cloudflare-zero-trust-ec2/cloudflared.tf at main · saintmalik/cloudflare-zero-trust-ec2 · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
# ==============================================================================
# Application
# ==============================================================================
resource "cloudflare_zero_trust_access_application" "app" {
  account_id = var.cloudflare_account_id
  name       = "internalwebapp"
  domain     = local.environment.domain

  allowed_idps = [cloudflare_zero_trust_access_identity_provider.google_workspace.id]

  type                  = "self_hosted"
  session_duration      = "24h"
  app_launcher_visible  = true
  app_launcher_logo_url = var.cloudflare_app_logo
}

# ==============================================================================
# Access Policy
# ==============================================================================
resource "cloudflare_zero_trust_access_policy" "policy" {
  account_id     = var.cloudflare_account_id
  application_id = cloudflare_zero_trust_access_application.app.id

  name                           = "internalwebapp-filter"
  precedence                     = "1"
  decision                       = "allow"
  purpose_justification_required = true

  include {
    login_method = [cloudflare_zero_trust_access_identity_provider.google_workspace.id]
  }

  require {
    gsuite {
      identity_provider_id = cloudflare_zero_trust_access_identity_provider.google_workspace.id
    }
    group = local.environment.cloudflare_config.allowed_groups
  }
}

# ==============================================================================
# SECRETS
# ==============================================================================
resource "aws_ssm_parameter" "tunnel" {
  name        = "/internalwebapp/CREDENTIALS"
  description = "Cloudflared Tunnel: credentials JSON"
  type        = "SecureString"

  value = jsonencode({
    AccountTag   = var.cloudflare_account_id
    TunnelSecret = cloudflare_zero_trust_tunnel_cloudflared.tunnel.secret
    TunnelID     = cloudflare_zero_trust_tunnel_cloudflared.tunnel.id
  })

  tags = local.common_tags
}

# ==============================================================================
# TUNNEL
# ==============================================================================
resource "random_password" "tunnel_secret" {
  length  = 32
  special = false
}

resource "cloudflare_zero_trust_tunnel_cloudflared" "tunnel" {
  account_id = var.cloudflare_account_id
  name       = "tunnel"
  secret     = random_password.tunnel_secret.result
}

resource "cloudflare_zero_trust_tunnel_cloudflared_config" "config" {
  account_id = var.cloudflare_account_id
  tunnel_id  = cloudflare_zero_trust_tunnel_cloudflared.tunnel.id

  config {
    warp_routing {
      enabled = true
    }
    ingress_rule {
      service = local.environment.origin_url
    }
  }
}

# ==============================================================================
# DNS Record
# ==============================================================================
resource "cloudflare_record" "dns" {
  zone_id = var.cloudflare_zone_id
  name    = local.environment.domain
  value   = cloudflare_zero_trust_tunnel_cloudflared.tunnel.cname
  type    = "CNAME"
  proxied = true
  ttl     = 1
  comment = "tunnel"
}

# ==============================================================================
# IdP
# ==============================================================================
resource "cloudflare_zero_trust_access_identity_provider" "google_workspace" {
  account_id = var.cloudflare_account_id
  name       = "Google Workspace IdP"
  type       = "google"

  config {
    client_id     = data.aws_ssm_parameter.google_oauth_client_id.value
    client_secret = data.aws_ssm_parameter.google_oauth_client_secret.value
    apps_domain   = var.google_workspace_domain
  }
}