Access
If 'application_id' is omitted, the policy created can be reused by multiple access applications. Any
cloudflare.ZeroTrustAccessApplicationresource can reference reusable policies through itspoliciesargument. To destroy a reusable policy and remove it from all applications' policies lists on the same apply, preemptively set the lifecycle optioncreate_before_destroyto true on the 'cloudflare_zero_trust_access_policy' resource.
Example Usage
resources:
exampleZeroTrustAccessPolicy:
type: cloudflare:ZeroTrustAccessPolicy
name: example_zero_trust_access_policy
properties:
accountId: 023e105f4ecef8ad9ca31a8372d0c353
decision: allow
includes:
- group:
id: aa0a4aab-672b-4bdb-bc33-a59f1130a11f
name: Allow devs
approvalGroups:
- approvals_needed: 1
email_addresses:
- test1@cloudflare.com
- test2@cloudflare.com
email_list_uuid: email_list_uuid
- approvals_needed: 3
email_addresses:
- test@cloudflare.com
- test2@cloudflare.com
email_list_uuid: 597147a1-976b-4ef2-9af0-81d5d007fc34
approvalRequired: true
excludes:
- group:
id: aa0a4aab-672b-4bdb-bc33-a59f1130a11f
isolationRequired: false
purposeJustificationPrompt: Please enter a justification for entering this protected domain.
purposeJustificationRequired: true
requires:
- group:
id: aa0a4aab-672b-4bdb-bc33-a59f1130a11f
sessionDuration: 24hImport
$ pulumi import cloudflare:index/accessPolicy:AccessPolicy example '<account_id>/<policy_id>'Constructors
Properties
Administrators who can approve a temporary authentication request.
Requires the user to request access from an administrator at the start of each session.
Rules evaluated with a NOT logical operator. To match the policy, a user cannot meet any of the Exclude rules.
Rules evaluated with an OR logical operator. A user needs to meet only one of the Include rules.
Require this application to be served in an isolated browser for users matching this policy. 'Client Web Isolation' must be on for the account in order to use this feature.
A custom message that will appear on the purpose justification screen.
Require users to enter a justification when they log in to the application.
Rules evaluated with an AND logical operator. To match the policy, a user must meet all of the Require rules.
The amount of time that tokens issued for the application will be valid. Must be in the format 300ms or 2h45m. Valid time units are: ns, us (or µs), ms, s, m, h.