-
Notifications
You must be signed in to change notification settings - Fork 5.5k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
5 changed files
with
159 additions
and
99 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -15,57 +15,115 @@ import { Tabs, TabItem, Render } from "~/components" | |
| 5. In **Target criteria**, select the target hostname(s) that will represent the application. The application definition will apply to all targets that share the selected hostname, including any targets added in the future. | ||
| 6. Enter the **Protocol** and **Port** that will be used to connect to the server. | ||
| 7. (Optional) If a protocol runs on more than one port, select **Add new target criteria** and reconfigure the same target hostname and protocol with a different port number. | ||
| :::note | ||
| Access for Infrastructure only supports assigning one protocol per port. You can reuse a port/protocol pairing across infrastructure applications, but the port cannot be reassigned to another protocol. | ||
| ::: | ||
| 8. Select **Next**. | ||
| 9. To secure your targets, configure a policy that defines who can connect and how they can connect: | ||
| 1. Enter any name for your policy. | ||
| 2. Create a rule that matches the users who are allowed to reach the targets. For more information, refer to [Access policies](/cloudflare-one/policies/access/) and review the list of [infrastructure policy selectors](/cloudflare-one/applications/non-http/infrastructure-apps/#infrastructure-policy-selectors). | ||
| 3. In **Connection context**, enter the UNIX usernames that users can log in as (for example, `root` or `ec2-user`). | ||
| 4. Select **Add application**. | ||
| </TabItem> | ||
| <TabItem label="API"> | ||
|
|
||
| To add an infrastructure application using the [API](/api/operations/access-applications-add-an-application): | ||
|
|
||
| ```sh | ||
| curl https://api.cloudflare.com/client/v4/accounts/{account_id}/access/apps \ | ||
| --header "Authorization: Bearer <API_TOKEN>" \ | ||
| --header "Content-Type: application/json" \ | ||
| --data '{ | ||
| "name": "example app", | ||
| "type": "infrastructure", | ||
| "target_criteria": [ | ||
| { | ||
| "target_attributes": { | ||
| "hostname": [ | ||
| "infra-access-target" | ||
| ] | ||
| }, | ||
| "port": 22, | ||
| "protocol": "SSH" | ||
| } | ||
| ], | ||
| "policies": [ | ||
| { | ||
| "name": "Allow a specific email", | ||
| "decision": "allow", | ||
| "include": [ | ||
| { | ||
| "email": { | ||
| "email": "[email protected]" | ||
| } | ||
| } | ||
| ], | ||
| "connection_rules": { | ||
| "ssh": { | ||
| "usernames": [ | ||
| "root", | ||
| "ec2-user" | ||
| 1. [Create an API token](/fundamentals/api/get-started/create-token/) with the following permissions: | ||
| | Type | Item | Permission | | ||
| | ------- | ---------------- | ---------- | | ||
| | Account | Access: Apps & Policies | Edit | | ||
|
|
||
| 2. Make a `POST` request to the [Access applications](/api/operations/access-applications-add-an-application) endpoint: | ||
|
|
||
| ```sh | ||
| curl https://api.cloudflare.com/client/v4/accounts/{account_id}/access/apps \ | ||
| --header "Authorization: Bearer <API_TOKEN>" \ | ||
| --header "Content-Type: application/json" \ | ||
| --data '{ | ||
| "name": "Example infrastructure app", | ||
| "type": "infrastructure", | ||
| "target_criteria": [ | ||
| { | ||
| "target_attributes": { | ||
| "hostname": [ | ||
| "infra-access-target" | ||
| ] | ||
| }, | ||
| "port": 22, | ||
| "protocol": "SSH" | ||
| } | ||
| ], | ||
| "policies": [ | ||
| { | ||
| "name": "Allow a specific email", | ||
| "decision": "allow", | ||
| "include": [ | ||
| { | ||
| "email": { | ||
| "email": "[email protected]" | ||
| } | ||
| } | ||
| ], | ||
| "connection_rules": { | ||
| "ssh": { | ||
| "usernames": [ | ||
| "root", | ||
| "ec2-user" | ||
| ] | ||
| } | ||
| } | ||
| } | ||
| ] | ||
| }' | ||
| ``` | ||
|
|
||
| </TabItem> | ||
| <TabItem label="Terraform"> | ||
|
|
||
| 1. Use the [`cloudflare_zero_trust_access_application`](https://registry.terraform.io/providers/cloudflare/cloudflare/4.44.0/docs/resources/zero_trust_access_application) resource to create an infrastructure application: | ||
|
|
||
| ```tf | ||
| resource "cloudflare_zero_trust_access_application" "infra-app" { | ||
| account_id = "f037e56e89293a057740de681ac9abbe" | ||
| name = "Example infrastructure app" | ||
| type = "infrastructure" | ||
| target_criteria { | ||
| port = 22 | ||
| protocol = "SSH" | ||
| target_attributes { | ||
| name = "hostname" | ||
| values = ["infra-access-target"] | ||
| } | ||
| } | ||
| } | ||
| ``` | ||
|
|
||
| 2. Use the [`cloudflare_zero_trust_access_policy`](https://registry.terraform.io/providers/cloudflare/cloudflare/4.44.0/docs/resources/zero_trust_access_policy) resource to add an infrastructure policy to the application: | ||
|
|
||
| ```tf | ||
| resource "cloudflare_zero_trust_access_policy" "infra-app-policy" { | ||
| application_id = cloudflare_zero_trust_access_application.infra-app.id | ||
| account_id = "f037e56e89293a057740de681ac9abbe" | ||
| name = "Allow a specific email" | ||
| decision = "allow" | ||
| precedence = 1 | ||
| include { | ||
| email = ["[email protected]"] | ||
| } | ||
| ] | ||
| }' | ||
| ``` | ||
| connection_rules { | ||
| ssh { | ||
| usernames = ["root", "ec2-user"] | ||
| } | ||
| } | ||
| } | ||
| ``` | ||
| </TabItem> | ||
| </Tabs> | ||
|
|
||
| The targets in this application are now secured by your infrastructure policies. | ||
|
|
||
| :::note | ||
| Access for Infrastructure only supports assigning one protocol per port. You can reuse a port/protocol pairing across infrastructure applications, but the port cannot be reassigned to another protocol. | ||
| Gateway [network policies](/cloudflare-one/policies/gateway/network-policies/) take precedence over infrastructure policies. For example, if you block port `22` for all users in Gateway, then no one can SSH over port `22` to your targets. | ||
| ::: | ||
19 changes: 0 additions & 19 deletions
19
src/content/partials/cloudflare-one/access/add-infrastructure-policy.mdx
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters