推奨ネットワークポリシー

resource "cloudflare_zero_trust_gateway_policy" "quarantined_users_net_restricted_access" {
  account_id  = var.cloudflare_account_id
  name        = "Quarantined-Users-NET-Restricted-Access"
  description = "Restrict access for users included in an IdP user group for risky users"
  precedence  = 0
  enabled     = true
  action      = "block"
  filters     = ["l4"]
  traffic     = "not(net.dst.ip in ${"$"}${cloudflare_zero_trust_list.ip_allowlist.id}) or not(net.sni.host in ${"$"}${cloudflare_zero_trust_list.host_allowlist.id}) or not(any(net.sni.domains[*] in ${"$"}${cloudflare_zero_trust_list.domain_allowlist.id}))"
  identity    = "any(identity.groups.name[*] in {\"Quarantined Users\"})"
}

resource "cloudflare_zero_trust_gateway_policy" "posture_fail_net_restricted_access" {
  account_id  = var.cloudflare_account_id
  name        = "Posture-Fail-NET-Restricted-Access"
  description = "Restrict access for devices where baseline posture checks have not passed"
  precedence  = 10
  enabled     = true
  action      = "block"
  filters     = ["l4"]
  traffic     = "not(net.dst.ip in ${"$"}${cloudflare_zero_trust_list.ip_allowlist.id}) or not(net.sni.host in ${"$"}${cloudflare_zero_trust_list.host_allowlist.id}) or not(any(net.sni.domains[*] in ${"$"}${cloudflare_zero_trust_list.domain_allowlist.id}))"
  device_posture = "not(any(device_posture.checks.passed[*] in {\"${cloudflare_device_posture_rule.baseline_check.id}\"}))"
}

resource "cloudflare_zero_trust_gateway_policy" "finance_users_net_https_finance_servers" {
  account_id  = var.cloudflare_account_id
  name        = "FinanceUsers-NET-HTTPS-FinanceServers"
  description = "Allow HTTPS access for user groups"
  precedence  = 20
  enabled     = true
  action      = "allow"
  filters     = ["l4"]
  traffic     = "net.dst.ip in ${"$"}${cloudflare_zero_trust_list.finance_servers_list.id}"
  identity    = "any(identity.groups.name[*] in {\"Finance Users\"})"
}

resource "cloudflare_zero_trust_gateway_policy" "finance_users_net_https_finance_servers" {
  account_id  = var.cloudflare_account_id
  name        = "All-NET-Internet-Blocklist"
  description = "Block traffic to malicious or risky destination IPs, SNIs, and SNI domains"
  precedence  = 30
  enabled     = true
  action      = "block"
  filters     = ["l4"]
  traffic     = "net.dst.ip in ${"$"}${cloudflare_zero_trust_list.ip_blocklist.id} and net.sni.host in ${"$"}${cloudflare_zero_trust_list.host_blocklist.id} and any(net.sni.domains[*] in ${"$"}${cloudflare_zero_trust_list.domain_blocklist.id})"
}

resource "cloudflare_zero_trust_gateway_policy" "all_net_ssh_internet_allowlist" {
  account_id  = var.cloudflare_account_id
  name        = "All-NET-SSH-Internet-Allowlist"
  description = "Allow SSH traffic to specific endpoints on the Internet for specific users"
  precedence  = 40
  enabled     = true
  action      = "allow"
  filters     = ["l4"]
  traffic     = "net.dst.ip in ${"$"}${cloudflare_zero_trust_list.ssh_ip_allowlist.id} and net.sni.host in ${"$"}${cloudflare_zero_trust_list.ssh_fqdn_allowlist.id} and net.detected_protocol == \"ssh\""
  identity    = "any(identity.groups.name[*] in {\"SSH-Allowed-Users\"})"
}

resource "cloudflare_zero_trust_gateway_policy" "all_net_no_http_https_internet_deny" {
  account_id  = var.cloudflare_account_id
  name        = "All-NET-NO-HTTP-HTTPS-Internet-Deny"
  description = "Block all non-web traffic towards the Internet"
  precedence  = 50
  enabled     = true
  action      = "block"
  filters     = ["l4"]
  traffic     = "not(net.dst.ip in ${"$"}${cloudflare_zero_trust_list.internal_network_ip_list.id}) and not(net.detected_protocol in {\"http\" \"http2\"})"
}

resource "cloudflare_zero_trust_gateway_policy" "all_net_internalnetwork_implicitdeny" {
  account_id  = var.cloudflare_account_id
  name        = "All-NET-InternalNetwork-ImplicitDeny"
  description = "Implicitly deny all of your internal IP ranges included in a list"
  precedence  = 60
  enabled     = true
  action      = "block"
  filters     = ["l4"]
  traffic     = "net.dst.ip in ${"$"}${cloudflare_zero_trust_list.internal_network_ip_list.id}"
}

resource "cloudflare_zero_trust_gateway_policy" "all_net_applicationaccess_allow" {
  account_id  = var.cloudflare_account_id
  name        = "All-NET-ApplicationAccess-Allow"
  description = "Ensure access to the application comes from authorized WARP clients"
  precedence  = 70
  enabled     = false
  action      = "block"
  filters     = ["l4"]
  traffic     = "any(net.sni.domains[*] == \"internalapp.com\")"
	posture			=	"not(any(device_posture.checks.passed[*] in {\"${"$"}${cloudflare_zero_trust_list.allowed_devices_sn_list.id}\"}))"
}