Skip to content

非公式本サイトは非公式の日本語ドキュメントであり、Cloudflare 公式サイトではありません。最新情報はdevelopers.cloudflare.comをご確認ください。

推奨 HTTP ポリシー

最終更新 Markdown で表示Agent セットアップ

組織向けのインターネットおよび SaaS アプリのセキュリティ戦略を構築するには、次の HTTP ポリシーを追加することを推奨します。

よく使う HTTP ポリシーの追加例は 一般的な HTTP ポリシー を参照してください。HTTP ポリシーの作成方法は HTTP ポリシー を参照してください。

All-HTTP-Application-InspectBypass

埋め込み証明書を使うアプリケーションの HTTP 検査をバイパスします。初期導入時に起きやすい証明書ピンニングエラーを避けられます。

セレクター 演算子 値 アクション
Application in Do Not Inspect Do Not Inspect
Create a Zero Trust Gateway rulebash
curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \
	--request POST \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"name": "All-HTTP-Application-InspectBypass",
		"description": "Bypass HTTP inspection for applications that use embedded certificates",
		"precedence": 0,
		"enabled": true,
		"action": "block",
		"filters": [
				"http"
		],
		"traffic": "any(app.type.ids[*] in {16})"
	}'
resource "cloudflare_zero_trust_gateway_policy" "all_http_application_inspect_bypass" {
  account_id  = var.cloudflare_account_id
  name        = "All-HTTP-Application-InspectBypass"
  description = "Bypass HTTP inspection for applications that use embedded certificates"
  precedence  = 0
  enabled     = true
  action      = "block"
  filters     = ["http"]
  traffic     = "any(app.type.ids[*] in {16})"
}

Android-HTTP-Application-InspectionBypass

証明書ピンニングを使う Android アプリケーション（Google Drive など）の HTTPS 検査をバイパスします。証明書ピンニングは Gateway の検査と互換性がありません。

セレクター 演算子 値 論理 アクション
Application in Google Drive And Do Not Inspect
Passed Device Posture Checks in OS Version Android (OS version)
Create a Zero Trust Gateway rulebash
curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \
	--request POST \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"name": "Android-HTTP-Application-InspectionBypass",
		"description": "Bypass HTTPS inspection for Android applications with certificate pinning",
		"precedence": 10,
		"enabled": true,
		"action": "off",
		"filters": [
				"http"
		],
		"traffic": "any(app.ids[] in {554})",
		"device_posture": "any(device_posture.checks.passed[] in {\"<ANDROID_VERSION_POSTURE_CHECK_UUID >\"})"
	}'
resource "cloudflare_zero_trust_gateway_policy" "android_http_application_inspection_bypass" {
  account_id  = var.cloudflare_account_id
  name        = "Android-HTTP-Application-InspectionBypass"
  description = "Bypass HTTPS inspection for Android applications with certificate pinning"
  precedence  = 10
  enabled     = true
  action      = "off"
  filters     = ["http"]
  traffic     = "any(app.ids[*] in {554})"
  device_posture = "any(device_posture.checks.passed[*] in {\"${"$"}{cloudflare_zero_trust_list.android_version_posture_check.id}\"})"
}

All-HTTP-Domain-Inspection-Bypass

TLS 検査と互換性がないと判明したドメインのカスタムリストについて、HTTP 検査をバイパスします。

セレクター 演算子 値 論理 アクション
Domain in list DomainInspectionBypass Or Do Not Inspect
Domain in list Known Domains
Create a Zero Trust Gateway rulebash
curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \
	--request POST \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"name": "All-HTTP-Domain-Inspection-Bypass",
		"description": "Bypass HTTP inspection for a custom list of domains identified as incompatible with TLS inspection",
		"precedence": 20,
		"enabled": true,
		"action": "off",
		"filters": [
				"http"
		],
		"traffic": "any(http.request.domains[*] in $<DOMAIN_INSPECTION_BYPASS_LIST_UUID>) or any(http.request.domains[*] in $<KNOWN_DOMAINS_LIST_UUID>)"
	}'
resource "cloudflare_zero_trust_gateway_policy" "android_http_application_inspection_bypass" {
  account_id  = var.cloudflare_account_id
  name        = "All-HTTP-Domain-Inspection-Bypass"
  description = "Bypass HTTP inspection for a custom list of domains identified as incompatible with TLS inspection"
  precedence  = 20
  enabled     = true
  action      = "off"
  filters     = ["http"]
  traffic     = "any(http.request.domains[*] in ${"$"}{cloudflare_zero_trust_list.domain_inspection_bypass_list.id}) or any(http.request.domains[*] in ${"$"}{cloudflare_zero_trust_list.known_domains_list.id})"
}

All-HTTP-SecurityRisks-Blocklist

Cloudflare の脅威インテリジェンスに基づき、Command and Control & Botnet や Malware などの セキュリティカテゴリ をブロックします。

