Organizations
resource cloudflare_zero_trust_organization
optional
Determines whether to deny all requests to Cloudflare-protected resources that lack an associated Access application. If enabled, you must explicitly configure an Access application and policy to allow traffic to your Cloudflare-protected resources. For domains you want to be public across all subdomains, add the domain to the deny_unmatched_requests_exempted_zone_names array.
The amount of time that tokens issued for applications will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count. Minimum value for this setting is 1 month (730h). Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
The amount of time that tokens issued for applications will be valid. Must be in the format 30m or 2h45m. Valid time units are: m, h.
Contains zone names to exempt from the deny_unmatched_requests feature. Requests to a subdomain in an exempted zone will block unauthenticated traffic by default if there is a configured Access application and policy that matches the request.
When set to true, users can authenticate via WARP for any application in your organization. Application settings will take precedence over this value.
When set to true, users skip the identity provider selection step during login.
Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled.
cloudflare_zero_trust_organization
resource "cloudflare_zero_trust_organization" "example_zero_trust_organization" {
zone_id = "zone_id"
allow_authenticate_via_warp = true
auth_domain = "test.cloudflareaccess.com"
auto_redirect_to_identity = true
custom_pages = {
forbidden = "699d98642c564d2e855e9661899b7252"
identity_denied = "699d98642c564d2e855e9661899b7252"
}
deny_unmatched_requests = true
deny_unmatched_requests_exempted_zone_names = ["example.com"]
is_ui_read_only = true
login_design = {
background_color = "#c5ed1b"
footer_text = "This is an example description."
header_text = "This is an example description."
logo_path = "https://example.com/logo.png"
text_color = "#c5ed1b"
}
mfa_config = {
allowed_authenticators = ["totp", "biometrics", "security_key"]
session_duration = "24h"
}
mfa_required_for_all_apps = false
name = "Widget Corps Internal Applications"
session_duration = "24h"
ui_read_only_toggle_reason = "Temporarily turn off the UI read only lock to make a change via the UI"
user_seat_expiration_inactive_time = "730h"
warp_auth_session_duration = "24h"
}
data cloudflare_zero_trust_organization
optional
computed
When set to true, users can authenticate via WARP for any application in your organization. Application settings will take precedence over this value.
When set to true, users skip the identity provider selection step during login.
Determines whether to deny all requests to Cloudflare-protected resources that lack an associated Access application. If enabled, you must explicitly configure an Access application and policy to allow traffic to your Cloudflare-protected resources. For domains you want to be public across all subdomains, add the domain to the deny_unmatched_requests_exempted_zone_names array.
Lock all settings as Read-Only in the Dashboard, regardless of user permission. Updates may only be made via the API or Terraform for this account when enabled.
Determines whether global MFA settings apply to applications by default. The organization must have MFA enabled with at least one authentication method and a session duration configured.
The amount of time that tokens issued for applications will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
A description of the reason why the UI read only field is being toggled.
The amount of time a user seat is inactive before it expires. When the user seat exceeds the set time of inactivity, the user is removed as an active seat and no longer counts against your Teams seat count. Minimum value for this setting is 1 month (730h). Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.
The amount of time that tokens issued for applications will be valid. Must be in the format 30m or 2h45m. Valid time units are: m, h.
cloudflare_zero_trust_organization
data "cloudflare_zero_trust_organization" "example_zero_trust_organization" {
account_id = "account_id"
zone_id = "zone_id"
}