🔐 Zero-Trust

2025-12-172025-12-17

This document outlines the implementation of Zero-Trust security principles using Cloudflare's Zero Trust platform. The goal is to enhance the security posture of our organization by ensuring that all devices and users are authenticated and authorized before accessing resources, regardless of their location.

🛡️ Zero-Trust Applications

We have configured Zero-Trust applications to enforce strict access controls. Each application is protected by policies that require EntraID group membership for access. This ensures that only authorized users can access sensitive applications.

🌐 Application Access Portal

All Zero-Trust applications are accessible via the Cloudflare Access portal:

Portal URL: https://unibeam-trust.cloudflareaccess.com/

Single Sign-On

All applications use EntraID (Azure AD) for authentication. You'll be prompted to authenticate with your organizational credentials on first access.

---

📊 Dashboard Applications

🏭 Production Environments

Dashboard-IL (Pelephone)

• Domain: dashboard.il.unibeam.com
• Environment: Production - Israel
• Session Duration: 12 hours
• Access Groups:
• Unibeam-NAT-Whitelist (IP-based)
• Zero-Trust_Devops
• Zero-Trust-Dashboard
• Zero-Trust-IL
• Logo: Israel Emblem
• Tags: Dashboard, IL, Pelephone, Prod

Dashboard-ATnT

• Domain: dashboard.us.unibeam.com
• Environment: Production - US (AT&T)
• Session Duration: 12 hours
• Access Groups:
• Unibeam-NAT-Whitelist (IP-based)
• Zero-Trust_Devops
• Zero-Trust-ATnT
• Logo: AT&T Logo
• Tags: Dashboard, ATnT, Prod

Dashboard-UB-Global-US

• Domain: dashboard.us2.unibeam.com
• Environment: Production - US Global
• Session Duration: 12 hours
• Access Groups:
• Unibeam-NAT-Whitelist (IP-based)
• Zero-Trust_Devops
• Zero-Trust-US
• Logo: Globe Icon
• Tags: Dashboard, US, Prod, UB-Global-US

🧪 Non-Production Environments

Dashboard-Demo

• Domain: dashboard.demo.unibeam.com
• Environment: Demo
• Session Duration: 12 hours
• Access Groups:
• Unibeam-NAT-Whitelist (IP-based)
• Zero-Trust_Devops
• Zero-Trust-QA
• Zero-Trust-RnD
• Tags: Dashboard, Demo

---

📈 Monitoring Applications (Grafana)

🏭 Production Environments

Grafana-IL (Pelephone)

• Domain: grafana.il.unibeam.com
• Environment: Production - Israel
• Session Duration: 12 hours
• Access Groups:
• Zero-Trust_Devops
• Zero-Trust-RnD
• Zero-Trust-IL
• Logo: Grafana Logo
• Tags: Prod, Grafana, IL, Pelephone

Grafana-ATnT

• Domain: grafana.us.unibeam.com
• Environment: Production - US (AT&T)
• Session Duration: 12 hours
• Access Groups:
• Zero-Trust_Devops
• Zero-Trust-RnD
• Zero-Trust-ATnT
• Tags: Prod, ATnT, Grafana

Grafana-US (UB-Global-US)

• Domain: grafana.us2.unibeam.com
• Environment: Production - US Global
• Session Duration: 12 hours
• Access Groups:
• Zero-Trust_Devops
• Zero-Trust-RnD
• Zero-Trust-ATnT
• Tags: Prod, US, Grafana, UB-Global-US

🔬 POC Environment

Grafana-ATnT-POC

• Domain: grafana.poc.atnt.unibeam.com
• Environment: POC - AT&T
• Session Duration: 12 hours
• Access Groups:
• Zero-Trust_Devops
• Zero-Trust-RnD
• Zero-Trust-ATnT
• Tags: POC, ATnT, Grafana

🧪 Non-Production Environments

Grafana-Demo

• Domain: grafana.demo.unibeam.com
• Environment: Demo
• Session Duration: 12 hours
• Access Groups:
• Zero-Trust_Devops
• Zero-Trust-RnD
• Zero-Trust-QA
• Zero-Trust-Demo
• Tags: Grafana, Demo

Grafana-Dev

• Domain: grafana.dev.unibeam.com
• Environment: Development/POC
• Session Duration: 12 hours
• Access Groups:
• Zero-Trust_Devops
• Zero-Trust-RnD
• Zero-Trust-QA
• Zero-Trust-POC
• Tags: Grafana, DEV, POC

---

🚀 GitOps Applications (ArgoCD)

🏭 Production Environments

ArgoCD-IL (Pelephone)

• Domain: argocd.il.unibeam.com
• Environment: Production - Israel
• Session Duration: 12 hours
• Access Groups:
• Zero-Trust_Devops
• Zero-Trust-RnD
• Logo: ArgoCD Logo
• Tags: ArgoCD, Pelephone, IL