セレクター 演算子 値 アクション
Security Categories in All security risks Block
Create a Zero Trust Gateway rulebash
curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \
	--request POST \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"name": "All-HTTP-SecurityRisks-Blocklist",
		"description": "Block security categories based on Cloudflare'\''s threat intelligence",
		"precedence": 30,
		"enabled": true,
		"action": "block",
		"filters": [
				"http"
		],
		"traffic": "any(http.request.uri.security_category[*] in {68 178 80 83 176 175 117 131 134 151 153})"
	}'
resource "cloudflare_zero_trust_gateway_policy" "all_http_security_risks_blocklist" {
  account_id  = var.cloudflare_account_id
  name        = "All-HTTP-SecurityRisks-Blocklist"
  description = "Block security categories based on Cloudflare's threat intelligence"
  precedence  = 30
  enabled     = true
  action      = "block"
  filters     = ["http"]
  traffic     = "any(http.request.uri.security_category[*] in {68 178 80 83 176 175 117 131 134 151 153})"
}

All-HTTP-ContentCategories-Blocklist

セキュリティリスクコンテンツサブカテゴリ の項目（New Domains など）は、常にセキュリティ上の脅威になるわけではありません。まず Allow ポリシーを作成し、ポリシーの一致を追跡して誤検知を特定することを推奨します。誤検知は、All-HTTP-Domain-Allowlist で使う Trusted Domains リストに追加できます。

テストが完了したら、組織へのリスクを抑えるため、アクションを Block に変更することを推奨します。

セレクター 演算子 値 アクション
Content Categories in Questionable Content, Security Risks, Miscellaneous, Adult Themes, Gambling Block
Create a Zero Trust Gateway rulebash
curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \
	--request POST \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"name": "All-HTTP-ContentCategories-Blocklist",
		"description": "Block access to questionable content and potential security risks",
		"precedence": 40,
		"enabled": true,
		"action": "block",
		"filters": [
				"http"
		],
		"traffic": "any(http.request.uri.content_category[*] in {17 85 87 102 157 135 138 180 162 32 169 177 128 15 115 119 124 141 161 2 67 125 133 99})",
		"identity": "",
		"device_posture": ""
	}'
resource "cloudflare_zero_trust_gateway_policy" "block_unauthorized_apps" {
  account_id     = var.cloudflare_account_id
  name           = "All-HTTP-ContentCategories-Blocklist"
  description    = "Block access to questionable content and potential security risks"
	precedence     = 40
  enabled        = true
  action         = "block"
  filters        = ["http"]
  traffic        = "any(http.request.uri.content_category[*] in {17 85 87 102 157 135 138 180 162 32 169 177 128 15 115 119 124 141 161 2 67 125 133 99})"
  identity       = ""
  device_posture = ""
}

All-HTTP-DomainHost-Blocklist

悪意がある、または組織に脅威となる特定のドメインやホストをブロックします。All-HTTP-ResolvedIP-Blocklist と同様に、このブロックリストは手動または API による自動化で更新できます。

セレクター 演算子 値 論理 アクション
Domain in list Domain Blocklist Or Block
Host in list Host Blocklist Or
Host matches regex .*example\.com
Create a Zero Trust Gateway rulebash
curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \
	--request POST \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"name": "All-HTTP-DomainHost-Blocklist",
		"description": "Block specific domains or hosts that are malicious or pose a threat to your organization",
		"precedence": 50,
		"enabled": true,
		"action": "block",
		"filters": [
				"http"
		],
		"traffic": "any(http.request.domains[*] in $<DOMAIN_BLOCKLIST_UUID>) or http.request.host in $<HOST_BLOCKLIST_UUID> or http.request.host matches \".*example.com\""
	}'
resource "cloudflare_zero_trust_gateway_policy" "all_http_domainhost_blocklist" {
  account_id  = var.cloudflare_account_id
  name        = "All-HTTP-DomainHost-Blocklist"
  description = "Block specific domains or hosts that are malicious or pose a threat to your organization"
  precedence  = 50
  enabled     = true
  action      = "block"
  filters     = ["http"]
  traffic     = "any(http.request.domains[*] in ${"$"}{cloudflare_zero_trust_list.domain_blocklist.id}) or http.request.host in ${"$"}{cloudflare_zero_trust_list.host_blocklist.id} or http.request.host matches \".*example\\.com\""
}

All-HTTP-Application-Blocklist

許可されていないアプリケーションをブロックし、ユーザーが特定のウェブツールへアクセスできないようにして、シャドーIT のリスクを抑えます。たとえば、次のポリシーは既知の AI ツールをブロックします。

セレクター 演算子 値 アクション
Application in Artificial Intelligence Block
Create a Zero Trust Gateway rulebash
curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \
	--request POST \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"name": "All-HTTP-Application-Blocklist",
		"description": "Limit access to shadow IT by blocking web-based tools and applications",
		"precedence": 60,
		"enabled": true,
		"action": "block",
		"filters": [
				"http"
		],
		"traffic": "any(app.type.ids[*] in {25})",
		"identity": "",
		"device_posture": ""
	}'
resource "cloudflare_zero_trust_gateway_policy" "all_http_application_blocklist" {
  account_id     = var.cloudflare_account_id
  name           = "All-HTTP-Application-Blocklist"
  description    = "Limit access to shadow IT by blocking web-based tools and applications"
  precedence     = 60
  enabled        = true
  action         = "block"
  filters        = ["http"]
  traffic        = "any(app.type.ids[*] in {25})"
  identity       = ""
  device_posture = ""
}

