
}
traffic = "http.request.uri matches \".*a/partial/uri.*\" and http.request.host in $01302951-49f9-47c9-a400-0297e60b6a10"
}
data cloudflare_zero_trust_gateway_policy
computed
Specify the action to perform when the associated traffic, identity, and device posture expressions either absent or evaluate to true.
Specify the wirefilter expression used for device posture check. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response.
Specify the wirefilter expression used for identity matching. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response.
Set the order of your rules. Lower values indicate higher precedence. At each processing phase, evaluate applicable rules in ascending order of this value. Refer to Order of enforcement to manage precedence via Terraform.
Specify the wirefilter expression used for traffic matching. The API automatically formats and sanitizes expressions before storing them. To prevent Terraform state drift, use the formatted expression returned in the API response.
cloudflare_zero_trust_gateway_policy
data "cloudflare_zero_trust_gateway_policy" "example_zero_trust_gateway_policy" {
account_id = "699d98642c564d2e855e9661899b7252"
rule_id = "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
}
data cloudflare_zero_trust_gateway_policies
cloudflare_zero_trust_gateway_policies
data "cloudflare_zero_trust_gateway_policies" "example_zero_trust_gateway_policies" {
account_id = "699d98642c564d2e855e9661899b7252"
}
GatewayCertificates
resource cloudflare_zero_trust_gateway_certificate
optional
Sets the certificate validity period in days (range: 1-10,950 days / ~30 years). Defaults to 1,825 days (5 years). Important: This field is only settable during the certificate creation. Certificates becomes immutable after creation - use the /activate and /deactivate endpoints to manage certificate lifecycle.
computed
Indicate the read-only deployment status of the certificate on Cloudflare's edge. Gateway TLS interception can use certificates in the 'available' (previously called 'active') state.
cloudflare_zero_trust_gateway_certificate
resource "cloudflare_zero_trust_gateway_certificate" "example_zero_trust_gateway_certificate" {
account_id = "699d98642c564d2e855e9661899b7252"
validity_period_days = 1826
}
data cloudflare_zero_trust_gateway_certificate
computed
Indicate the read-only deployment status of the certificate on Cloudflare's edge. Gateway TLS interception can use certificates in the 'available' (previously called 'active') state.
cloudflare_zero_trust_gateway_certificate
data "cloudflare_zero_trust_gateway_certificate" "example_zero_trust_gateway_certificate" {
account_id = "699d98642c564d2e855e9661899b7252"
certificate_id = "f174e90a-fafe-4643-bbbc-4a0ed4fc8415"
}
data cloudflare_zero_trust_gateway_certificates
cloudflare_zero_trust_gateway_certificates
data "cloudflare_zero_trust_gateway_certificates" "example_zero_trust_gateway_certificates" {
account_id = "699d98642c564d2e855e9661899b7252"
}
GatewayPacfiles
resource cloudflare_zero_trust_gateway_pacfile
required
optional
cloudflare_zero_trust_gateway_pacfile
resource "cloudflare_zero_trust_gateway_pacfile" "example_zero_trust_gateway_pacfile" {
account_id = "699d98642c564d2e855e9661899b7252"
contents = "function FindProxyForURL(url, host) { return \"DIRECT\"; }"
name = "Devops team"
description = "PAC file for Devops team"
slug = "pac_devops"
}
data cloudflare_zero_trust_gateway_pacfile
cloudflare_zero_trust_gateway_pacfile
data "cloudflare_zero_trust_gateway_pacfile" "example_zero_trust_gateway_pacfile" {
account_id = "699d98642c564d2e855e9661899b7252"
pacfile_id = "ed35569b41ce4d1facfe683550f54086"
}
data cloudflare_zero_trust_gateway_pacfiles
cloudflare_zero_trust_gateway_pacfiles
data "cloudflare_zero_trust_gateway_pacfiles" "example_zero_trust_gateway_pacfiles" {
account_id = "699d98642c564d2e855e9661899b7252"
}