ArgoCD-ATnT

• Domain: argocd.us.unibeam.com
• Environment: Production - US (AT&T)
• Session Duration: 12 hours
• Access Groups:
• Zero-Trust_Devops
• Zero-Trust-RnD
• Tags: ArgoCD, ATnT

ArgoCD-UB-Global-US

• Domain: argocd.us2.unibeam.com
• Environment: Production - US Global
• Session Duration: 12 hours
• Access Groups:
• Zero-Trust_Devops
• Zero-Trust-RnD
• Tags: ArgoCD, US, UB-Global-US

🧪 Non-Production Environments

ArgoCD-Demo

• Domain: argocd.demo.unibeam.com
• Environment: Demo
• Session Duration: 12 hours
• Access Groups:
• Zero-Trust_Devops
• Zero-Trust-RnD
• Tags: ArgoCD, Demo

ArgoCD-Dev

• Domain: argocd.dev.unibeam.com
• Environment: Development/POC
• Session Duration: 12 hours
• Access Groups:
• Zero-Trust_Devops
• Zero-Trust-RnD
• Tags: ArgoCD, DEV, POC

---

📡 Kafka Management (Kafka UI)

🧪 Non-Production Environments

Kafka-UI-Demo

• Domain: kafka-ui.demo.unibeam.com
• Environment: Demo
• Session Duration: 12 hours
• Access Groups:
• Zero-Trust_Devops
• Logo: Apache Kafka Logo
• Tags: Demo, Kafka-UI

Kafka-UI-Dev

• Domain: kafka-ui.dev.unibeam.com
• Environment: Development/POC
• Session Duration: 12 hours
• Access Groups:
• Zero-Trust_Devops
• Tags: DEV, POC, Kafka-UI

Production Kafka UI

Production Kafka UI instances (IL, US, ATnT) are currently disabled in the configuration. They can be enabled by uncommenting the respective blocks in global-variables.tfvars.

---

☸️ AWS EKS Cluster Management (Lens)

Connectivity is done via cloudflared tunnel deployed on each EKS cluster. Access is restricted to the DevOps and RnD teams via EntraID groups. Connection is only available via WARP-enabled devices.

Connectors have routing set up for the following clusters:

• IL Production EKS Cluster
• ATnT Production EKS Cluster
• UB-Global-US Production EKS Cluster
• Dev EKS Cluster
• Demo EKS Cluster

---

📚 Documentation Portal

Docs-Unibeam

• Domain: docs.unibeam.com
• Environment: Global Documentation
• Session Duration: 24 hours
• Access Groups:
• Zero-Trust_Devops
• Zero-Trust-RnD
• Zero-Trust-Support
• Zero-Trust-Docs
• Logo: MkDocs Logo
• Tags: docs

Extended Session

Documentation portal has extended 24-hour sessions to improve user experience during extended reading sessions.

---

🔐 Access Policy Overview

📋 Policy Precedence

Policies are evaluated in order of precedence (lower number = higher priority):

1. Unibeam-NAT-Whitelist (Precedence 1): IP-based bypass for NAT gateways
2. Zero-Trust_Devops (Precedence 1-2): DevOps team access
3. Environment-Specific Groups (Precedence 2-4): IL, ATnT, US, QA, RnD, Support, etc.
4. BlockPolicy (Final): Explicit deny for all others

👥 EntraID Groups

The following EntraID groups are used for access control:

Group Name	Purpose	Typical Members
Zero-Trust_Devops	DevOps engineers	Platform team
Zero-Trust-RnD	Research & Development	Engineering team
Zero-Trust-IL	Israel operations	IL production team
Zero-Trust-ATnT	AT&T operations	US production team
Zero-Trust-US	US Global operations	US global team
Zero-Trust-QA	Quality Assurance	Testing team
Zero-Trust-Demo	Demo environment	Demo users
Zero-Trust-POC	POC environments	POC users
Zero-Trust-Support	Support team	Support engineers
Zero-Trust-Docs	Documentation access	Documentation users
Zero-Trust-Dashboard	Dashboard-specific	Dashboard users
Unibeam-NAT-Whitelist	IP whitelist bypass	NAT gateway IPs

---

🛠️ WARP-Client User/Device Profiles

Currently there are 2 main profiles for user devices per group membership: - DevOps Devices: Full access to all Zero-Trust applications, with device posture checks enabled. - RnD Devices: Access to development demo and prod

⚙️ Standard Configuration

All applications include:

• ✅ Skip Interstitial: Users go directly to applications after authentication
• ✅ App Launcher Visible: Applications appear in the Cloudflare Access portal
• ✅ EntraID SSO: Azure AD integration for authentication
• ✅ Session Management: 12-24 hour sessions with automatic renewal