PrivilegedUsers-HTTP-Any-Isolate

重要なシステムへ日常的にアクセスする特権ユーザーや、脅威分析・マルウェアテストなどを行うユーザーのトラフィックを分離します。

セキュリティチームは、マルウェア検出を引き起こす可能性のある脅威分析やマルウェアテストを行うことがあります。また、特権ユーザーは、重要なシステムへのアクセスを狙う攻撃者の標的になることもあります。

セレクター 演算子 値 アクション
User Group Names in Privileged Users Isolate
Create a Zero Trust Gateway rulebash
curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \
	--request POST \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"name": "PrivilegedUsers-HTTP-Any-Isolate",
		"description": "Isolate traffic for privileged users who regularly access critical or testing systems",
		"precedence": 70,
		"enabled": true,
		"action": "isolate",
		"filters": [
				"http"
		],
		"identity": "any(identity.groups.name[*] in {\"Privileged Users\"})"
	}'
resource "cloudflare_zero_trust_gateway_policy" "privileged_users_http_any_isolate" {
  account_id  = var.cloudflare_account_id
  name        = "PrivilegedUsers-HTTP-Any-Isolate"
  description = "Isolate traffic for privileged users who regularly access critical or testing systems"
  precedence  = 70
  enabled     = true
  action      = "isolate"
  filters     = ["http"]
  identity    = "any(identity.groups.name[*] in {\"Privileged Users\"})"
}

Quarantined-Users-HTTP-Restricted-Access

リスクの高いユーザー向けの identity provider (IdP) ユーザーグループに含まれるユーザーのアクセスを制限します。このポリシーにより、セキュリティチームは、悪意のある、または不審なアクティビティが検出されたユーザーのトラフィックを制限できます。

セレクター 演算子 値 論理 アクション
Destination IP not in list Quarantined-Users-IPAllowlist And Block
User Group Names in Quarantined Users
Create a Zero Trust Gateway rulebash
curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \
	--request POST \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"name": "Quarantined-Users-HTTP-Restricted-Access",
		"description": "Restrict access for users included in an identity provider (IdP) user group for risky users",
		"precedence": 80,
		"enabled": true,
		"action": "block",
		"filters": [
				"http"
		],
		"traffic": "not(any(http.conn.dst_ip[] in $<QUARANTINED_USERS_IP_ALLOWLIST_UUID>))",
		"identity": "any(identity.groups.name[] in {\"Quarantined Users\"})"
	}'
resource "cloudflare_zero_trust_gateway_policy" "quarantined_users_http_restricted_access" {
  account_id  = var.cloudflare_account_id
  name        = "Quarantined-Users-HTTP-Restricted-Access"
  description = "Restrict access for users included in an identity provider (IdP) user group for risky users"
  precedence  = 80
  enabled     = true
  action      = "block"
  filters     = ["http"]
  traffic     = "not(any(http.conn.dst_ip[*] in ${"$"}{cloudflare_zero_trust_list.quarantined_users_ip_allowlist.id}))"
  identity    = "any(identity.groups.name[*] in {\"Quarantined Users\"})"
}

All-HTTP-Domain-Isolate

データ持ち出しやマルウェア感染を防ぐため、リスクの高いドメインを分離するか、既知のリスクドメインのカスタムリストを作成します。理想的には、インシデント対応チームが API 自動化 でブロックリストを更新し、リアルタイムの脅威防御を行います。

セレクター 演算子 値 論理 アクション
Content Categories in New Domains, Newly Seen Domains Or Isolate
Domain in list Domain Isolation
Create a Zero Trust Gateway rulebash
curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/gateway/rules" \
	--request POST \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"name": "All-HTTP-Domain-Isolate",
		"description": "Isolate high risk domains or create a custom list of known risky domains to avoid data exfiltration or malware infection",
		"precedence": 90,
		"enabled": true,
		"action": "isolate",
		"filters": [
				"http"
		],
		"traffic": "any(http.request.uri.content_category[*] in {169 177}) or any(http.request.domains[*] in $<DOMAIN_ISOLATE_LIST_UUID>)"
	}'
resource "cloudflare_zero_trust_gateway_policy" "all_http_domain_isolate" {
  account_id  = var.cloudflare_account_id
  name        = "All-HTTP-Domain-Isolate"
  description = "Isolate high risk domains or create a custom list of known risky domains to avoid data exfiltration or malware infection"
  precedence  = 90
  enabled     = true
  action      = "isolate"
  filters     = ["http"]
  traffic     = "any(http.request.uri.content_category[*] in {169 177}) or any(http.request.domains[*] in ${"$"}{cloudflare_zero_trust_list.domain_isolate_list.id})"
}

役に立ちましたか？