🔒 Security Features

• 🔒 Multi-Factor Authentication: Enforced via EntraID policies
• 🔒 IP Whitelisting: NAT gateway bypass for production access
• 🔒 Policy Precedence: Layered security with explicit deny-all fallback
• 🔒 Session Expiry: Automatic session termination after configured duration

---

📝 Adding New Applications

To add a new Zero-Trust application:

1. Create Application JSON File in iac/managed-services/components/zero-trust-applications/applications/:

   {
     "name": "My New App",
     "domain": "myapp.environment.unibeam.com",
     "logo_url": "https://example.com/logo.svg",
     "session_duration": "12h",
     "skip_interstitial": true,
     "app_launcher_visible": true,
     "policies": [
       {
         "name": "Zero-Trust_Devops",
         "precedence": 1
       },
       {
         "name": "BlockPolicy",
         "precedence": 2
       }
     ],
     "tags": ["MyApp", "Environment"]
   }
   

File Naming Convention: <app-name>.json (e.g., myapp-demo.json)

1. Application is Auto-Discovered: The Terraform configuration automatically loads all JSON files from the applications/ directory

2. Commit Changes to zero-trust branch in iac repository

3. GitHub Actions will automatically:

4. Run terraform plan
5. Apply changes after review
6. Create Cloudflare Access application

7. Configure DNS CNAME record

8. Verify Access at https://unibeam-trust.cloudflareaccess.com/

DNS Propagation

Allow 1-5 minutes for DNS changes to propagate after Terraform applies.

JSON Validation

Validate your JSON file before committing:

cat myapp-demo.json | jq '.'

📂 Application Directory Structure

iac/managed-services/components/zero-trust-applications/
├── applications/                    # Application definitions (JSON)
│   ├── argocd-demo.json
│   ├── argocd-dev.json
│   ├── argocd-il.json
│   ├── dashboard-atnt.json
│   ├── dashboard-demo.json
│   ├── grafana-demo.json
│   ├── grafana-dev.json
│   ├── kafka-ui-demo.json
│   ├── kafka-ui-dev.json
│   └── docs.json
├── main.tf                          # Terraform configuration
├── providers.tf                     # Cloudflare provider
├── backend.hcl                      # S3 backend config
└── variables.tf                     # Variable definitions

📋 Application JSON Schema

Required Fields: - name: Display name for the application - domain: Full domain (e.g., app.env.unibeam.com) - policies: Array of policy objects with name and precedence

Optional Fields: - logo_url: URL to application logo (default: Cloudflare logo) - session_duration: Session timeout (default: 12h) - skip_interstitial: Skip Cloudflare interstitial page (default: true) - app_launcher_visible: Show in Access portal (default: true) - tags: Array of tags for organization (default: []) - cors_headers: CORS configuration for API applications (optional)

Example with CORS:

{
  "name": "API Service",
  "domain": "api.demo.unibeam.com",
  "session_duration": "24h",
  "cors_headers": {
    "allow_credentials": true,
    "allowed_methods": ["GET", "POST", "PUT", "DELETE"],
    "allowed_origins": ["https://dashboard.demo.unibeam.com"],
    "allowed_headers": ["Authorization", "Content-Type"],
    "max_age": 3600
  },
  "policies": [
    {
      "name": "Zero-Trust_Devops",
      "precedence": 1
    }
  ],
  "tags": ["API", "Demo"]
}

---

🔄 Maintenance

📅 Regular Tasks

• Quarterly Review: Audit EntraID group memberships
• Session Duration: Review and adjust based on security requirements
• IP Whitelist: Update NAT gateway IPs as infrastructure changes
• Policy Updates: Adjust policies based on access patterns
• Application Cleanup: Remove unused application JSON files

🔧 Configuration Updates

All Zero-Trust configuration is managed via Terraform in the iac repository:

• Applications Directory: managed-services/components/zero-trust-applications/applications/
• Global Config: managed-services/global-variables.tfvars
• IP Whitelist: managed-services/components/zero-trust-policy/ip_list.txt
• Branch: zero-trust
• Deployment: Automated via GitHub Actions

Best Practice

Always test configuration changes in non-production environments (Dev/Demo) before applying to production.

🗂️ Managing Applications

Add New Application: 1. Create JSON file in applications/ directory 2. Commit to zero-trust branch 3. GitHub Actions deploys automatically

Modify Existing Application: 1. Edit JSON file in applications/ directory 2. Commit changes 3. Terraform updates application configuration

Remove Application: 1. Delete JSON file from applications/ directory 2. Commit changes 3. Terraform destroys Cloudflare resources (with prune: true)

Destructive Action

Deleting an application JSON file will remove the Cloudflare Access application and DNS records. Ensure this is intentional before committing.

🔍 Viewing All Applications

List all configured applications:

cd iac/managed-services/components/zero-trust-applications/applications
ls -1 *.json

View application details:

cat grafana-demo.json | jq '.'

Search for applications by tag:

grep -l '"Demo"' *.json

---